diff options
| author |  Jarred Sumner <709451+Jarred-Sumner@users.noreply.github.com>
| 2022-11-27 19:37:14 -0800 |
|---|---|---|
| committer | Jarred Sumner <709451+Jarred-Sumner@users.noreply.github.com>
| 2022-11-27 19:37:14 -0800 |
| commit | 002f4ecc9e0dfb19ea9e5032b812b9b976706995 (patch) | |
| tree | 34fae197918c8064d456a855b987c0b8bd36dc03 /src | |
| parent | 495f25501f7bcfddec6e91cca7815cc6220fb53e (diff) | |
| download | bun-002f4ecc9e0dfb19ea9e5032b812b9b976706995.tar.gz bun-002f4ecc9e0dfb19ea9e5032b812b9b976706995.tar.zst bun-002f4ecc9e0dfb19ea9e5032b812b9b976706995.zip | |
Fix crash in console.log
Diffstat (limited to 'src')
| -rw-r--r-- | src/bun.js/bindings/bindings.cpp | 23 |
1 files changed, 13 insertions, 10 deletions
diff --git a/src/bun.js/bindings/bindings.cpp b/src/bun.js/bindings/bindings.cpp index 864e431c6..b2b0973db 100644 --- a/src/bun.js/bindings/bindings.cpp +++ b/src/bun.js/bindings/bindings.cpp @@ -3765,6 +3765,7 @@ void JSC__JSValue__forEachProperty(JSC__JSValue JSValue0, JSC__JSGlobalObject* g restart: if (fast) { bool anyHits = false; + JSC::JSObject* objectToUse = prototypeObject.getObject(); structure->forEachProperty(vm, [&](const PropertyTableEntry& entry) -> bool { if ((entry.attributes() & PropertyAttribute::Accessor) != 0 && (entry.attributes() & PropertyAttribute::DontEnum) != 0) { return true; @@ -3785,9 +3786,9 @@ restart: if (key.len == 0) return true; - JSC::JSValue propertyValue = object->getDirect(entry.offset()); + JSC::JSValue propertyValue = objectToUse->getDirect(entry.offset()); if (!propertyValue || propertyValue.isGetterSetter()) { - propertyValue = object->get(globalObject, entry.key()); + propertyValue = objectToUse->get(globalObject, entry.key()); } if (scope.exception()) @@ -3809,12 +3810,14 @@ restart: if (anyHits) { - if (prototypeCount++ < 3) { + if (prototypeCount++ < 5) { if (JSValue proto = prototypeObject.getPrototype(globalObject)) { - if ((structure = proto.structureOrNull())) { - prototypeObject = proto; - fast = canPerformFastPropertyEnumerationForIterationBun(structure); - goto restart; + if (!(proto == globalObject->objectPrototype() || proto == globalObject->functionPrototype())) { + if ((structure = proto.structureOrNull())) { + prototypeObject = proto; + fast = canPerformFastPropertyEnumerationForIterationBun(structure); + goto restart; + } } } } @@ -3828,7 +3831,7 @@ restart: JSObject* iterating = prototypeObject.getObject(); - while (iterating && prototypeCount++ < 3 && !(iterating == globalObject->objectPrototype() || iterating == globalObject->functionPrototype())) { + while (iterating && !(iterating == globalObject->objectPrototype() || iterating == globalObject->functionPrototype()) && prototypeCount++ < 5) { iterating->methodTable()->getOwnPropertyNames(iterating, globalObject, properties, DontEnumPropertiesMode::Include); RETURN_IF_EXCEPTION(scope, void()); for (auto& property : properties) { @@ -3839,8 +3842,8 @@ restart: if (property == vm.propertyNames->constructor || clientData->builtinNames().bunNativePtrPrivateName() == property) continue; - JSC::PropertySlot slot(object, PropertySlot::InternalMethodType::Get); - if (!object->getPropertySlot(globalObject, property, slot)) + JSC::PropertySlot slot(iterating, PropertySlot::InternalMethodType::Get); + if (!iterating->getPropertySlot(globalObject, property, slot)) continue; if ((slot.attributes() & PropertyAttribute::Accessor) != 0) { |