details: https://hg.nginx.org/njs/rev/884100020b1b branches: changeset: 2119:884100020b1b user: Dmitry Volyntsev <xei...@nginx.com> date: Wed May 17 00:39:45 2023 -0700 description: Fixed evaluation of computed property names with function expressions.
Previously, while evaluating a property name expression with a function expression as the right side, the evaluation modified the value used to compute the property name in-place. The in-place modification changes values not intended to be changed. The issue was introduced in 74d30c2d70f3 (0.7.8). This fixes #640 issue on Github. diffstat: src/njs_generator.c | 13 +++++++++++++ src/test/njs_unit_test.c | 3 +++ 2 files changed, 16 insertions(+), 0 deletions(-) diffs (43 lines): diff -r 71fa2f4b6adb -r 884100020b1b src/njs_generator.c --- a/src/njs_generator.c Fri May 12 19:38:29 2023 -0400 +++ b/src/njs_generator.c Wed May 17 00:39:45 2023 -0700 @@ -3247,6 +3247,12 @@ njs_generate_assignment_end(njs_vm_t *vm njs_generate_code(generator, njs_vmcode_2addr_t, to_prop_key, NJS_VMCODE_TO_PROPERTY_KEY, 2, property); + prop_index = njs_generate_temp_index_get(vm, generator, + property); + if (njs_slow_path(prop_index == NJS_INDEX_ERROR)) { + return NJS_ERROR; + } + to_prop_key->src = property->index; to_prop_key->dst = prop_index; @@ -3277,6 +3283,13 @@ njs_generate_assignment_end(njs_vm_t *vm prop_set->object = object->index; prop_set->property = prop_index; + if (prop_index != property->index) { + ret = njs_generate_index_release(vm, generator, prop_index); + if (njs_slow_path(ret != NJS_OK)) { + return ret; + } + } + node->index = expr->index; node->temporary = expr->temporary; diff -r 71fa2f4b6adb -r 884100020b1b src/test/njs_unit_test.c --- a/src/test/njs_unit_test.c Fri May 12 19:38:29 2023 -0400 +++ b/src/test/njs_unit_test.c Wed May 17 00:39:45 2023 -0700 @@ -3922,6 +3922,9 @@ static njs_unit_test_t njs_test[] = { njs_str("var named = Symbol('xxx'); ({[named]: () => {}})[named].name"), njs_str("[xxx]") }, + { njs_str("var obj = {}; ({[obj](){}}); typeof obj"), + njs_str("object") }, + { njs_str("var called = false;" "({" " [{toString(){ if (called) throw 'OOps'; called = true; return 'a'}}](){}" _______________________________________________ nginx-devel mailing list nginx-devel@nginx.org https://mailman.nginx.org/mailman/listinfo/nginx-devel