mirror of
https://github.com/vercel-labs/scriptc.git
synced 2026-11-05 08:13:06 +08:00
Chris Tate
1501559d4a
An element index the checker types as a number can hold undefined at run time (an element read from a holey array). JavaScript then names the array's "undefined" property, but the index converted with ToNumber, so such reads and writes used the "NaN" property: Node prints `10 0,7,0,7` for a program that sets `values[NaN] = 10` and then writes through two holes, the compiled program printed `7 0,7,0,7`. The runtime's noncanonical property table, which holds the properties named by non-index numbers, now spells one NaN payload (scr_arr_undefined_key) "undefined". At array element reads, writes, compound and update writes, destructuring targets and writes in value position, an index that can be undefined is that key when it is undefined. The property stays a typed entry of the array, so the Int32[] contract checks cover it like any element store. A typed array cannot hold the property: a write through an undefined index throws the catchable SC1090 error where Node adds it. Fixes #1640.