Skip to content
This repository has been archived by the owner on Jul 8, 2024. It is now read-only.

Bugfix: fix a missed ~empty~ check in isSubsetOf #102

Merged
merged 1 commit into from
Nov 25, 2023
Merged

Bugfix: fix a missed ~empty~ check in isSubsetOf #102

merged 1 commit into from
Nov 25, 2023

Conversation

bakkot
Copy link
Collaborator

@bakkot bakkot commented Nov 25, 2023

No description provided.

@ljharb
Copy link
Member

ljharb commented Nov 25, 2023

What's some JS code that would trigger this bug?

@bakkot
Copy link
Collaborator Author

bakkot commented Nov 25, 2023

let x = new Set('a', 'b');
let evil = {
  size: 3,
  has() {
    x.delete('b');
    x.add('c');
    return true;
  },
  *keys(){}
};
x.isSubsetOf(evil);

That ends up calling evil.has with argument ~empty~, which is not an ES language value.

@ljharb
Copy link
Member

ljharb commented Nov 25, 2023

gotcha, thanks, LGTM

ljharb added a commit to es-shims/Set.prototype.isSubsetOf that referenced this pull request Nov 25, 2023
Copy link
Member

@michaelficarra michaelficarra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😆

@bakkot bakkot merged commit f2635a7 into main Nov 25, 2023
1 check passed
@bakkot bakkot deleted the fix-empty branch November 25, 2023 17:22
@syg
Copy link

syg commented Nov 27, 2023

cc @rmahdav to see if V8 has this bug as well.

ljharb added a commit to es-shims/Set.prototype.isSubsetOf that referenced this pull request Dec 17, 2023
ljharb added a commit to es-shims/Set.prototype.isSubsetOf that referenced this pull request Dec 17, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants