Fix bug in comparison logic of object property (#22348)

vreality64 · facebook-github-bot · commit c3b3eb7f73b0 · 2018-12-04T19:25:11.000-08:00
Summary: `instance.hasOwnProperty` has potential danger because of some object could be eliminate own prototype chain. Update code be more reliable. This PR is solution of #22308 issue. (Fixes #22308) Pull Request resolved: #22348 Differential Revision: D13334882 Pulled By: cpojer fbshipit-source-id: 9b9310a972e933af1962666d7b0c683ff43cc5b2
diff --git a/Libraries/vendor/core/mergeInto.js b/Libraries/vendor/core/mergeInto.js
@@ -23,7 +23,7 @@ function mergeInto(one, two) {
   if (two != null) {
     checkMergeObjectArg(two);
     for (var key in two) {
-      if (!two.hasOwnProperty(key)) {
+      if (!Object.prototype.hasOwnProperty.call(two, key)) {
         continue;
       }
       one[key] = two[key];

Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ function mergeInto(one, two) {`
`23`	`23`	`if (two != null) {`
`24`	`24`	`checkMergeObjectArg(two);`
`25`	`25`	`for (var key in two) {`
`26`		`- if (!two.hasOwnProperty(key)) {`
	`26`	`+ if (!Object.prototype.hasOwnProperty.call(two, key)) {`
`27`	`27`	`continue;`
`28`	`28`	`}`
`29`	`29`	`one[key] = two[key];`