From: Dmitry Volyntsev <xeioex@nginx.com>
Date: Fri, 4 Sep 2026 01:47:58 +0000 (-0700)
Subject: Fix Array.prototype.concat() with sparse arrays
X-Git-Tag: 1.0.2~77
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=e68fef653d416056af88884b70cd6252bef2140a;p=njs.git

Fix Array.prototype.concat() with sparse arrays

Previously, the fast concat path represented a missing source property with
njs_value_invalid and still created the corresponding destination property.
For a slow sparse destination this materialized an internal hole sentinel as
a normal property, which later property access could interpret as an invalid
accessor.

The fix is to advance the destination index without creating a property when
the source lookup reports a hole.

The issue was introduced in 232fb594 (0.7.2).

This closes #1095 issue on GitHub.
---

diff --git a/src/njs_array.c b/src/njs_array.c
index 5c30e833..a9ea5143 100644
--- a/src/njs_array.c
+++ b/src/njs_array.c
@@ -1961,7 +1961,7 @@ njs_array_prototype_concat(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
                             return NJS_ERROR;
                         }
 
-                        njs_set_invalid(&value);
+                        continue;
                     }
 
                     ret = njs_value_property_i64_set(vm, &this, length,
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 8ce6c53f..3fc86908 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -5193,6 +5193,11 @@ static njs_unit_test_t  njs_test[] =
               "njs.dump(a2)"),
       njs_str("[3,1,<1111110 empty items>,2,4]") },
 
+    { njs_str("var a = []; a[100000] = 1;"
+              "var b = [].concat(a, [,, 5]);"
+              "[b.length, Object.keys(b), b[100001], b.sort().length]"),
+      njs_str("100004,100000,100003,,100004") },
+
     { njs_str("var re = /abc/; re[Symbol.isConcatSpreadable] = true;"
               "re[0] = 1, re[1] = 2, re[2] = 3, re.length = 3;"
               "[].concat(re)"),