Skip to content

Commit 84cdb60

Browse files
committed
[GR-51680] Fix possible infinite recursion in AbstractJSObjectArray.setElementImpl.
1 parent 159292d commit 84cdb60

File tree

1 file changed

+10
-5
lines changed

1 file changed

+10
-5
lines changed

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/AbstractJSObjectArray.java

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2018, 2023, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2018, 2024, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* The Universal Permissive License (UPL), Version 1.0
@@ -78,10 +78,15 @@ public final ScriptArray setElementImpl(JSDynamicObject object, long index, Obje
7878
}
7979

8080
private ScriptArray rewrite(JSDynamicObject object, long index, Object value) {
81-
if (isSupportedContiguous(object, index)) {
82-
return toContiguous(object, index, value);
83-
} else if (isSupportedHoles(object, index)) {
84-
return toHoles(object, index, value);
81+
if (JSDynamicObject.isJSDynamicObject(value)) {
82+
assert !isSupported(object, index);
83+
if (isSupportedContiguous(object, index)) {
84+
return toContiguous(object, index, value);
85+
} else if (isSupportedHoles(object, index)) {
86+
return toHoles(object, index, value);
87+
} else {
88+
return toSparse(object, index, value);
89+
}
8590
} else {
8691
return toObject(object, index, value);
8792
}

0 commit comments

Comments
 (0)