RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 05:37:34 +00:00
Code Issues Activity Actions

LibJS: Handle the different realms case in ArraySpeciesCreate

Browse source
This commit is contained in:
davidot 2021-06-29 19:55:25 +02:00 • committed by Linus Groh
parent 384cffaa04
commit fc9cc74555
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Userland/Libraries/LibJS/Runtime/ArrayPrototype.cpp
View file

@ -13,6 +13,7 @@
#include <AK/StringBuilder.h> #include <AK/StringBuilder.h>
#include <LibJS/Runtime/AbstractOperations.h> #include <LibJS/Runtime/AbstractOperations.h>
#include <LibJS/Runtime/Array.h> #include <LibJS/Runtime/Array.h>
#include <LibJS/Runtime/ArrayConstructor.h>
#include <LibJS/Runtime/ArrayIterator.h> #include <LibJS/Runtime/ArrayIterator.h>
#include <LibJS/Runtime/ArrayPrototype.h> #include <LibJS/Runtime/ArrayPrototype.h>
#include <LibJS/Runtime/Error.h> #include <LibJS/Runtime/Error.h>
@ -157,7 +158,13 @@ static Object* array_species_create(GlobalObject& global_object, Object& origina
if (vm.exception()) if (vm.exception())
return {}; return {};
if (constructor.is_constructor()) { if (constructor.is_constructor()) {
// FIXME: Check if the returned constructor is from another realm, and if so set constructor to undefined auto& constructor_function = constructor.as_function();
if (&constructor_function.global_object() != &global_object) {
auto* array_constructor = constructor_function.global_object().array_constructor();
if (&constructor_function == array_constructor) {
constructor = js_undefined();
}
}
} }
if (constructor.is_object()) { if (constructor.is_object()) {