RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 10:48:11 +00:00
Code Issues Activity Actions

LibJS: Oops, "instanceof" was backwards!

Browse source 
Fix the "instanceof" operator to check if the constructor's prototype
property occurs anywhere in the prototype chain of the instance object.

This patch also adds Object.setPrototypeOf() to make it possible to
create a test for this bug.

Thanks to DexesTTP for pointing this out! :^)
This commit is contained in:
Andreas Kling 2020-03-28 19:48:12 +01:00
parent e5ebdb9bca
commit 82ca7ae1f8
5 changed files with 53 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

15
Libraries/LibJS/Runtime/Value.cpp
View file

@ -259,20 +259,11 @@ Value instance_of(Value lhs, Value rhs)
if (!lhs.is_object() || !rhs.is_object())
return Value(false);
auto* instance_prototype = lhs.as_object()->prototype();
if (!instance_prototype)
auto constructor_prototype_property = rhs.as_object()->get("prototype");
if (!constructor_prototype_property.has_value() || !constructor_prototype_property.value().is_object())
return Value(false);
for (auto* constructor_object = rhs.as_object(); constructor_object; constructor_object = constructor_object->prototype()) {
auto prototype_property = constructor_object->get_own_property(*constructor_object, "prototype");
if (!prototype_property.has_value())
continue;
if (prototype_property.value().is_object() && prototype_property.value().as_object() == instance_prototype)
return Value(true);
}
return Value(false);
return Value(lhs.as_object()->has_prototype(constructor_prototype_property.value().as_object()));
}
const LogStream& operator<<(const LogStream& stream, const Value& value)