RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-10-31 15:32:46 +00:00
Code Issues Activity Actions

LibJS: Don't assume Object.setPrototypeOf() prototype value is an object

Browse source 
We're crashing otherwise. Also it was not possible to set the prototype
to null.
This commit is contained in:
Linus Groh 2020-06-02 12:25:21 +01:00 • committed by Andreas Kling
parent 1a64bdd80c
commit 8cf1ded478
2 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Libraries/LibJS/Runtime/ObjectConstructor.cpp
View file

@ -102,7 +102,17 @@ Value ObjectConstructor::set_prototype_of(Interpreter& interpreter)
auto* object = interpreter.argument(0).to_object(interpreter);
if (interpreter.exception())
return {};
object->set_prototype(&const_cast<Object&>(interpreter.argument(1).as_object()));
auto prototype_value = interpreter.argument(1);
Object* prototype;
if (prototype_value.is_null()) {
prototype = nullptr;
} else if (prototype_value.is_object()) {
prototype = &prototype_value.as_object();
} else {
interpreter.throw_exception<TypeError>("Prototype must be null or object");
return {};
}
object->set_prototype(prototype);
return object;
}

7
Libraries/LibJS/Tests/Object.setPrototypeOf.js
View file

@ -3,6 +3,13 @@ load("test-common.js");
try {
assert(Object.setPrototypeOf.length === 2);
assertThrowsError(() => {
Object.setPrototypeOf({}, "foo");
}, {
error: TypeError,
message: "Prototype must be null or object"
});
o = {};
assert(Object.setPrototypeOf(o, {}) === o);