details: https://hg.nginx.org/njs/rev/884100020b1b
branches:
changeset: 2119:884100020b1b
user: Dmitry Volyntsev <xeioex@nginx.com>
date: Wed May 17 00:39:45 2023 -0700
description:
Fixed evaluation of computed property names with function expressions.

Previously, while evaluating a property name expression with a function
expression as the right side, the evaluation modified the value used to
compute the property name in-place. The in-place modification changes
values not intended to be changed.

The issue was introduced in 74d30c2d70f3 (0.7.8).

This fixes #640 issue on Github.

diffstat:

src/njs_generator.c | 13 +++++++++++++
src/test/njs_unit_test.c | 3 +++
2 files changed, 16 insertions(+), 0 deletions(-)

diffs (43 lines):

diff -r 71fa2f4b6adb -r 884100020b1b src/njs_generator.c
--- a/src/njs_generator.c Fri May 12 19:38:29 2023 -0400
+++ b/src/njs_generator.c Wed May 17 00:39:45 2023 -0700
@@ -3247,6 +3247,12 @@ njs_generate_assignment_end(njs_vm_t *vm
njs_generate_code(generator, njs_vmcode_2addr_t, to_prop_key,
NJS_VMCODE_TO_PROPERTY_KEY, 2, property);

+ prop_index = njs_generate_temp_index_get(vm, generator,
+ property);
+ if (njs_slow_path(prop_index == NJS_INDEX_ERROR)) {
+ return NJS_ERROR;
+ }
+
to_prop_key->src = property->index;
to_prop_key->dst = prop_index;

@@ -3277,6 +3283,13 @@ njs_generate_assignment_end(njs_vm_t *vm
prop_set->object = object->index;
prop_set->property = prop_index;

+ if (prop_index != property->index) {
+ ret = njs_generate_index_release(vm, generator, prop_index);
+ if (njs_slow_path(ret != NJS_OK)) {
+ return ret;
+ }
+ }
+
node->index = expr->index;
node->temporary = expr->temporary;

diff -r 71fa2f4b6adb -r 884100020b1b src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c Fri May 12 19:38:29 2023 -0400
+++ b/src/test/njs_unit_test.c Wed May 17 00:39:45 2023 -0700
@@ -3922,6 +3922,9 @@ static njs_unit_test_t njs_test[] =
{ njs_str("var named = Symbol('xxx'); ({[named]: () => {}})[named].name"),
njs_str("[xxx]") },

+ { njs_str("var obj = {}; ({[obj](){}}); typeof obj"),
+ njs_str("object") },
+
{ njs_str("var called = false;"
"({"
" [{toString(){ if (called) throw 'OOps'; called = true; return 'a'}}](){}"
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
https://mailman.nginx.org/mailman/listinfo/nginx-devel