Don't use UINT_MAX as invalid array index in PropertyKey

Technically UINT_MAX is actually a valid array index, although that is
an academic problem right now. However, we do have a method
isArrayIndex() and should just use that to determine if a PropertyKey is
an array index.

Fixes: QTBUG-73893
Change-Id: I302e7894331ed2ab4717f7d8d6cc7d8974dabb4e
Reviewed-by: Erik Verbruggen <[email protected]>

1 files changed, 35 insertions, 23 deletions

diff --git a/src/qml/jsruntime/qv4argumentsobject.cpp b/src/qml/jsruntime/qv4argumentsobject.cpp
index 4a21f62cf2..98e0ef9e70 100644
--- a/src/qml/jsruntime/qv4argumentsobject.cpp
+++ b/src/qml/jsruntime/qv4argumentsobject.cpp
@@ -116,6 +116,9 @@ bool ArgumentsObject::virtualDefineOwnProperty(Managed *m, PropertyKey id, const
 {
     ArgumentsObject *args = static_cast<ArgumentsObject *>(m);
     args->fullyCreate();
+    if (!id.isArrayIndex())
+        return Object::virtualDefineOwnProperty(m, id, desc, attrs);
+
     uint index = id.asArrayIndex();
 
     if (!args->isMapped(index))
@@ -148,36 +151,42 @@ bool ArgumentsObject::virtualDefineOwnProperty(Managed *m, PropertyKey id, const
 
 ReturnedValue ArgumentsObject::virtualGet(const Managed *m, PropertyKey id, const Value *receiver, bool *hasProperty)
 {
-    const ArgumentsObject *args = static_cast<const ArgumentsObject *>(m);
-    uint index = id.asArrayIndex();
-    if (index < args->d()->argCount && !args->d()->fullyCreated) {
-        if (hasProperty)
-            *hasProperty = true;
-        return args->context()->args()[index].asReturnedValue();
+    if (id.isArrayIndex()) {
+        const ArgumentsObject *args = static_cast<const ArgumentsObject *>(m);
+        uint index = id.asArrayIndex();
+        if (index < args->d()->argCount && !args->d()->fullyCreated) {
+            if (hasProperty)
+                *hasProperty = true;
+            return args->context()->args()[index].asReturnedValue();
+        }
+
+        if (args->isMapped(index)) {
+            Q_ASSERT(index < static_cast<uint>(args->context()->function->formalParameterCount()));
+            if (hasProperty)
+                *hasProperty = true;
+            return args->context()->args()[index].asReturnedValue();
+        }
     }
 
-    if (!args->isMapped(index))
-        return Object::virtualGet(m, id, receiver, hasProperty);
-    Q_ASSERT(index < static_cast<uint>(args->context()->function->formalParameterCount()));
-    if (hasProperty)
-        *hasProperty = true;
-    return args->context()->args()[index].asReturnedValue();
+    return Object::virtualGet(m, id, receiver, hasProperty);
 }
 
 bool ArgumentsObject::virtualPut(Managed *m, PropertyKey id, const Value &value, Value *receiver)
 {
-    ArgumentsObject *args = static_cast<ArgumentsObject *>(m);
-    uint index = id.asArrayIndex();
-
-    if (args == receiver && index < args->d()->argCount && !args->d()->fullyCreated) {
-        args->context()->setArg(index, value);
-        return true;
+    if (id.isArrayIndex()) {
+        ArgumentsObject *args = static_cast<ArgumentsObject *>(m);
+        uint index = id.asArrayIndex();
+
+        if (args == receiver && index < args->d()->argCount && !args->d()->fullyCreated) {
+            args->context()->setArg(index, value);
+            return true;
+        }
+
+        bool isMapped = (args == receiver && args->isMapped(index));
+        if (isMapped)
+            args->context()->setArg(index, value);
     }
 
-    bool isMapped = (args == receiver && args->isMapped(index));
-    if (isMapped)
-        args->context()->setArg(index, value);
-
     return Object::virtualPut(m, id, value, receiver);
 }
 
@@ -186,13 +195,16 @@ bool ArgumentsObject::virtualDeleteProperty(Managed *m, PropertyKey id)
     ArgumentsObject *args = static_cast<ArgumentsObject *>(m);
     args->fullyCreate();
     bool result = Object::virtualDeleteProperty(m, id);
-    if (result)
+    if (result && id.isArrayIndex())
         args->removeMapping(id.asArrayIndex());
     return result;
 }
 
 PropertyAttributes ArgumentsObject::virtualGetOwnProperty(const Managed *m, PropertyKey id, Property *p)
 {
+    if (!id.isArrayIndex())
+        return Object::virtualGetOwnProperty(m, id, p);
+
     const ArgumentsObject *args = static_cast<const ArgumentsObject *>(m);
     uint index = id.asArrayIndex();
     if (index < args->d()->argCount && !args->d()->fullyCreated) {