diff options
| author | Timothy Flynn <trflynn89@pm.me> | 2022-09-14 16:11:35 -0400 |
|---|---|---|
| committer | Andreas Kling <kling@serenityos.org> | 2022-09-15 09:45:13 +0200 |
| commit | 3efe611dbfe76a816c837fc02037793fa4e22e61 (patch) | |
| tree | 1ea70cb5762f7d76043102c1e2247c36cac9c44e /Userland/Libraries/LibJS/Runtime/PromiseResolvingFunction.cpp | |
| parent | 98a6f962a020073de68c19cf6cc7068eebcc3fed (diff) | |
| download | serenity-3efe611dbfe76a816c837fc02037793fa4e22e61.zip | |
LibJS: Do not assume that IsArray means the object type is an Array
IsArray returns true if the object is an Array *or* if it is a
ProxyObject whose target is an Array. Therefore, we cannot downcast to
an Array based on IsArray.
Luckily, we don't actually need an Array here; SerializeJSONArray only
needs an Object.
This was caught by UBSAN with vptr sanitation enabled.
Diffstat (limited to 'Userland/Libraries/LibJS/Runtime/PromiseResolvingFunction.cpp')
0 files changed, 0 insertions, 0 deletions