Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-26 06:11:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 944975: fix bug by getting original fcn for callsite clone in New (r=shu).

Browse Source
This commit is contained in:
Felix S. Klock II 2014-02-07 17:56:38 +01:00
parent 8db9fa0a38
commit 2e24dda145
3 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
js/src/jsfun.cpp
View File

@ -118,8 +118,8 @@ fun_getProperty(JSContext *cx, HandleObject obj_, HandleId id, MutableHandleValu
/* Callsite clones should never escape to script. */
JSObject &maybeClone = iter.calleev().toObject();
if (maybeClone.is<JSFunction>() && maybeClone.as<JSFunction>().nonLazyScript()->isCallsiteClone())
vp.setObject(*maybeClone.as<JSFunction>().nonLazyScript()->originalFunction());
if (maybeClone.is<JSFunction>())
vp.setObject(*maybeClone.as<JSFunction>().originalFunction());
else
vp.set(iter.calleev());

10
js/src/jsfun.h
View File

@ -339,6 +339,16 @@ class JSFunction : public JSObject
return u.i.s.script_;
}
// Returns the non-callsited-clone version of this function. Use
// when return-value can flow to arbitrary JS (see Bug 944975).
JSFunction* originalFunction() {
if (this->hasScript() && this->nonLazyScript()->isCallsiteClone()) {
return this->nonLazyScript()->originalFunction();
} else {
return this;
}
}
js::HeapPtrScript &mutableScript() {
JS_ASSERT(isInterpreted());
return *(js::HeapPtrScript *)&u.i.s.script_;

7
js/src/vm/Interpreter.cpp
View File

@ -555,9 +555,10 @@ js::InvokeConstructor(JSContext *cx, CallArgs args)
return ok;
}
if (!fun->isInterpretedConstructor())
return ReportIsNotFunction(cx, args.calleev(), args.length() + 1, CONSTRUCT);
if (!fun->isInterpretedConstructor()) {
RootedValue orig(cx, ObjectValue(*fun->originalFunction()));
return ReportIsNotFunction(cx, orig, args.length() + 1, CONSTRUCT);
}
if (!Invoke(cx, args, CONSTRUCT))
return false;