YourWishes/jerryscript
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prevent fast access mode arrays from low-level property management methods (#3047)

Browse Source 
This patch fixes #3043 and fixes #3045 and fixes #3046.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
This commit is contained in:
Robert Fancsik
2019-09-04 10:41:29 +02:00
committed by Dániel Bátyai
parent 3e661c0c5a
commit 1088273bc3
12 changed files with 141 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jerry-core/vm/opcodes.c
+4
View File
@@ -91,6 +91,10 @@ opfunc_set_accessor (bool is_getter, /**< is getter accessor */
ecma_value_t accessor) /**< accessor value */
{
ecma_object_t *object_p = ecma_get_object_from_value (object);
JERRY_ASSERT (ecma_get_object_type (object_p) != ECMA_OBJECT_TYPE_ARRAY
|| !((ecma_extended_object_t *) object_p)->u.array.is_fast_mode);
ecma_property_t *property_p = ecma_find_named_property (object_p, accessor_name_p);
if (property_p != NULL
jerry-core/vm/vm.c
+4
View File
@@ -1259,6 +1259,10 @@ vm_loop (vm_frame_ctx_t *frame_ctx_p) /**< frame context */
#endif /* ENABLED (JERRY_ES2015_CLASS) */
ecma_object_t *object_p = ecma_get_object_from_value (stack_top_p[index]);
JERRY_ASSERT (ecma_get_object_type (object_p) != ECMA_OBJECT_TYPE_ARRAY
|| !((ecma_extended_object_t *) object_p)->u.array.is_fast_mode);
ecma_property_t *property_p = ecma_find_named_property (object_p, prop_name_p);
if (property_p != NULL