RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 07:47:35 +00:00
Code Issues Activity Actions

LibJS: VERIFY() that to_object() succeeds in Object.prototype.toString()

Browse source 
As null and undefined are already handled separately, this must not
fail.
This commit is contained in:
Linus Groh 2021-06-13 01:03:41 +01:00
parent 4794e6b0da
commit 1253a3d038
1 changed files with 1 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Userland/Libraries/LibJS/Runtime/ObjectPrototype.cpp
View file

@ -64,8 +64,7 @@ JS_DEFINE_NATIVE_FUNCTION(ObjectPrototype::to_string)
return js_string(vm, "[object Null]");
auto* this_object = this_value.to_object(global_object);
if (!this_object)
return {};
VERIFY(this_object);
String tag;
auto to_string_tag = this_object->get(vm.well_known_symbol_to_string_tag());