From 08448d9bef5e4919fb9f850ce2634b964d31f725 Mon Sep 17 00:00:00 2001
From: Michaël Zasso <targos@protonmail.com>
Date: Tue, 22 Oct 2019 16:03:19 +0200
Subject: deps: V8: cherry-pick c721203

Original commit message:

    Add missing null condition in Proxy GetPrototypeof

    Bug: v8:9781
    Change-Id: I1f82a828f103cc2aa3f9553214f6b4867ffc3b17
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1829897
    Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
    Reviewed-by: Georg Neis <neis@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#64049}

Refs: https://github.com/v8/v8/commit/c721203615afea24cd6bef5b4850c20c68e0e43a
Fixes: https://github.com/nodejs/node/issues/29730

PR-URL: https://github.com/nodejs/node/pull/30065
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
---
 deps/v8/src/builtins/proxy-get-prototype-of.tq |  2 +-
 deps/v8/test/mjsunit/regress/regress-9781.js   | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 deps/v8/test/mjsunit/regress/regress-9781.js

(limited to 'deps/v8')

diff --git a/deps/v8/src/builtins/proxy-get-prototype-of.tq b/deps/v8/src/builtins/proxy-get-prototype-of.tq
index 653d4503d1..5b90a1bb02 100644
--- a/deps/v8/src/builtins/proxy-get-prototype-of.tq
+++ b/deps/v8/src/builtins/proxy-get-prototype-of.tq
@@ -33,7 +33,7 @@ namespace proxy {
 
       // 8. If Type(handlerProto) is neither Object nor Null, throw a TypeError
       // exception.
-      if (!Is<JSReceiver>(handlerProto)) {
+      if (!Is<JSReceiver>(handlerProto) && handlerProto != Null) {
         goto ThrowProxyGetPrototypeOfInvalid;
       }
 
diff --git a/deps/v8/test/mjsunit/regress/regress-9781.js b/deps/v8/test/mjsunit/regress/regress-9781.js
new file mode 100644
index 0000000000..6d3e3162d3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-9781.js
@@ -0,0 +1,11 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var proto = Object.getPrototypeOf(new Proxy(Object.create(null), {
+  getPrototypeOf(target) {
+    return Reflect.getPrototypeOf(target);
+  }
+} ));
+
+assertEquals(proto, null);
-- 
cgit v1.2.3