RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-04 15:17:35 +00:00
Code Issues Activity Actions

LibJS: Don't assume Object.setPrototypeOf() prototype value is an object

Browse source 
We're crashing otherwise. Also it was not possible to set the prototype
to null.
This commit is contained in:
Linus Groh 2020-06-02 12:25:21 +01:00 • committed by Andreas Kling
parent 1a64bdd80c
commit 8cf1ded478
2 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Libraries/LibJS/Runtime/ObjectConstructor.cpp
View file

@ -102,7 +102,17 @@ Value ObjectConstructor::set_prototype_of(Interpreter& interpreter)
auto* object = interpreter.argument(0).to_object(interpreter);
if (interpreter.exception())
return {};
object->set_prototype(&const_cast<Object&>(interpreter.argument(1).as_object()));
auto prototype_value = interpreter.argument(1);
Object* prototype;
if (prototype_value.is_null()) {
prototype = nullptr;
} else if (prototype_value.is_object()) {
prototype = &prototype_value.as_object();
} else {
interpreter.throw_exception<TypeError>("Prototype must be null or object");
return {};
}
object->set_prototype(prototype);
return object;
}