Bug 1282332 - Refuse to parse display names with unquoted, non-numeric, property names; r=jorendorff

--HG--
extra : rebase_source : 77825ee84d76beed0da58b6092f4730c6d64c7a2

js/src/jsfun.cpp

@@ -1670,13 +1670,17 @@ FunctionNameFromDisplayName(JSContext* cx, TextChar* text, size_t textLen, Strin
             MOZ_ASSERT(0);
             break;
         } else if (text[index] == (TextChar)']') {
-            // Here we're dealing with an unquoted numeric value so we can
-            // just skip to the closing bracket to save some work.
+            // Here we expect an unquoted numeric value. If that's the case
+            // we can just skip to the closing bracket to save some work.
             for (size_t j = 0; j < index; j++) {
-                if (text[(index - j) - 1] == (TextChar)'[') {
+                TextChar numeral = text[(index - j) - 1];
+                if (numeral == (TextChar)'[') {
                     start = index - j;
                     end = index;
                     break;
+                } else if (numeral > (TextChar)'9' || numeral < (TextChar)'0') {
+                    // Fail on anything that isn't a numeral (Bug 1282332).
+                    return false;
                 }
             }
             break;

js/src/tests/ecma_6/Function/name.js

@@ -75,4 +75,23 @@ assertEq(({"[abba]": () => 1})["[abba]"].name, "[abba]");
 let zip = obj.wubba;
 assertEq(zip.name, "wubba");
 
+// (Bug 1282332) Accessed as a property based on a function name
+// This creates a tricky display name of the form: x[y[0]].
+let idaho = {0: () => 1};
+
+let planetz = {};
+planetz[idaho[0]] = () => 1;
+assertEq(planetz[idaho[0]].name, "");
+
+let moya = {};
+moya[planetz[idaho[0]]] =  () => 1;
+assertEq(moya[planetz[idaho[0]]].name, "");
+
+
+// Bound function names
+function bound() {};
+assertEq(bound.name, "bound");
+assertEq(bound.bind(Object).name, "bound bound");
+assertEq((function(){}).bind(function(){}).name, "bound ");
+
 reportCompare(0, 0, 'ok');