浏览代码

LibWeb: Don't assume name is string in HTMLCollectionWrapper::get()

If the property name is not a string (symbol or integer), we should
just defer to the base class instead of trying to handle it.

Fixes #6575.
Andreas Kling 4 年之前
父节点
当前提交
f7a33043e0
共有 1 个文件被更改,包括 2 次插入0 次删除
  1. 2 0
      Userland/Libraries/LibWeb/Bindings/HTMLCollectionWrapperCustom.cpp

+ 2 - 0
Userland/Libraries/LibWeb/Bindings/HTMLCollectionWrapperCustom.cpp

@@ -14,6 +14,8 @@ namespace Web::Bindings {
 
 
 JS::Value HTMLCollectionWrapper::get(JS::PropertyName const& name, JS::Value receiver, bool without_side_effects) const
 JS::Value HTMLCollectionWrapper::get(JS::PropertyName const& name, JS::Value receiver, bool without_side_effects) const
 {
 {
+    if (!name.is_string())
+        return Base::get(name, receiver, without_side_effects);
     auto* item = const_cast<DOM::HTMLCollection&>(impl()).named_item(name.to_string());
     auto* item = const_cast<DOM::HTMLCollection&>(impl()).named_item(name.to_string());
     if (!item)
     if (!item)
         return Base::get(name, receiver, without_side_effects);
         return Base::get(name, receiver, without_side_effects);