Ensure our builtin constructors are subclassable

Respect the newTarget passed into those constructors and make
sure we set up the proto chain correctly.

Change-Id: I3d12c7dbef4b33660a6715d73e9fb0f89105167a
Fixes: QTBUG-71138
Reviewed-by: Erik Verbruggen <erik.verbruggen@qt.io>

1 files changed, 5 insertions, 2 deletions

diff --git a/src/qml/jsruntime/qv4mapobject.cpp b/src/qml/jsruntime/qv4mapobject.cpp
index 7d53b36fcd..68741e7677 100644
--- a/src/qml/jsruntime/qv4mapobject.cpp
+++ b/src/qml/jsruntime/qv4mapobject.cpp
@@ -59,11 +59,14 @@ void Heap::MapCtor::init(QV4::ExecutionContext *scope)
     Heap::FunctionObject::init(scope, QStringLiteral("Map"));
 }
 
-ReturnedValue WeakMapCtor::construct(const FunctionObject *f, const Value *argv, int argc, const Value *, bool weakMap)
+ReturnedValue WeakMapCtor::construct(const FunctionObject *f, const Value *argv, int argc, const Value *newTarget, bool weakMap)
 {
     Scope scope(f);
     Scoped<MapObject> a(scope, scope.engine->memoryManager->allocate<MapObject>());
-    if (weakMap) {
+    bool protoSet = false;
+    if (newTarget)
+        protoSet = a->setProtoFromNewTarget(newTarget);
+    if (!protoSet && weakMap) {
         a->setPrototypeOf(scope.engine->weakMapPrototype());
         scope.engine->memoryManager->registerWeakMap(a->d());
     }