From 6b923039b2961f2929514273340014e408d21634 Mon Sep 17 00:00:00 2001 From: chengyuli Date: Mon, 8 Sep 2025 17:14:23 +0800 Subject: [PATCH] Fix container get crash Issue: https://gitee.com/openharmony/arkcompiler_ets_runtime/issues/ICWY67 Signed-off-by: chengyuli Change-Id: Idead72751c0b441b27c8e40e08999a4163c72263 --- ecmascript/object_fast_operator-inl.h | 6 ++++-- test/moduletest/container/container_deque.js | 13 +++++++++++++ test/moduletest/container/container_stack.js | 12 ++++++++++++ 3 files changed, 29 insertions(+), 2 deletions(-) diff --git a/ecmascript/object_fast_operator-inl.h b/ecmascript/object_fast_operator-inl.h index 9ca4faf4a8..232b4c5140 100644 --- a/ecmascript/object_fast_operator-inl.h +++ b/ecmascript/object_fast_operator-inl.h @@ -1219,10 +1219,12 @@ JSTaggedValue ObjectFastOperator::GetContainerProperty(JSThread *thread, JSTagge res = JSAPIPlainArray::Cast(receiver.GetTaggedObject())->Get(thread, JSTaggedValue(index)); break; case JSType::JS_API_DEQUE: - res = JSAPIDeque::Cast(receiver.GetTaggedObject())->Get(thread, index); + res = JSAPIDeque::GetProperty(thread, JSHandle(thread, receiver), + JSHandle(thread, JSTaggedValue(index))).GetValue().GetTaggedValue(); break; case JSType::JS_API_STACK: - res = JSAPIStack::Cast(receiver.GetTaggedObject())->Get(thread, index); + res = JSAPIStack::GetProperty(thread, JSHandle(thread, receiver), + JSHandle(thread, JSTaggedValue(index))).GetValue().GetTaggedValue(); break; case JSType::JS_API_VECTOR: { auto self = JSHandle(thread, receiver); diff --git a/test/moduletest/container/container_deque.js b/test/moduletest/container/container_deque.js index 87b9794be9..9e7c16a94e 100644 --- a/test/moduletest/container/container_deque.js +++ b/test/moduletest/container/container_deque.js @@ -274,6 +274,19 @@ if (globalThis["ArkPrivate"] != undefined) { Object.assign(v1,v5) print(JSON.stringify(v1)) const v6 = new Deque() + + { + try { + const v1 = new Deque(); + const v4 = Array(4); + v4.__proto__ = v1; + JSON.stringify(v4); + map.set("test deque as _proto_ stringify:", false); + } catch (e) { + + } + } + try { v6[4294967295] } catch (error) { diff --git a/test/moduletest/container/container_stack.js b/test/moduletest/container/container_stack.js index e3587fcb56..8637a56d94 100644 --- a/test/moduletest/container/container_stack.js +++ b/test/moduletest/container/container_stack.js @@ -58,6 +58,18 @@ if (globalThis["ArkPrivate"] != undefined) { map.set("test stack forEach:", res) + { + try{ + const v1 = new Stack(); + const v4 = Array(4); + v4.__proto__ = v1; + JSON.stringify(v4); + map.set("test stack as _proto_ stringify:", false); + } catch (e) { + + } + } + res = true let j = 0 for (const data of proxy) { -- Gitee