Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-08 19:04:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1851416 - Properly guard that the proxy hasn't been revoked r=iain

Browse Source 
Maybe a little bit alarming how simple this testcase is.

Differential Revision: https://phabricator.services.mozilla.com/D187511
This commit is contained in:
Doug Thayer 2023-09-06 16:06:25 +00:00
parent 61aca7cda4
commit 3b66ad25bb
5 changed files with 33 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
js/src/jit-test/tests/proxy/testDirectProxyGet14.js Normal file
View File

@ -0,0 +1,22 @@
load(libdir + "asserts.js");
var target = {x: 5};
var returnValue = 42;
var handler = {
get(t, p) {
return returnValue;
}
};
var {proxy, revoke} = Proxy.revocable(target, handler);
function testGet(p) {
return p.x;
}
for (i = 0; i < 200; i++) {
assertEq(testGet(proxy), returnValue);
}
assertEq(testGet(proxy), returnValue);
revoke();
assertThrowsInstanceOf(function () { testGet(proxy) }, TypeError);

3
js/src/jit/CacheIR.cpp
View File

@ -1560,7 +1560,8 @@ AttachDecision GetPropIRGenerator::tryAttachScriptedProxy(
writer.guardIsProxy(objId);
writer.guardHasProxyHandler(objId, &ScriptedProxyHandler::singleton);
ObjOperandId handlerObjId = writer.loadScriptedProxyHandler(objId);
ValOperandId handlerValId = writer.loadScriptedProxyHandler(objId);
ObjOperandId handlerObjId = writer.guardToObject(handlerValId);
ObjOperandId targetObjId = writer.loadWrapperTarget(objId);
if (trapKind == NativeGetPropKind::Missing) {

12
js/src/jit/CacheIRCompiler.cpp
View File

@ -2253,17 +2253,19 @@ bool CacheIRCompiler::emitGuardDynamicSlotValue(ObjOperandId objId,
return true;
}
bool CacheIRCompiler::emitLoadScriptedProxyHandler(ObjOperandId resultId,
bool CacheIRCompiler::emitLoadScriptedProxyHandler(ValOperandId resultId,
ObjOperandId objId) {
JitSpew(JitSpew_Codegen, "%s", __FUNCTION__);
Register obj = allocator.useRegister(masm, objId);
Register output = allocator.defineRegister(masm, resultId);
ValueOperand output = allocator.defineValueRegister(masm, resultId);
masm.loadPtr(Address(obj, ProxyObject::offsetOfReservedSlots()), output);
masm.unboxObject(Address(output, js::detail::ProxyReservedSlots::offsetOfSlot(
masm.loadPtr(Address(obj, ProxyObject::offsetOfReservedSlots()),
output.scratchReg());
masm.loadValue(
Address(output.scratchReg(), js::detail::ProxyReservedSlots::offsetOfSlot(
ScriptedProxyHandler::HANDLER_EXTRA)),
output);
output);
return true;
}

2
js/src/jit/CacheIROps.yaml
View File

@ -668,7 +668,7 @@
transpile: true
cost_estimate: 1
args:
result: ObjId
result: ValId
obj: ObjId
- name: IdToStringOrSymbol

2
js/src/jit/WarpCacheIRTranspiler.cpp
View File

@ -912,7 +912,7 @@ bool WarpCacheIRTranspiler::emitGuardDynamicSlotValue(ObjOperandId objId,
return true;
}
bool WarpCacheIRTranspiler::emitLoadScriptedProxyHandler(ObjOperandId resultId,
bool WarpCacheIRTranspiler::emitLoadScriptedProxyHandler(ValOperandId resultId,
ObjOperandId objId) {
MDefinition* obj = getOperand(objId);