1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-28 17:25:06 +00:00

LibJS: Fix crashing exception in Value::ordinary_has_instance()

Two issues:

- throw_exception() with ErrorType::InstanceOfOperatorBadPrototype would
  receive rhs_prototype.to_string_without_side_effects(), which would
  ASSERT_NOT_REACHED() as to_string_without_side_effects() must not be
  called on an empty value. It should (and now does) receive the RHS
  value instead as the message is "'prototype' property of {} is not an
  object".
- Value::instance_of() was missing an exception check after calling
  has_instance_method, to_boolean() on an empty value result would crash
  as well.

Fixes #3930.
This commit is contained in:
Linus Groh 2020-11-03 17:54:57 +00:00 committed by Andreas Kling
parent c538e22516
commit 565a26808d
2 changed files with 17 additions and 3 deletions

View file

@ -22,3 +22,15 @@ test("derived ES5 classes", () => {
expect(d instanceof Derived).toBeTrue();
expect(d instanceof Base).toBeTrue();
});
test("issue #3930, instanceof on arrow function", () => {
function f() {}
const a = () => {};
expect(() => {
f instanceof a;
}).toThrow(TypeError);
expect(() => {
a instanceof a;
}).toThrow(TypeError);
});