mirror of
https://github.com/RGBCube/serenity
synced 2025-05-28 17:25:06 +00:00
LibJS: Fix crashing exception in Value::ordinary_has_instance()
Two issues: - throw_exception() with ErrorType::InstanceOfOperatorBadPrototype would receive rhs_prototype.to_string_without_side_effects(), which would ASSERT_NOT_REACHED() as to_string_without_side_effects() must not be called on an empty value. It should (and now does) receive the RHS value instead as the message is "'prototype' property of {} is not an object". - Value::instance_of() was missing an exception check after calling has_instance_method, to_boolean() on an empty value result would crash as well. Fixes #3930.
This commit is contained in:
parent
c538e22516
commit
565a26808d
2 changed files with 17 additions and 3 deletions
|
@ -22,3 +22,15 @@ test("derived ES5 classes", () => {
|
|||
expect(d instanceof Derived).toBeTrue();
|
||||
expect(d instanceof Base).toBeTrue();
|
||||
});
|
||||
|
||||
test("issue #3930, instanceof on arrow function", () => {
|
||||
function f() {}
|
||||
const a = () => {};
|
||||
|
||||
expect(() => {
|
||||
f instanceof a;
|
||||
}).toThrow(TypeError);
|
||||
expect(() => {
|
||||
a instanceof a;
|
||||
}).toThrow(TypeError);
|
||||
});
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue