mirror of
https://github.com/fergalmoran/ladybird.git
synced 2026-01-06 16:45:03 +00:00
LibJS: Handle OOB access in GenericIndexedPropertyStorage::take_last()
We already do this for the SimpleIndexedPropertyStorage, so for indexed properties with GenericIndexedPropertyStorage this would previously crash. Since overwriting the array-like size with a larger value won't magically insert values at previously unset indices, we need to handle such an out of bounds access gracefully and just return an empty value. Fixes #7043.
This commit is contained in:
@@ -160,8 +160,9 @@ ValueAndAttributes GenericIndexedPropertyStorage::take_last()
|
||||
m_array_size--;
|
||||
|
||||
auto result = m_sparse_elements.get(m_array_size);
|
||||
if (!result.has_value())
|
||||
return {};
|
||||
m_sparse_elements.remove(m_array_size);
|
||||
VERIFY(result.has_value());
|
||||
return result.value();
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user