RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-23 09:07:41 +00:00
Code Issues Activity Actions

LibJS: Object::put() shouldn't create own properties on prototype chain

Browse source 
Unless there is a setter present on the prototype chain, put() should
only set own properties on the object itself.

Fixes #1588.
This commit is contained in:
Andreas Kling 2020-04-02 21:34:31 +02:00
parent a62230770b
commit 99aab4470a
2 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Libraries/LibJS/Runtime/Object.cpp
View file

@ -133,6 +133,8 @@ Optional<Value> Object::get(const FlyString& property_name) const
void Object::put(const FlyString& property_name, Value value)
{
// If there's a setter in the prototype chain, we go to the setter.
// Otherwise, it goes in the own property storage.
Object* object = this;
while (object) {
auto metadata = object->shape().lookup(property_name);
@ -147,8 +149,6 @@ void Object::put(const FlyString& property_name, Value value)
interpreter.pop_call_frame();
return;
}
if (object->put_own_property(*this, property_name, value))
return;
}
object = object->prototype();
}

8
Libraries/LibJS/Tests/Object.prototype.toString.js Normal file
View file

@ -0,0 +1,8 @@
function assert(x) { if (!x) throw 1; }
try {
assert(typeof Object.prototype.toString() === "string");
console.log("PASS");
} catch (e) {
console.log("FAIL: " + e);
}