Skip to content

Commit eb20759

Browse files
committed
[1.10>master] [MERGE #5538 @dilijev] OS#17035705: Mark SetItem as JS_REENTRANT in CopyWithinHelper.
Merge pull request #5538 from dilijev:copywithin-reentrant Found by OSS-Fuzz
2 parents 1158355 + 6127540 commit eb20759

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

lib/Runtime/Library/JavascriptArray.cpp

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9244,8 +9244,10 @@ using namespace Js;
92449244
}
92459245
else if (pArr)
92469246
{
9247-
JS_REENTRANT(jsReentLock, Var val = pArr->DirectGetItem(fromIndex));
9248-
pArr->SetItem(toIndex, val, Js::PropertyOperation_ThrowIfNotExtensible);
9247+
Var val = nullptr;
9248+
JS_REENTRANT(jsReentLock,
9249+
val = pArr->DirectGetItem(fromIndex),
9250+
pArr->SetItem(toIndex, val, Js::PropertyOperation_ThrowIfNotExtensible));
92499251

92509252
if (!JavascriptArray::Is(obj))
92519253
{

0 commit comments

Comments
 (0)