fergalmoran/ladybird
1
0
Fork 0
mirror of https://github.com/fergalmoran/ladybird.git synced 2025-12-30 13:19:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

LibJS: Fix Object::delete_property() with numeric string property

Browse Source 
- We have to check if the property name is a string before calling
  as_string() on it
- We can't as_number() the same property name but have to use the parsed
  index number

Fixes #3950.
This commit is contained in:
Linus Groh
2020-11-04 23:31:47 +00:00
committed by Andreas Kling
parent 8d96f428ef
commit 0bb66890c8
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
Libraries/LibJS/Runtime/Object.cpp
View File

@@ -631,9 +631,12 @@ Value Object::delete_property(const PropertyName& property_name)
if (property_name.is_number())
return Value(m_indexed_properties.remove(property_name.as_number()));
int property_index = property_name.as_string().to_int().value_or(-1);
if (property_index >= 0)
return Value(m_indexed_properties.remove(property_name.as_number()));
if (property_name.is_string()) {
i32 property_index = property_name.as_string().to_int().value_or(-1);
if (property_index >= 0)
return Value(m_indexed_properties.remove(property_index));
}
auto metadata = shape().lookup(property_name.to_string_or_symbol());
if (!metadata.has_value())