Don't use UINT_MAX as invalid array index in PropertyKey

Technically UINT_MAX is actually a valid array index, although that is
an academic problem right now. However, we do have a method
isArrayIndex() and should just use that to determine if a PropertyKey is
an array index.

Fixes: QTBUG-73893
Change-Id: I302e7894331ed2ab4717f7d8d6cc7d8974dabb4e
Reviewed-by: Erik Verbruggen <erik.verbruggen@qt.io>

1 files changed, 7 insertions, 11 deletions

diff --git a/src/qml/jsruntime/qv4object.cpp b/src/qml/jsruntime/qv4object.cpp
index efab9a6454..206b410cf4 100644
--- a/src/qml/jsruntime/qv4object.cpp
+++ b/src/qml/jsruntime/qv4object.cpp
@@ -406,8 +406,8 @@ ReturnedValue Object::internalGet(PropertyKey id, const Value *receiver, bool *h
 {
     Heap::Object *o = d();
 
-    uint index = id.asArrayIndex();
-    if (index != UINT_MAX) {
+    if (id.isArrayIndex()) {
+        const uint index = id.asArrayIndex();
         Scope scope(this);
         PropertyAttributes attrs;
         ScopedProperty pd(scope);
@@ -431,8 +431,6 @@ ReturnedValue Object::internalGet(PropertyKey id, const Value *receiver, bool *h
                 break;
         }
     } else {
-        Q_ASSERT(!id.isArrayIndex());
-
         while (1) {
             auto idx = o->internalClass->findValueOrGetter(id);
             if (idx.isValid()) {
@@ -470,14 +468,13 @@ bool Object::internalPut(PropertyKey id, const Value &value, Value *receiver)
         if (d()->internalClass->vtable->getOwnProperty == Object::virtualGetOwnProperty) {
             // This object standard methods in the vtable, so we can take a shortcut
             // and avoid the calls to getOwnProperty and defineOwnProperty
-            uint index = id.asArrayIndex();
 
             PropertyAttributes attrs;
             PropertyIndex propertyIndex{nullptr, nullptr};
 
-            if (index != UINT_MAX) {
+            if (id.isArrayIndex()) {
                 if (arrayData())
-                    propertyIndex = arrayData()->getValueOrSetter(index, &attrs);
+                    propertyIndex = arrayData()->getValueOrSetter(id.asArrayIndex(), &attrs);
             } else {
                 auto member = internalClass()->findValueOrSetter(id);
                 if (member.isValid()) {
@@ -546,12 +543,11 @@ bool Object::internalPut(PropertyKey id, const Value &value, Value *receiver)
 
     if (r->internalClass()->vtable->defineOwnProperty == virtualDefineOwnProperty) {
         // standard object, we can avoid some more checks
-        uint index = id.asArrayIndex();
-        if (index == UINT_MAX) {
+        if (id.isArrayIndex()) {
+            r->arraySet(id.asArrayIndex(), value);
+        } else {
             ScopedStringOrSymbol s(scope, id.asStringOrSymbol());
             r->insertMember(s, value);
-        } else {
-            r->arraySet(index, value);
         }
         return true;
     }