[njs] Fixed Object.freeze() with fast arrays.

[Vadim Zhestikov]

details:   https://hg.nginx.org/njs/rev/d40481363bdf
branches:  
changeset: 1948:d40481363bdf
user:      Vadim Zhestikov <v.zhestikov at f5.com>
date:      Tue Sep 06 11:13:31 2022 -0700
description:
Fixed Object.freeze() with fast arrays.

Previously, Object.freeze() failed to freeze the 'length' property of a fast array.

diffstat:

 src/njs_object.c         |  13 ++++++++++++-
 src/test/njs_unit_test.c |   6 ++++++
 2 files changed, 18 insertions(+), 1 deletions(-)

diffs (50 lines):

diff -r c597cd200724 -r d40481363bdf src/njs_object.c
--- a/src/njs_object.c	Tue Sep 06 10:09:08 2022 -0700
+++ b/src/njs_object.c	Tue Sep 06 11:13:31 2022 -0700
@@ -1553,7 +1553,9 @@ static njs_int_t
 njs_object_set_integrity_level(njs_vm_t *vm, njs_value_t *args,
     njs_uint_t nargs, njs_index_t level)
 {
+    uint32_t           length;
     njs_int_t          ret;
+    njs_array_t        *array;
     njs_value_t        *value;
     njs_lvlhsh_t       *hash;
     njs_object_t       *object;
@@ -1576,10 +1578,19 @@ njs_object_set_integrity_level(njs_vm_t 
     }
 
     if (njs_is_fast_array(value)) {
-        ret = njs_array_convert_to_slow_array(vm, njs_array(value));
+        array = njs_array(value);
+        length = array->length;
+
+        ret = njs_array_convert_to_slow_array(vm, array);
         if (ret != NJS_OK) {
             return ret;
         }
+
+        ret = njs_array_length_redefine(vm, value, length);
+        if (njs_slow_path(ret != NJS_OK)) {
+            return ret;
+        }
+
     }
 
     object = njs_object(value);
diff -r c597cd200724 -r d40481363bdf src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c	Tue Sep 06 10:09:08 2022 -0700
+++ b/src/test/njs_unit_test.c	Tue Sep 06 11:13:31 2022 -0700
@@ -4615,6 +4615,12 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("Object.prototype[1] = 1; Object.prototype.length = 2; Array.prototype.pop.call({0:0})"),
       njs_str("1") },
 
+    { njs_str("var a = []; Object.freeze(a); Object.getOwnPropertyDescriptor(a, 'length').writable"),
+      njs_str("false") },
+
+    { njs_str("var o = Object.freeze([0,1,2]); o.length=3"),
+      njs_str("TypeError: Cannot assign to read-only property \"length\" of array") },
+
     { njs_str("var o = Object.freeze({0: 0, 1: 1, length: 2}); Array.prototype.pop.call(o)"),
       njs_str("TypeError: Cannot delete property \"1\" of object") },