[njs] Fixed Array.prototype.fill() when start object changes "this".

[Dmitry Volyntsev]

details:   https://hg.nginx.org/njs/rev/94b370d9aa13
branches:  
changeset: 1989:94b370d9aa13
user:      Dmitry Volyntsev <xeioex at nginx.com>
date:      Mon Nov 07 14:22:41 2022 -0800
description:
Fixed Array.prototype.fill() when start object changes "this".

This fixed #589, #599 issues on Github.

diffstat:

 src/njs_array.c          |  27 ++++++++++-----------------
 src/njs_object.c         |   5 +++++
 src/test/njs_unit_test.c |   9 +++++++++
 3 files changed, 24 insertions(+), 17 deletions(-)

diffs (92 lines):

diff -r b80c24512157 -r 94b370d9aa13 src/njs_array.c
--- a/src/njs_array.c	Mon Nov 07 14:08:28 2022 -0800
+++ b/src/njs_array.c	Mon Nov 07 14:22:41 2022 -0800
@@ -1832,17 +1832,9 @@ njs_array_prototype_fill(njs_vm_t *vm, n
         return ret;
     }
 
-    array = NULL;
-
-    if (njs_is_fast_array(this)) {
-        array = njs_array(this);
-        length = array->length;
-
-    } else {
-        ret = njs_object_length(vm, this, &length);
-        if (njs_slow_path(ret == NJS_ERROR)) {
-            return ret;
-        }
+    ret = njs_object_length(vm, this, &length);
+    if (njs_slow_path(ret == NJS_ERROR)) {
+        return ret;
     }
 
     ret = njs_value_to_integer(vm, njs_arg(args, nargs, 2), &start);
@@ -1866,18 +1858,19 @@ njs_array_prototype_fill(njs_vm_t *vm, n
 
     value = njs_arg(args, nargs, 1);
 
-    if (array != NULL) {
+    if (njs_is_fast_array(this)) {
+        array = njs_array(this);
+        end = njs_min(end, array->length);
+
         for (i = start; i < end; i++) {
-            array->start[i] = *value;
+            njs_value_assign(&array->start[i], value);
         }
 
-        vm->retval = *this;
+        njs_value_assign(&vm->retval, this);
 
         return NJS_OK;
     }
 
-    value = njs_arg(args, nargs, 1);
-
     while (start < end) {
         ret = njs_value_property_i64_set(vm, this, start++, value);
         if (njs_slow_path(ret == NJS_ERROR)) {
@@ -1885,7 +1878,7 @@ njs_array_prototype_fill(njs_vm_t *vm, n
         }
     }
 
-    vm->retval = *this;
+    njs_value_assign(&vm->retval, this);
 
     return NJS_OK;
 }
diff -r b80c24512157 -r 94b370d9aa13 src/njs_object.c
--- a/src/njs_object.c	Mon Nov 07 14:08:28 2022 -0800
+++ b/src/njs_object.c	Mon Nov 07 14:22:41 2022 -0800
@@ -2505,6 +2505,11 @@ njs_object_length(njs_vm_t *vm, njs_valu
 
     const njs_value_t  string_length = njs_string("length");
 
+    if (njs_is_fast_array(value)) {
+        *length = njs_array(value)->length;
+        return NJS_OK;
+    }
+
     ret = njs_value_property(vm, value, njs_value_arg(&string_length),
                              &value_length);
     if (njs_slow_path(ret == NJS_ERROR)) {
diff -r b80c24512157 -r 94b370d9aa13 src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c	Mon Nov 07 14:08:28 2022 -0800
+++ b/src/test/njs_unit_test.c	Mon Nov 07 14:22:41 2022 -0800
@@ -5549,6 +5549,15 @@ static njs_unit_test_t  njs_test[] =
                  "Array.prototype.fill.call(o, 2).a"),
       njs_str("4") },
 
+    { njs_str("var a = (new Array(2**10)).fill(0);"
+              "var start = {valueOf() {"
+              "                 var len = a.length - 2;"
+              "                 for (var i = 0; i < len; i++) { a.shift(); }; "
+              "                 return 0;"
+              "            }};"
+              "a.fill('xxx', start)"),
+      njs_str("xxx,xxx") },
+
     { njs_str("Array.prototype.fill.call(new Int32Array(1))"),
       njs_str("0") },