Fixed Array.prototype.sort() when arr size is changed in a comparator.

This fixed #468 issue on Github.
nginx · Apr 23, 2022 · 8b39afd · 8b39afd
1 parent 675049d
commit 8b39afd
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/src/njs_array.c b/src/njs_array.c
@@ -2696,7 +2696,7 @@ njs_array_prototype_sort(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
         goto exception;
     }
 
-    if (njs_fast_path(fast_path)) {
+    if (njs_fast_path(fast_path && njs_is_fast_array(this))) {
         array = njs_array(this);
         start = array->start;
 

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
@@ -6989,6 +6989,9 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("[1,2].sort(1)"),
       njs_str("TypeError: comparefn must be callable or undefined") },
 
+    { njs_str("var a = [1,2]; a.sort(() => {a.length = 65535}); a.length"),
+      njs_str("65535") },
+
     /*
       Array.prototype.keys()
       Array.prototype.values()