Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-29 15:52:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1494518 - Do not pass non-PromiseObject to JSRuntime::enqueuePromiseJob. r=till

Browse Source
This commit is contained in:
Tooru Fujisawa 2018-09-28 00:06:51 +09:00
parent 58812c5536
commit 12a859a177
2 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
js/src/builtin/Promise.cpp
View File

@ -1018,9 +1018,23 @@ EnqueuePromiseReactionJob(JSContext* cx, HandleObject reactionObj,
// handler's compartment above, because we should pass objects from a
// single compartment to the enqueuePromiseJob callback.
RootedObject promise(cx, reaction->promise());
if (promise && promise->is<PromiseObject>()) {
if (!cx->compartment()->wrap(cx, &promise)) {
return false;
if (promise) {
if (promise->is<PromiseObject>()) {
if (!cx->compartment()->wrap(cx, &promise)) {
return false;
}
} else if (IsWrapper(promise)) {
// `promise` can be already-wrapped promise object at this point.
JSObject* unwrappedPromise = UncheckedUnwrap(promise);
if (unwrappedPromise->is<PromiseObject>()) {
if (!cx->compartment()->wrap(cx, &promise)) {
return false;
}
} else {
promise = nullptr;
}
} else {
promise = nullptr;
}
}

4
js/src/vm/Runtime.cpp
View File

@ -648,6 +648,10 @@ JSRuntime::enqueuePromiseJob(JSContext* cx, HandleFunction job, HandleObject pro
void* data = cx->enqueuePromiseJobCallbackData;
RootedObject allocationSite(cx);
if (promise) {
#ifdef DEBUG
AssertSameCompartment(job, promise);
#endif
RootedObject unwrappedPromise(cx, promise);
// While the job object is guaranteed to be unwrapped, the promise
// might be wrapped. See the comments in EnqueuePromiseReactionJob in