Add missing null condition in Proxy GetPrototypeof

duongnhn · Commit Bot · commit c721203615af · 2019-09-30T17:56:34.000Z
Bug: v8:9781 Change-Id: I1f82a828f103cc2aa3f9553214f6b4867ffc3b17 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1829897 Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#64049}
diff --git a/src/builtins/proxy-get-prototype-of.tq b/src/builtins/proxy-get-prototype-of.tq
@@ -33,7 +33,7 @@ namespace proxy {
 
       // 8. If Type(handlerProto) is neither Object nor Null, throw a TypeError
       // exception.
-      if (!Is<JSReceiver>(handlerProto)) {
+      if (!Is<JSReceiver>(handlerProto) && handlerProto != Null) {
         goto ThrowProxyGetPrototypeOfInvalid;
       }
 
diff --git a/test/mjsunit/regress/regress-9781.js b/test/mjsunit/regress/regress-9781.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var proto = Object.getPrototypeOf(new Proxy(Object.create(null), {
+  getPrototypeOf(target) {
+    return Reflect.getPrototypeOf(target);
+  }
+} ));
+
+assertEquals(proto, null);

Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ namespace proxy {`
`33`	`33`
`34`	`34`	`// 8. If Type(handlerProto) is neither Object nor Null, throw a TypeError`
`35`	`35`	`// exception.`
`36`		`- if (!Is<JSReceiver>(handlerProto)) {`
	`36`	`+ if (!Is<JSReceiver>(handlerProto) && handlerProto != Null) {`
`37`	`37`	`goto ThrowProxyGetPrototypeOfInvalid;`
`38`	`38`	`}`
`39`	`39`