[PATCH 2/9] jscript: Handle NULL objects instead of crashing.

Gabriel Ivăncescu gabrielopcode at gmail.com
Tue Mar 22 10:41:20 CDT 2022


Signed-off-by: Gabriel Ivăncescu <gabrielopcode at gmail.com>
---

Most of the existing code deals with NULL objects already and has proper
checks, but some does not. Not only is this inconsistent, but it makes no
sense to crash. For example, FFXIV Launcher uses instanceof on a NULL obj,
but there's many other areas that need handling as well. This should fix
them all, hopefully.

 dlls/jscript/array.c      |  8 ++++----
 dlls/jscript/bool.c       |  2 +-
 dlls/jscript/date.c       |  2 +-
 dlls/jscript/dispex.c     |  2 +-
 dlls/jscript/engine.c     | 10 +++++-----
 dlls/jscript/enumerator.c |  4 ++--
 dlls/jscript/error.c      |  2 +-
 dlls/jscript/function.c   |  8 ++++----
 dlls/jscript/json.c       |  2 +-
 dlls/jscript/jsregexp.c   |  6 +++---
 dlls/jscript/jsutils.c    |  4 ++--
 dlls/jscript/number.c     |  2 +-
 dlls/jscript/object.c     | 18 +++++++++---------
 dlls/jscript/set.c        |  2 +-
 dlls/jscript/string.c     | 12 ++++++------
 dlls/jscript/vbarray.c    |  2 +-
 16 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/dlls/jscript/array.c b/dlls/jscript/array.c
index 9b97ef2..abfc997 100644
--- a/dlls/jscript/array.c
+++ b/dlls/jscript/array.c
@@ -39,7 +39,7 @@ static inline ArrayInstance *array_from_jsdisp(jsdisp_t *jsdisp)
 
 static inline ArrayInstance *array_this(jsval_t vthis)
 {
-    jsdisp_t *jsdisp = is_object_instance(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
+    jsdisp_t *jsdisp = is_object_instance(vthis) && get_object(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
     return (jsdisp && is_class(jsdisp, JSCLASS_ARRAY)) ? array_from_jsdisp(jsdisp) : NULL;
 }
 
@@ -207,7 +207,7 @@ static HRESULT Array_concat(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsign
         DWORD i;
 
         for(i=0; i < argc; i++) {
-            if(is_object_instance(argv[i]))
+            if(is_object_instance(argv[i]) && get_object(argv[i]))
                 hres = concat_obj(ret, get_object(argv[i]), &len);
             else
                 hres = jsdisp_propput_idx(ret, len++, argv[i]);
@@ -690,7 +690,7 @@ static HRESULT Array_sort(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsigned
         return hres;
 
     if(argc >= 1) {
-        if(is_object_instance(argv[0])) {
+        if(is_object_instance(argv[0]) && get_object(argv[0])) {
             if(argc > 1 && ctx->version < SCRIPTLANGUAGEVERSION_ES5) {
                 WARN("invalid arg_cnt %d\n", argc);
                 hres = JS_E_JSCRIPT_EXPECTED;
@@ -1345,7 +1345,7 @@ static HRESULT ArrayConstr_isArray(script_ctx_t *ctx, jsval_t vthis, WORD flags,
 
     TRACE("\n");
 
-    if(!argc || !is_object_instance(argv[0])) {
+    if(!argc || !is_object_instance(argv[0]) || !get_object(argv[0])) {
         if(r) *r = jsval_bool(FALSE);
         return S_OK;
     }
diff --git a/dlls/jscript/bool.c b/dlls/jscript/bool.c
index a230855..39206b4 100644
--- a/dlls/jscript/bool.c
+++ b/dlls/jscript/bool.c
@@ -41,7 +41,7 @@ static inline HRESULT boolval_this(jsval_t vthis, BOOL *ret)
     jsdisp_t *jsdisp;
     if(is_bool(vthis))
         *ret = get_bool(vthis);
-    else if(is_object_instance(vthis) && (jsdisp = to_jsdisp(get_object(vthis))) && is_class(jsdisp, JSCLASS_BOOLEAN))
+    else if(is_object_instance(vthis) && get_object(vthis) && (jsdisp = to_jsdisp(get_object(vthis))) && is_class(jsdisp, JSCLASS_BOOLEAN))
         *ret = bool_from_jsdisp(jsdisp)->val;
     else
         return JS_E_BOOLEAN_EXPECTED;
diff --git a/dlls/jscript/date.c b/dlls/jscript/date.c
index e482c4a..c553f24 100644
--- a/dlls/jscript/date.c
+++ b/dlls/jscript/date.c
@@ -51,7 +51,7 @@ static inline DateInstance *date_from_jsdisp(jsdisp_t *jsdisp)
 
 static inline DateInstance *date_this(jsval_t vthis)
 {
-    jsdisp_t *jsdisp = is_object_instance(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
+    jsdisp_t *jsdisp = is_object_instance(vthis) && get_object(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
     return (jsdisp && is_class(jsdisp, JSCLASS_DATE)) ? date_from_jsdisp(jsdisp) : NULL;
 }
 
diff --git a/dlls/jscript/dispex.c b/dlls/jscript/dispex.c
index df2f65f..b9ad882 100644
--- a/dlls/jscript/dispex.c
+++ b/dlls/jscript/dispex.c
@@ -99,7 +99,7 @@ static inline BOOL is_function_prop(dispex_prop_t *prop)
 {
     BOOL ret = FALSE;
 
-    if (is_object_instance(prop->u.val))
+    if (is_object_instance(prop->u.val) && get_object(prop->u.val))
     {
         jsdisp_t *jsdisp = iface_to_jsdisp(get_object(prop->u.val));
 
diff --git a/dlls/jscript/engine.c b/dlls/jscript/engine.c
index d894fbc..925eaeb 100644
--- a/dlls/jscript/engine.c
+++ b/dlls/jscript/engine.c
@@ -320,7 +320,7 @@ static HRESULT exprval_call(script_ctx_t *ctx, exprval_t *ref, WORD flags, unsig
     case EXPRVAL_STACK_REF: {
         jsval_t v = ctx->stack[ref->u.off];
 
-        if(!is_object_instance(v)) {
+        if(!is_object_instance(v) || !get_object(v)) {
             FIXME("invoke %s\n", debugstr_jsval(v));
             return E_FAIL;
         }
@@ -1381,7 +1381,7 @@ static HRESULT interp_call(script_ctx_t *ctx)
     TRACE("%d %d\n", argn, do_ret);
 
     obj = stack_topn(ctx, argn);
-    if(!is_object_instance(obj))
+    if(!is_object_instance(obj) || !get_object(obj))
         return JS_E_INVALID_PROPERTY;
 
     clear_acc(ctx);
@@ -1831,7 +1831,7 @@ static HRESULT interp_instanceof(script_ctx_t *ctx)
     v = stack_pop(ctx);
 
     if(is_object_instance(prot)) {
-        if(is_object_instance(v))
+        if(is_object_instance(v) && get_object(v))
             tmp = iface_to_jsdisp(get_object(v));
         for(iter = tmp; !ret && iter; iter = iter->prototype) {
             hres = disp_cmp(get_object(prot), to_disp(iter), &ret);
@@ -2985,7 +2985,7 @@ static HRESULT unwind_exception(script_ctx_t *ctx, HRESULT exception_hres)
         jsval_t msg;
 
         WARN("Exception %08lx %s", exception_hres, debugstr_jsval(ei->valid_value ? ei->value : jsval_undefined()));
-        if(ei->valid_value && jsval_type(ei->value) == JSV_OBJECT) {
+        if(ei->valid_value && jsval_type(ei->value) == JSV_OBJECT && get_object(ei->value)) {
             error_obj = to_jsdisp(get_object(ei->value));
             if(error_obj) {
                 hres = jsdisp_propget_name(error_obj, L"message", &msg);
@@ -3114,7 +3114,7 @@ static HRESULT bind_event_target(script_ctx_t *ctx, function_code_t *func, jsdis
     if(FAILED(hres))
         return hres;
 
-    if(!is_object_instance(v)) {
+    if(!is_object_instance(v) || !get_object(v)) {
         FIXME("Can't bind to %s\n", debugstr_jsval(v));
         jsval_release(v);
     }
diff --git a/dlls/jscript/enumerator.c b/dlls/jscript/enumerator.c
index 0fc6750..e435e3a 100644
--- a/dlls/jscript/enumerator.c
+++ b/dlls/jscript/enumerator.c
@@ -40,7 +40,7 @@ static inline EnumeratorInstance *enumerator_from_jsdisp(jsdisp_t *jsdisp)
 
 static inline EnumeratorInstance *enumerator_this(jsval_t vthis)
 {
-    jsdisp_t *jsdisp = is_object_instance(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
+    jsdisp_t *jsdisp = is_object_instance(vthis) && get_object(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
     return (jsdisp && is_class(jsdisp, JSCLASS_ENUMERATOR)) ? enumerator_from_jsdisp(jsdisp) : NULL;
 }
 
@@ -229,7 +229,7 @@ static HRESULT create_enumerator(script_ctx_t *ctx, jsval_t *argv, jsdisp_t **re
     {
         VARIANT varresult;
 
-        if (!is_object_instance(*argv))
+        if (!is_object_instance(*argv) || !get_object(*argv))
         {
             FIXME("I don't know how to handle this type!\n");
             return E_NOTIMPL;
diff --git a/dlls/jscript/error.c b/dlls/jscript/error.c
index d309d42..a1b182c 100644
--- a/dlls/jscript/error.c
+++ b/dlls/jscript/error.c
@@ -39,7 +39,7 @@ static HRESULT Error_toString(script_ctx_t *ctx, jsval_t vthis, WORD flags,
 
     TRACE("\n");
 
-    if(is_object_instance(vthis))
+    if(is_object_instance(vthis) && get_object(vthis))
         jsthis = to_jsdisp(get_object(vthis));
     else if(ctx->version >= SCRIPTLANGUAGEVERSION_ES5)
         return JS_E_OBJECT_EXPECTED;
diff --git a/dlls/jscript/function.c b/dlls/jscript/function.c
index fc8a85c..1b87f04 100644
--- a/dlls/jscript/function.c
+++ b/dlls/jscript/function.c
@@ -79,7 +79,7 @@ static inline FunctionInstance *function_from_jsdisp(jsdisp_t *jsdisp)
 
 static inline FunctionInstance *function_this(jsval_t vthis)
 {
-    jsdisp_t *jsdisp = is_object_instance(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
+    jsdisp_t *jsdisp = is_object_instance(vthis) && get_object(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
     return (jsdisp && is_class(jsdisp, JSCLASS_FUNCTION)) ? function_from_jsdisp(jsdisp) : NULL;
 }
 
@@ -336,7 +336,7 @@ static HRESULT Function_apply(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsi
 
     TRACE("\n");
 
-    if(!is_object_instance(vthis) || (!(function = function_this(vthis)) && to_jsdisp(get_object(vthis))))
+    if(!is_object_instance(vthis) || !get_object(vthis) || (!(function = function_this(vthis)) && to_jsdisp(get_object(vthis))))
         return JS_E_FUNCTION_EXPECTED;
 
     if(argc) {
@@ -356,7 +356,7 @@ static HRESULT Function_apply(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsi
     if(argc >= 2) {
         jsdisp_t *arg_array = NULL;
 
-        if(is_object_instance(argv[1])) {
+        if(is_object_instance(argv[1]) && get_object(argv[1])) {
             arg_array = iface_to_jsdisp(get_object(argv[1]));
             if(arg_array &&
                (!is_class(arg_array, JSCLASS_ARRAY) && !is_class(arg_array, JSCLASS_ARGUMENTS) )) {
@@ -449,7 +449,7 @@ static HRESULT Function_bind(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsig
         return E_NOTIMPL;
     }
 
-    if(is_object_instance(argv[0])) {
+    if(is_object_instance(argv[0]) && get_object(argv[0])) {
         bound_this = get_object(argv[0]);
     }else if(!is_null(argv[0])) {
         FIXME("%s is not an object instance\n", debugstr_jsval(argv[0]));
diff --git a/dlls/jscript/json.c b/dlls/jscript/json.c
index e0867eb..64d77a2 100644
--- a/dlls/jscript/json.c
+++ b/dlls/jscript/json.c
@@ -721,7 +721,7 @@ static HRESULT stringify(stringify_ctx_t *ctx, jsdisp_t *object, const WCHAR *na
     case JSV_OBJECT: {
         jsdisp_t *obj;
 
-        obj = iface_to_jsdisp(get_object(value));
+        obj = get_object(value) ? iface_to_jsdisp(get_object(value)) : NULL;
         if(!obj) {
             hres = S_FALSE;
             break;
diff --git a/dlls/jscript/jsregexp.c b/dlls/jscript/jsregexp.c
index 15ebb11..6696586 100644
--- a/dlls/jscript/jsregexp.c
+++ b/dlls/jscript/jsregexp.c
@@ -41,7 +41,7 @@ static inline RegExpInstance *regexp_from_jsdisp(jsdisp_t *jsdisp)
 
 static inline RegExpInstance *regexp_this(jsval_t vthis)
 {
-    jsdisp_t *jsdisp = is_object_instance(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
+    jsdisp_t *jsdisp = is_object_instance(vthis) && get_object(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
     return (jsdisp && is_class(jsdisp, JSCLASS_REGEXP)) ? regexp_from_jsdisp(jsdisp) : NULL;
 }
 
@@ -645,7 +645,7 @@ HRESULT create_regexp_var(script_ctx_t *ctx, jsval_t src_arg, jsval_t *flags_arg
     jsstr_t *src;
     HRESULT hres = S_OK;
 
-    if(is_object_instance(src_arg)) {
+    if(is_object_instance(src_arg) && get_object(src_arg)) {
         jsdisp_t *obj;
 
         obj = iface_to_jsdisp(get_object(src_arg));
@@ -892,7 +892,7 @@ static HRESULT RegExpConstr_value(script_ctx_t *ctx, jsval_t vthis, WORD flags,
     switch(flags) {
     case DISPATCH_METHOD:
         if(argc) {
-            if(is_object_instance(argv[0])) {
+            if(is_object_instance(argv[0]) && get_object(argv[0])) {
                 jsdisp_t *jsdisp = iface_to_jsdisp(get_object(argv[0]));
                 if(jsdisp) {
                     if(is_class(jsdisp, JSCLASS_REGEXP)) {
diff --git a/dlls/jscript/jsutils.c b/dlls/jscript/jsutils.c
index 6bc34da..b0a920b 100644
--- a/dlls/jscript/jsutils.c
+++ b/dlls/jscript/jsutils.c
@@ -419,7 +419,7 @@ HRESULT to_primitive(script_ctx_t *ctx, jsval_t val, jsval_t *ret, hint_t hint)
                 jsdisp_release(jsdisp);
                 *ret = prim;
                 return S_OK;
-            }else {
+            }else if(get_object(prim)) {
                 IDispatch_Release(get_object(prim));
             }
         }
@@ -435,7 +435,7 @@ HRESULT to_primitive(script_ctx_t *ctx, jsval_t val, jsval_t *ret, hint_t hint)
                 jsdisp_release(jsdisp);
                 *ret = prim;
                 return S_OK;
-            }else {
+            }else if(get_object(prim)) {
                 IDispatch_Release(get_object(prim));
             }
         }
diff --git a/dlls/jscript/number.c b/dlls/jscript/number.c
index 472acd0..830c053 100644
--- a/dlls/jscript/number.c
+++ b/dlls/jscript/number.c
@@ -44,7 +44,7 @@ static inline HRESULT numberval_this(jsval_t vthis, DOUBLE *ret)
     jsdisp_t *jsdisp;
     if(is_number(vthis))
         *ret = get_number(vthis);
-    else if(is_object_instance(vthis) && (jsdisp = to_jsdisp(get_object(vthis))) && is_class(jsdisp, JSCLASS_NUMBER))
+    else if(is_object_instance(vthis) && get_object(vthis) && (jsdisp = to_jsdisp(get_object(vthis))) && is_class(jsdisp, JSCLASS_NUMBER))
         *ret = number_from_jsdisp(jsdisp)->value;
     else
         return JS_E_NUMBER_EXPECTED;
diff --git a/dlls/jscript/object.c b/dlls/jscript/object.c
index f8f1407..f375491 100644
--- a/dlls/jscript/object.c
+++ b/dlls/jscript/object.c
@@ -273,7 +273,7 @@ static HRESULT Object_isPrototypeOf(script_ctx_t *ctx, jsval_t vthis, WORD flags
         goto done;
 
     if(argc && (jsthis = to_jsdisp(disp)) && is_object_instance(argv[0]) &&
-       (jsdisp = to_jsdisp(get_object(argv[0])))) {
+       get_object(argv[0]) && (jsdisp = to_jsdisp(get_object(argv[0])))) {
         while(jsdisp->prototype) {
             if(jsdisp->prototype == jsthis) {
                 ret = TRUE;
@@ -332,13 +332,13 @@ HRESULT Object_set_proto_(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsigned
             *r = jsval_undefined();
         return S_OK;
     }
-    if(!is_object_instance(vthis) || !(jsthis = to_jsdisp(get_object(vthis))))
+    if(!is_object_instance(vthis) || !get_object(vthis) || !(jsthis = to_jsdisp(get_object(vthis))))
         goto done;
 
     if(is_null(argv[0])) {
         proto = NULL;
     }else if(is_object_instance(argv[0])) {
-        proto = to_jsdisp(get_object(argv[0]));
+        proto = get_object(argv[0]) ? to_jsdisp(get_object(argv[0])) : NULL;
         if(!proto) {
             FIXME("Host object value\n");
             return E_FAIL;
@@ -476,7 +476,7 @@ static HRESULT to_property_descriptor(script_ctx_t *ctx, jsdisp_t *attr_obj, pro
                 hres = E_FAIL;
             }else {
                 /* FIXME: Check IsCallable */
-                desc->getter = to_jsdisp(get_object(v));
+                desc->getter = get_object(v) ? to_jsdisp(get_object(v)) : NULL;
                 if(!desc->getter)
                     FIXME("getter is not JS object\n");
             }
@@ -500,7 +500,7 @@ static HRESULT to_property_descriptor(script_ctx_t *ctx, jsdisp_t *attr_obj, pro
                 hres = E_FAIL;
             }else {
                 /* FIXME: Check IsCallable */
-                desc->setter = to_jsdisp(get_object(v));
+                desc->setter = get_object(v) ? to_jsdisp(get_object(v)) : NULL;
                 if(!desc->setter)
                     FIXME("setter is not JS object\n");
             }
@@ -587,7 +587,7 @@ static HRESULT Object_defineProperty(script_ctx_t *ctx, jsval_t vthis, WORD flag
 
     TRACE("\n");
 
-    if(argc < 1 || !is_object_instance(argv[0]))
+    if(argc < 1 || !is_object_instance(argv[0]) || !get_object(argv[0]))
         return JS_E_OBJECT_EXPECTED;
     obj = to_jsdisp(get_object(argv[0]));
     if(!obj) {
@@ -599,7 +599,7 @@ static HRESULT Object_defineProperty(script_ctx_t *ctx, jsval_t vthis, WORD flag
     if(FAILED(hres))
         return hres;
 
-    if(argc >= 3 && is_object_instance(argv[2])) {
+    if(argc >= 3 && is_object_instance(argv[2]) && get_object(argv[2])) {
         attr_obj = to_jsdisp(get_object(argv[2]));
         if(attr_obj) {
             hres = to_property_descriptor(ctx, attr_obj, &prop_desc);
@@ -655,7 +655,7 @@ static HRESULT Object_getOwnPropertyDescriptor(script_ctx_t *ctx, jsval_t vthis,
 
     TRACE("\n");
 
-    if(argc < 1 || !is_object_instance(argv[0]))
+    if(argc < 1 || !is_object_instance(argv[0]) || !get_object(argv[0]))
         return JS_E_OBJECT_EXPECTED;
     obj = to_jsdisp(get_object(argv[0]));
     if(!obj) {
@@ -751,7 +751,7 @@ static HRESULT Object_getPrototypeOf(script_ctx_t *ctx, jsval_t vthis, WORD flag
 {
     jsdisp_t *obj;
 
-    if(!argc || !is_object_instance(argv[0])) {
+    if(!argc || !is_object_instance(argv[0]) || !get_object(argv[0])) {
         FIXME("invalid arguments\n");
         return E_NOTIMPL;
     }
diff --git a/dlls/jscript/set.c b/dlls/jscript/set.c
index 35edcf8..6e2e017 100644
--- a/dlls/jscript/set.c
+++ b/dlls/jscript/set.c
@@ -182,7 +182,7 @@ static HRESULT get_map_this(jsval_t vthis, MapInstance **ret)
 
     if(!is_object_instance(vthis))
         return JS_E_OBJECT_EXPECTED;
-    if(!(jsdisp = to_jsdisp(get_object(vthis))) || !is_class(jsdisp, JSCLASS_MAP)) {
+    if(!get_object(vthis) || !(jsdisp = to_jsdisp(get_object(vthis))) || !is_class(jsdisp, JSCLASS_MAP)) {
         WARN("not a Map object passed as 'this'\n");
         return JS_E_MAP_EXPECTED;
     }
diff --git a/dlls/jscript/string.c b/dlls/jscript/string.c
index 0b2e695..74dd061 100644
--- a/dlls/jscript/string.c
+++ b/dlls/jscript/string.c
@@ -38,7 +38,7 @@ static inline StringInstance *string_from_jsdisp(jsdisp_t *jsdisp)
 
 static inline StringInstance *string_this(jsval_t vthis)
 {
-    jsdisp_t *jsdisp = is_object_instance(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
+    jsdisp_t *jsdisp = is_object_instance(vthis) && get_object(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
     return (jsdisp && is_class(jsdisp, JSCLASS_STRING)) ? string_from_jsdisp(jsdisp) : NULL;
 }
 
@@ -580,7 +580,7 @@ static HRESULT String_match(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsign
         return S_OK;
     }
 
-    if(is_object_instance(argv[0])) {
+    if(is_object_instance(argv[0]) && get_object(argv[0])) {
         regexp = iface_to_jsdisp(get_object(argv[0]));
         if(regexp && !is_class(regexp, JSCLASS_REGEXP)) {
             jsdisp_release(regexp);
@@ -743,7 +743,7 @@ static HRESULT String_replace(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsi
         return S_OK;
     }
 
-    if(is_object_instance(argv[0])) {
+    if(is_object_instance(argv[0]) && get_object(argv[0])) {
         regexp = iface_to_jsdisp(get_object(argv[0]));
         if(regexp && !is_class(regexp, JSCLASS_REGEXP)) {
             jsdisp_release(regexp);
@@ -760,7 +760,7 @@ static HRESULT String_replace(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsi
     }
 
     if(argc >= 2) {
-        if(is_object_instance(argv[1])) {
+        if(is_object_instance(argv[1]) && get_object(argv[1])) {
             rep_func = iface_to_jsdisp(get_object(argv[1]));
             if(rep_func && !is_class(rep_func, JSCLASS_FUNCTION)) {
                 jsdisp_release(rep_func);
@@ -959,7 +959,7 @@ static HRESULT String_search(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsig
         return S_OK;
     }
 
-    if(is_object_instance(argv[0])) {
+    if(is_object_instance(argv[0]) && get_object(argv[0])) {
         regexp = iface_to_jsdisp(get_object(argv[0]));
         if(regexp && !is_class(regexp, JSCLASS_REGEXP)) {
             jsdisp_release(regexp);
@@ -1116,7 +1116,7 @@ static HRESULT String_split(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsign
         }
     }
 
-    if(is_object_instance(argv[0])) {
+    if(is_object_instance(argv[0]) && get_object(argv[0])) {
         regexp = iface_to_jsdisp(get_object(argv[0]));
         if(regexp) {
             if(!is_class(regexp, JSCLASS_REGEXP)) {
diff --git a/dlls/jscript/vbarray.c b/dlls/jscript/vbarray.c
index 881c45e..6f35586 100644
--- a/dlls/jscript/vbarray.c
+++ b/dlls/jscript/vbarray.c
@@ -35,7 +35,7 @@ static inline VBArrayInstance *vbarray_from_jsdisp(jsdisp_t *jsdisp)
 
 static inline VBArrayInstance *vbarray_this(jsval_t vthis)
 {
-    jsdisp_t *jsdisp = is_object_instance(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
+    jsdisp_t *jsdisp = is_object_instance(vthis) && get_object(vthis) ? to_jsdisp(get_object(vthis)) : NULL;
     return (jsdisp && is_class(jsdisp, JSCLASS_VBARRAY)) ? vbarray_from_jsdisp(jsdisp) : NULL;
 }
 
-- 
2.34.1




More information about the wine-devel mailing list