mirror of
https://github.com/RGBCube/serenity
synced 2025-07-23 06:37:40 +00:00
LibJS: Object::put() shouldn't create own properties on prototype chain
Unless there is a setter present on the prototype chain, put() should only set own properties on the object itself. Fixes #1588.
This commit is contained in:
parent
a62230770b
commit
99aab4470a
2 changed files with 10 additions and 2 deletions
|
@ -133,6 +133,8 @@ Optional<Value> Object::get(const FlyString& property_name) const
|
||||||
|
|
||||||
void Object::put(const FlyString& property_name, Value value)
|
void Object::put(const FlyString& property_name, Value value)
|
||||||
{
|
{
|
||||||
|
// If there's a setter in the prototype chain, we go to the setter.
|
||||||
|
// Otherwise, it goes in the own property storage.
|
||||||
Object* object = this;
|
Object* object = this;
|
||||||
while (object) {
|
while (object) {
|
||||||
auto metadata = object->shape().lookup(property_name);
|
auto metadata = object->shape().lookup(property_name);
|
||||||
|
@ -147,8 +149,6 @@ void Object::put(const FlyString& property_name, Value value)
|
||||||
interpreter.pop_call_frame();
|
interpreter.pop_call_frame();
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
if (object->put_own_property(*this, property_name, value))
|
|
||||||
return;
|
|
||||||
}
|
}
|
||||||
object = object->prototype();
|
object = object->prototype();
|
||||||
}
|
}
|
||||||
|
|
8
Libraries/LibJS/Tests/Object.prototype.toString.js
Normal file
8
Libraries/LibJS/Tests/Object.prototype.toString.js
Normal file
|
@ -0,0 +1,8 @@
|
||||||
|
function assert(x) { if (!x) throw 1; }
|
||||||
|
|
||||||
|
try {
|
||||||
|
assert(typeof Object.prototype.toString() === "string");
|
||||||
|
console.log("PASS");
|
||||||
|
} catch (e) {
|
||||||
|
console.log("FAIL: " + e);
|
||||||
|
}
|
Loading…
Add table
Add a link
Reference in a new issue