Non-object values should give early false result for instanceof operator (#2830)

This patch fixes #2823.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
This commit is contained in:
Robert Fancsik 2019-04-24 14:39:04 +02:00 committed by Dániel Bátyai
parent 760fc4fb95
commit 962d549be6
2 changed files with 21 additions and 5 deletions

View File

@ -402,6 +402,11 @@ ecma_op_function_has_instance (ecma_object_t *func_obj_p, /**< Function object *
JERRY_ASSERT (func_obj_p != NULL
&& !ecma_is_lexical_environment (func_obj_p));
if (!ecma_is_value_object (value))
{
return ECMA_VALUE_FALSE;
}
while (ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_BOUND_FUNCTION)
{
JERRY_ASSERT (ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_BOUND_FUNCTION);
@ -423,11 +428,6 @@ ecma_op_function_has_instance (ecma_object_t *func_obj_p, /**< Function object *
JERRY_ASSERT (ecma_is_normal_or_arrow_function (ecma_get_object_type (func_obj_p))
|| ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_EXTERNAL_FUNCTION);
if (!ecma_is_value_object (value))
{
return ECMA_VALUE_FALSE;
}
ecma_object_t *v_obj_p = ecma_get_object_from_value (value);
ecma_value_t prototype_obj_value = ecma_op_object_get_by_magic_id (func_obj_p,

View File

@ -0,0 +1,16 @@
// Copyright JS Foundation and other contributors, http://js.foundation
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
class myArray extends Array {}
assert (!(undefined instanceof myArray));