Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-12-03 18:47:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1799824 part 1 - Check array elements after potential side-effects in shortestPaths testing function. r=sfink

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D161767
This commit is contained in:
Jan de Mooij 2022-11-21 14:58:19 +00:00
parent 201a7aa1b3
commit 0ff4699518
2 changed files with 24 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
js/src/builtin/TestingFunctions.cpp
View File

@ -5888,22 +5888,6 @@ static bool ShortestPaths(JSContext* cx, unsigned argc, Value* vp) {
}
Rooted<ArrayObject*> objs(cx, &args[0].toObject().as<ArrayObject>());
size_t length = objs->getDenseInitializedLength();
if (length == 0) {
ReportValueError(cx, JSMSG_UNEXPECTED_TYPE, JSDVG_SEARCH_STACK, args[0],
nullptr,
"not a dense array object with one or more elements");
return false;
}
for (size_t i = 0; i < length; i++) {
RootedValue el(cx, objs->getDenseElement(i));
if (!el.isObject() && !el.isString() && !el.isSymbol()) {
JS_ReportErrorASCII(cx,
"Each target must be an object, string, or symbol");
return false;
}
}
RootedValue start(cx, NullValue());
int32_t maxNumPaths = 3;
@ -5952,6 +5936,24 @@ static bool ShortestPaths(JSContext* cx, unsigned argc, Value* vp) {
}
}
// Ensure we have at least one target.
size_t length = objs->getDenseInitializedLength();
if (length == 0) {
ReportValueError(cx, JSMSG_UNEXPECTED_TYPE, JSDVG_SEARCH_STACK, args[0],
nullptr,
"not a dense array object with one or more elements");
return false;
}
for (size_t i = 0; i < length; i++) {
RootedValue el(cx, objs->getDenseElement(i));
if (!el.isObject() && !el.isString() && !el.isSymbol()) {
JS_ReportErrorASCII(cx,
"Each target must be an object, string, or symbol");
return false;
}
}
// We accumulate the results into a GC-stable form, due to the fact that the
// JS::ubi::ShortestPaths lifetime (when operating on the live heap graph)
// is bounded within an AutoCheckCannotGC.

6
js/src/jit-test/tests/heap-analysis/shortestPaths.js
View File

@ -73,3 +73,9 @@ assertEq(e, "TypeError: 100 is not an array object");
try { paths = shortestPaths([f], {start: 200}); } catch (exc) { e = ""+exc; };
assertEq(e, "TypeError: 200 is not a GC thing");
// Bug 1799824.
let arr = [{}];
let objWithGetter = {get start() { arr.length = 0; return {}; }};
try { paths = shortestPaths(arr, objWithGetter); } catch (exc) { e = ""+exc; }
assertEq(e, "TypeError: arr is not a dense array object with one or more elements");