Bug 204971 – Object.prototype.isPrototypeOf() should check if the passed in value is a non-object first.

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

According to the ES standard(From ES3 to ES 10), when the argument "thisArg" of Function.prototype.call(thisArg, ...args) is undefined or null, the argument "thisArg" should be replaced with the global object, and then Object.prototype.isPrototypeOf will called which return false. However, JSC throws TypeError. So I suspect it is a bug of javascriptCore.
The references of ES10 are as follows:
http://www.ecma-international.org/ecma-262/10.0/index.html#sec-function.prototype.call
http://www.ecma-international.org/ecma-262/10.0/index.html#sec-object.prototype.isprototypeof


Version:b96bf75
https://github.com/WebKit/webkit/commit/b96bf7590bc090fa8161cff1189255ca3319c94b

Build steps:
Tools/Scripts/build-webkit --debug --jsc-only -j

Testcase:
var NISLFuzzingFunc = function() {
    var a = Object.prototype.isPrototypeOf.call(null);
    print(a);
};
NISLFuzzingFunc();

Execution steps:
webkit/WebKitBuild/Debug/bin/jsc testcase.js

Output:
Exception: TypeError: null is not an object (evaluating 'Object.prototype.isPrototypeOf.call(null)')
isPrototypeOf@[native code]
[e-mail]:2:48
global [e-mail]:5:16

Expected output:
flase

[Radar WebKit Bug Importer]

<rdar://problem/57730080>

[Mark Lam]

Thanks for reporting this issue.  Investigating now.

[Mark Lam]

Created attachment 385107 [details]
proposed patch.

[Mark Lam]

Thanks for the review.  Landed in r253264: <http://trac.webkit.org/r253264>.