Fix debug assert when using instanceof if __proto__ was set to non-object (fix #2363)

Author: gfwilliams

ChangeLog

@@ -28,7 +28,8 @@
             Add Serial.flush() to allow us to wait for transmission on a device to finish
             Fix for var link corruption when replacing a native function with a normal one (fix #2361)
             Fix memory leak (and assert in debug mode) when iterating over an object with proto with for...of (fix #2360)
-            Fix assert when reversing an array with non-integer elements (fix #2362)
+            Fix debug assert when reversing an array with non-integer elements (fix #2362)
+            Fix debug assert when using instanceof if __proto__ was set to non-object (fix #2363)
 
      2v17 : Bangle.js: When reading file info from a filename table, do it in blocks of 8 (20% faster file search)
             Bangle.js2: Increase flash buffer size from 16->32 bytes (5% performance increase)

src/jsparse.c

@@ -2063,15 +2063,15 @@ NO_INLINE JsVar *__jspeBinaryExpression(JsVar *a, unsigned int lastPrecedence) {
             if (jsvIsObject(av) || jsvIsFunction(av)) {
               JsVar *bproto = jspGetNamedField(bv, JSPARSE_PROTOTYPE_VAR, false);
               JsVar *proto = jsvObjectGetChildIfExists(av, JSPARSE_INHERITS_VAR);
-              while (proto) {
+              while (jsvHasChildren(proto)) { // proto could have been set to anything (null/number/etc) #2363
                 if (proto == bproto) inst=true;
                 // search prototype chain
                 JsVar *childProto = jsvObjectGetChildIfExists(proto, JSPARSE_INHERITS_VAR);
                 jsvUnLock(proto);
                 proto = childProto;
               }
               if (jspIsConstructor(bv, "Object")) inst = true;
-              jsvUnLock(bproto);
+              jsvUnLock2(bproto, proto);
             }
             if (!inst) {
               const char *name = jswGetBasicObjectName(av);