From a78058bc796de7aa98e41d6176171dc082b81a93 Mon Sep 17 00:00:00 2001
From: Timothy Flynn <trflynn89@pm.me>
Date: Thu, 10 Feb 2022 07:30:51 -0500
Subject: [PATCH] LibJS: Do not refer to moved-from completions / values

In the ThrowCompletionOr constructors, the VERIFY statements are using
moved-from objects. We should not rely on those objects still being
valid after being moved.
---
 Userland/Libraries/LibJS/Runtime/Completion.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Userland/Libraries/LibJS/Runtime/Completion.h b/Userland/Libraries/LibJS/Runtime/Completion.h
index 94ac00eee2..5e857f1edb 100644
--- a/Userland/Libraries/LibJS/Runtime/Completion.h
+++ b/Userland/Libraries/LibJS/Runtime/Completion.h
@@ -101,7 +101,7 @@ public:
     ThrowCompletionOr(Completion throw_completion)
         : m_throw_completion(move(throw_completion))
     {
-        VERIFY(throw_completion.is_error());
+        VERIFY(m_throw_completion->is_error());
     }
 
     // Not `explicit` on purpose so that `return value;` is possible.
@@ -109,7 +109,7 @@ public:
         : m_value(move(value))
     {
         if constexpr (IsSame<ValueType, Value>)
-            VERIFY(!value.is_empty());
+            VERIFY(!m_value->is_empty());
     }
 
     // Allows implicit construction of ThrowCompletionOr<T> from a type U if T(U) is a supported constructor.