mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 10:47:44 +00:00
LibJS: Take a pointer in get_or_prune_cached_prototype_transition()
Prototypes can be set to null, and while the previous version also kinda allowed null (by not reading through the null reference), it was making UBSAN very sad.
This commit is contained in:
parent
db98ed5ed0
commit
36516a4c47
2 changed files with 4 additions and 4 deletions
|
@ -36,9 +36,9 @@ Shape* Shape::get_or_prune_cached_forward_transition(TransitionKey const& key)
|
|||
return it->value;
|
||||
}
|
||||
|
||||
Shape* Shape::get_or_prune_cached_prototype_transition(Object& prototype)
|
||||
Shape* Shape::get_or_prune_cached_prototype_transition(Object* prototype)
|
||||
{
|
||||
auto it = m_prototype_transitions.find(&prototype);
|
||||
auto it = m_prototype_transitions.find(prototype);
|
||||
if (it == m_prototype_transitions.end())
|
||||
return nullptr;
|
||||
if (!it->value) {
|
||||
|
@ -71,7 +71,7 @@ Shape* Shape::create_configure_transition(const StringOrSymbol& property_name, P
|
|||
|
||||
Shape* Shape::create_prototype_transition(Object* new_prototype)
|
||||
{
|
||||
if (auto* existing_shape = get_or_prune_cached_prototype_transition(*new_prototype))
|
||||
if (auto* existing_shape = get_or_prune_cached_prototype_transition(new_prototype))
|
||||
return existing_shape;
|
||||
auto* new_shape = heap().allocate_without_global_object<Shape>(*this, new_prototype);
|
||||
m_prototype_transitions.set(new_prototype, new_shape);
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue