Fix Proxy ownKeys trap accepting a primitive result (saghul)

diff --git a/quickjs.c b/quickjs.c
index 13d2d756dbcfbb288d3fc5dbb62af053aee814e6..c4ba91561d1f7cb000fa5c3046b5b87df0cde70f 100644 (file)
--- a/quickjs.c
+++ b/quickjs.c
@@ -53672,6 +53672,12 @@ static int js_proxy_get_own_property_names(JSContext *ctx,
     prop_array = JS_CallFree(ctx, method, s->handler, 1, (JSValueConst *)&s->target);
     if (JS_IsException(prop_array))
         return -1;
+    /* CreateListFromArrayLike() requires an object */
+    if (!JS_IsObject(prop_array)) {
+        JS_FreeValue(ctx, prop_array);
+        JS_ThrowTypeError(ctx, "proxy: ownKeys must return an object");
+        return -1;
+    }
     tab = NULL;
     len = 0;
     tab2 = NULL;