mirrors/JetBrainsRuntime
1
0
Fork 0
mirror of https://github.com/JetBrains/JetBrainsRuntime.git synced 2026-01-09 10:01:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

8176511: JSObject property access is broken for numeric keys outside the int range

Browse Source 
Reviewed-by: sundar
This commit is contained in:
Hannes Wallnöfer
2017-03-10 18:30:39 +01:00
parent ff81e44c2c
commit f36a94bedc
2 changed files with 58 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/linker/JSObjectLinker.java
View File

@@ -176,6 +176,8 @@ final class JSObjectLinker implements TypeBasedGuardingDynamicLinker {
final int index = getIndex((Number)key);
if (index > -1) {
return ((JSObject)jsobj).getSlot(index);
} else {
return ((JSObject)jsobj).getMember(JSType.toString(key));
}
} else if (isString(key)) {
final String name = key.toString();
@@ -193,7 +195,12 @@ final class JSObjectLinker implements TypeBasedGuardingDynamicLinker {
if (key instanceof Integer) {
((JSObject)jsobj).setSlot((Integer)key, value);
} else if (key instanceof Number) {
((JSObject)jsobj).setSlot(getIndex((Number)key), value);
final int index = getIndex((Number)key);
if (index > -1) {
((JSObject)jsobj).setSlot(index, value);
} else {
((JSObject)jsobj).setMember(JSType.toString(key), value);
}
} else if (isString(key)) {
((JSObject)jsobj).setMember(key.toString(), value);
}

50
nashorn/test/script/basic/JDK-8176511.js Normal file
View File

@@ -0,0 +1,50 @@
/*
* Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* JDK-8176511: JSObject property access is broken for numeric keys outside the int range
*
* @test
* @run
*/
var reassignWithNewGlobal = loadWithNewGlobal({
script: '(function (o, i) { o[i] = o[i]; })', name: 'internal.js'
});
function test(i) {
var o = {};
o[i] = true;
var before = JSON.stringify(o);
reassignWithNewGlobal(o, i);
var after = JSON.stringify(o);
Assert.assertEquals(before, after);
}
test(-2147483649);
test(-2147483648);
test(2147483647);
test(2147483648);