Fix a markup parser crash when a tag name shadows hasOwnProperty

[willeastcott]

Fixes the crash reported in #8578 with the minimal change.

The markup parser stores tag names as keys on plain objects and then calls .hasOwnProperty on those same objects while merging overlapping tags. A text element with enableMarkup set and text containing a tag named hasOwnProperty shadows the method and the parser throws:

TypeError: source.hasOwnProperty is not a function

This replaces the four method calls in markup.js with Object.prototype.hasOwnProperty.call(...) via a module-level hasOwn constant, and adds a Markup test file that covers the shadowing case and confirms Object.prototype is not polluted by a [__proto__] tag. The shadowing tests fail against the unmodified parser and pass with the change.

Unlike #8578, this does not touch the core extend utility or its merge semantics. The [__proto__] case was never a pollution vector: the tag is silently dropped both before and after this change.

🤖 Generated with Claude Code

[github-actions]

Build size report

This PR changes the size of the minified bundles.

Bundle	Minified	Gzip	Brotli
playcanvas.min.js	2472.0 KB (+9 B, +0.00%)	637.0 KB (+28 B, +0.00%)	494.3 KB (−538 B, −0.11%)
playcanvas.min.mjs	2469.3 KB (+7 B, +0.00%)	635.5 KB (+38 B, +0.01%)	494.1 KB (+182 B, +0.04%)

[Copilot]

Copilot review overview

🟢 Approval recommended

The change is minimal, targeted to the reported failure mode, and is backed by regression tests covering the crash scenario.

Review effort: Lite
Findings: 1

Open (1)

• Add test for merging into target with shadowing hasOwnProperty key · New

What changed in this PR

This pull request fixes a crash in the Element markup parser when a user-defined tag name shadows Object.prototype.hasOwnProperty (e.g. [hasOwnProperty]...[/hasOwnProperty]). It does so by switching internal own-property checks to Object.prototype.hasOwnProperty.call(...) (via a module-level hasOwn reference) and adds a focused unit test suite covering the shadowing case and a __proto__ non-pollution check.

Changes:

• Replace direct .hasOwnProperty(...) calls in markup.js with hasOwn.call(obj, key) to avoid shadowing crashes.
• Add Markup unit tests for tag-stripping and for handling a hasOwnProperty tag name without throwing.
• Add a regression test ensuring __proto__ tags do not pollute Object.prototype.

File	Description
src/​framework/​components/​element/​markup.js	Hardens internal merging/edge-building logic against hasOwnProperty shadowing by using hasOwn.call(...).
test/​framework/​components/​element/​markup.test.mjs	Adds unit coverage for the reported crash scenario and a __proto__ non-pollution regression check.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.