From f9b1a9e60cfd39fa71a8a5fd28a7b5ee8db0f6aa Mon Sep 17 00:00:00 2001
From: Linus Groh <mail@linusgroh.de>
Date: Fri, 29 Jan 2021 20:22:18 +0100
Subject: [PATCH] LibJS: Let RegExp.string get RegExp.prototype from the global
 object directly

We can't assume that RegExp on the global object is still the original
constructor, or an object at all.

This makes '--RegExp<</<</</,/</x/' work. :^)

Found by OSS-Fuzz:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29740
---
 Userland/Libraries/LibJS/Runtime/RegExpPrototype.cpp | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/Userland/Libraries/LibJS/Runtime/RegExpPrototype.cpp b/Userland/Libraries/LibJS/Runtime/RegExpPrototype.cpp
index 8540b7bc060..c1f6b2b5ad7 100644
--- a/Userland/Libraries/LibJS/Runtime/RegExpPrototype.cpp
+++ b/Userland/Libraries/LibJS/Runtime/RegExpPrototype.cpp
@@ -137,9 +137,8 @@ JS_DEFINE_NATIVE_GETTER(RegExpPrototype::source)
     if (!this_object)
         return {};
 
-    // FIXME: This is obnoxious - we should have an easier way of looking up %RegExp.prototype%.
-    auto& regexp_prototype = global_object.get(vm.names.RegExp).as_object().get(vm.names.prototype).as_object();
-    if (this_object == &regexp_prototype)
+    auto* regexp_prototype = global_object.regexp_prototype();
+    if (this_object == regexp_prototype)
         return js_string(vm, "(?:)");
 
     auto regexp_object = regexp_object_from(vm, global_object);