diff options
author | Richard Weickelt <richard@weickelt.de> | 2020-11-24 01:14:28 +0100 |
---|---|---|
committer | Richard Weickelt <richard@weickelt.de> | 2020-11-25 14:06:11 +0100 |
commit | 810a0afe1e9bd14e4393a73bf6c299b25745dbc5 (patch) | |
tree | 127834204e459c6c368ce82f9236e6bd66a669a2 /tests | |
parent | 89ea9f1f9468aa47718cbb398317c63a9479adf2 (diff) |
Fix crash when calling hasOwnProperty() on proxy object
Property pointer p needs to be checked for nullptr value in
QV4::ProxyObject::virtualGetOwnProperty(). This can happen when calling
hasOwnProperty() or propertyIsEnumerable().
Fixes: QTBUG-88786
Change-Id: I43da58fed4d8656f9187213f7317f17398739e34
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
(cherry picked from commit 9b321a34490cd17c0eb043b69bd7c9d8d8f513d5)
Reviewed-by: Richard Weickelt <richard@weickelt.de>
Diffstat (limited to 'tests')
-rw-r--r-- | tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp | 31 |
1 files changed, 30 insertions, 1 deletions
diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp index 1e10841430..3a9d1bfb4c 100644 --- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp +++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp @@ -382,7 +382,7 @@ private slots: void semicolonAfterProperty(); void hugeStack(); void variantConversionMethod(); - + void proxyHandlerTraps(); void gcCrashRegressionTest(); private: @@ -9306,6 +9306,35 @@ void tst_qqmlecmascript::variantConversionMethod() QCOMPARE(obj.funcCalled, QLatin1String("QModelIndex")); } +void tst_qqmlecmascript::proxyHandlerTraps() +{ + const QString expression = QStringLiteral(R"SNIPPET( + (function(){ + const target = { + prop: 47 + }; + const handler = { + getOwnPropertyDescriptor(target, prop) { + return { configurable: true, enumerable: true, value: 47 }; + } + }; + const proxy = new Proxy(target, handler); + + // QTBUG-88786 + if (!proxy.propertyIsEnumerable("prop")) + throw Error("FAIL: propertyisEnumerable"); + if (!proxy.hasOwnProperty("prop")) + throw Error("FAIL: hasOwnProperty"); + + return "SUCCESS"; + })() + )SNIPPET"); + + QJSEngine engine; + QJSValue value = engine.evaluate(expression); + QVERIFY(value.isString() && value.toString() == QStringLiteral("SUCCESS")); +} + QTEST_MAIN(tst_qqmlecmascript) #include "tst_qqmlecmascript.moc" |