LibJS: VERIFY() that to_object() succeeds in Object.prototype.toString()

As null and undefined are already handled separately, this must not
fail.
This commit is contained in:
Linus Groh 2021-06-13 01:03:41 +01:00
commit 1253a3d038
Notes: sideshowbarker 2024-07-18 12:19:31 +09:00

View file

@ -64,8 +64,7 @@ JS_DEFINE_NATIVE_FUNCTION(ObjectPrototype::to_string)
return js_string(vm, "[object Null]");
auto* this_object = this_value.to_object(global_object);
if (!this_object)
return {};
VERIFY(this_object);
String tag;
auto to_string_tag = this_object->get(vm.well_known_symbol_to_string_tag());