Fix bug in comparison logic of object property (facebook#22348)

vreality64 · grabbou · commit 18c4dd539af2 · 2018-12-17T19:53:24.000+01:00
Summary: `instance.hasOwnProperty` has potential danger because of some object could be eliminate own prototype chain. Update code be more reliable. This PR is solution of facebook#22308 issue. (Fixes facebook#22308) Pull Request resolved: facebook#22348 Differential Revision: D13334882 Pulled By: cpojer fbshipit-source-id: 9b9310a972e933af1962666d7b0c683ff43cc5b2
diff --git a/Libraries/vendor/core/mergeInto.js b/Libraries/vendor/core/mergeInto.js
@@ -23,7 +23,7 @@ function mergeInto(one, two) {
   if (two != null) {
     checkMergeObjectArg(two);
     for (var key in two) {
-      if (!two.hasOwnProperty(key)) {
+      if (!Object.prototype.hasOwnProperty.call(two, key)) {
         continue;
       }
       one[key] = two[key];

Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ function mergeInto(one, two) {`
`23`	`23`	`if (two != null) {`
`24`	`24`	`checkMergeObjectArg(two);`
`25`	`25`	`for (var key in two) {`
`26`		`- if (!two.hasOwnProperty(key)) {`
	`26`	`+ if (!Object.prototype.hasOwnProperty.call(two, key)) {`
`27`	`27`	`continue;`
`28`	`28`	`}`
`29`	`29`	`one[key] = two[key];`