details: http://hg.nginx.org/njs/rev/e33bea39c650
branches:
changeset: 376:e33bea39c650
user: Igor Sysoev <igor@sysoev.ru>
date: Fri Jun 23 15:27:28 2017 +0300
description:
Fixed processing of large array indexes.

diffstat:

njs/njs_vm.c | 13 +++++++------
njs/test/njs_unit_test.c | 3 +++
2 files changed, 10 insertions(+), 6 deletions(-)

diffs (53 lines):

diff -r 44ca33e6afdb -r e33bea39c650 njs/njs_vm.c
--- a/njs/njs_vm.c Thu Jun 22 18:56:26 2017 +0300
+++ b/njs/njs_vm.c Fri Jun 23 15:27:28 2017 +0300
@@ -73,7 +73,7 @@ struct njs_property_next_s {
static nxt_noinline njs_ret_t njs_property_query(njs_vm_t *vm,
njs_property_query_t *pq, njs_value_t *object, njs_value_t *property);
static njs_ret_t njs_array_property_query(njs_vm_t *vm,
- njs_property_query_t *pq, njs_value_t *object, int32_t index);
+ njs_property_query_t *pq, njs_value_t *object, uint32_t index);
static njs_ret_t njs_object_property_query(njs_vm_t *vm,
njs_property_query_t *pq, njs_value_t *value, njs_object_t *object);
static njs_ret_t njs_method_private_copy(njs_vm_t *vm,
@@ -1054,21 +1054,22 @@ njs_property_query(njs_vm_t *vm, njs_pro

static njs_ret_t
njs_array_property_query(njs_vm_t *vm, njs_property_query_t *pq,
- njs_value_t *object, int32_t index)
+ njs_value_t *object, uint32_t index)
{
- int32_t size;
+ uint32_t size;
njs_ret_t ret;
njs_value_t *value;
njs_array_t *array;

array = object->data.u.array;
- size = index - array->length;
-
- if (size >= 0) {
+
+ if (index >= array->length) {
if (pq->query != NJS_PROPERTY_QUERY_SET) {
return NXT_DECLINED;
}

+ size = index - array->length;
+
ret = njs_array_expand(vm, array, 0, size + 1);
if (nxt_slow_path(ret != NXT_OK)) {
return ret;
diff -r 44ca33e6afdb -r e33bea39c650 njs/test/njs_unit_test.c
--- a/njs/test/njs_unit_test.c Thu Jun 22 18:56:26 2017 +0300
+++ b/njs/test/njs_unit_test.c Fri Jun 23 15:27:28 2017 +0300
@@ -2487,6 +2487,9 @@ static njs_unit_test_t njs_test[] =
{ nxt_string("var a = [ 1, 2, 3 ]; a[4294967296] = 4; a + a[4294967296]"),
nxt_string("1,2,34") },

+ { nxt_string("delete[]['4e9']"),
+ nxt_string("false") },
+
{ nxt_string("var n = 1, a = [ n += 1 ]; a"),
nxt_string("2") },

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel