Skip to content

Commit 56470ce

Browse files
committed
Add type check to PrototypeOverwriteGenerator
This patch adds a check in case an object and the object its prototype is being set to are the same thing (i.e. obj.__proto__ = obj;) This currently allows for an invalid program with the error: TypeError: Cyclic __proto__ value Bug: 40272934 Change-Id: Ib115f6f754d1cc70564bc91a5fd433033e9d5bdf Reviewed-on: https://chrome-internal-review.googlesource.com/c/v8/fuzzilli/+/8557236 Reviewed-by: Matthias Liedtke <mliedtke@google.com>
1 parent 4dc6de5 commit 56470ce

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

Sources/Fuzzilli/CodeGen/CodeGenerators.swift

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1658,7 +1658,8 @@ public let CodeGenerators: [CodeGenerator] = [
16581658
},
16591659

16601660
CodeGenerator("PrototypeOverwriteGenerator", inputs: .preferred(.object(), .object())) { b, obj, proto in
1661-
let needGuard = b.type(of: obj).MayBe(.nullish)
1661+
// Check for obj == proto to reduce the chance of cyclic prototype chains.
1662+
let needGuard = b.type(of: obj).MayBe(.nullish) || obj == proto
16621663
b.setProperty("__proto__", of: obj, to: proto, guard: needGuard)
16631664
},
16641665

0 commit comments

Comments
 (0)