Fix bug in comparison logic of object property (#22348)

vreality64 · kelset · commit 692fc2e4d903 · 2018-12-12T16:58:23.000Z
Summary: `instance.hasOwnProperty` has potential danger because of some object could be eliminate own prototype chain. Update code be more reliable. This PR is solution of #22308 issue. (Fixes #22308) Pull Request resolved: #22348 Differential Revision: D13334882 Pulled By: cpojer fbshipit-source-id: 9b9310a972e933af1962666d7b0c683ff43cc5b2
diff --git a/Libraries/vendor/core/mergeInto.js b/Libraries/vendor/core/mergeInto.js
@@ -47,7 +47,7 @@ function mergeInto(one, two) {
   if (two != null) {
     checkMergeObjectArg(two);
     for (var key in two) {
-      if (!two.hasOwnProperty(key)) {
+      if (!Object.prototype.hasOwnProperty.call(two, key)) {
         continue;
       }
       one[key] = two[key];

Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ function mergeInto(one, two) {`
`47`	`47`	`if (two != null) {`
`48`	`48`	`checkMergeObjectArg(two);`
`49`	`49`	`for (var key in two) {`
`50`		`- if (!two.hasOwnProperty(key)) {`
	`50`	`+ if (!Object.prototype.hasOwnProperty.call(two, key)) {`
`51`	`51`	`continue;`
`52`	`52`	`}`
`53`	`53`	`one[key] = two[key];`