Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-11 12:25:53 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1527592 - Preserve callable/constructor flags when returning a dead object proxy from Compartment::wrap. r=evilpie,jorendorff

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D19945

--HG--
extra : moz-landing-system : lando
This commit is contained in:
Jan de Mooij 2019-02-19 10:11:27 +00:00
parent 095c9d9c6f
commit f0d43beec0
4 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
js/src/jit-test/tests/basic/bug1527592.js Normal file
View File

@ -0,0 +1,7 @@
// |jit-test| error:dead object
var g1 = newGlobal();
var g2 = newGlobal({newCompartment: true});
var f = g2.Function("");
nukeAllCCWs();
var c = new class extends f {};
c();

15
js/src/proxy/DeadObjectProxy.cpp
View File

@ -160,3 +160,18 @@ JSObject* js::NewDeadProxyObject(JSContext* cx, JSObject* origObj) {
return NewProxyObject(cx, &DeadObjectProxy::singleton, target, nullptr,
ProxyOptions());
}
JSObject* js::NewDeadProxyObject(JSContext* cx, IsCallableFlag isCallable,
IsConstructorFlag isConstructor) {
int32_t flags = 0;
if (isCallable == IsCallableFlag::True) {
flags |= DeadObjectProxyIsCallable;
}
if (isConstructor == IsConstructorFlag::True) {
flags |= DeadObjectProxyIsConstructor;
}
RootedValue target(cx, Int32Value(flags));
return NewProxyObject(cx, &DeadObjectProxy::singleton, target, nullptr,
ProxyOptions());
}

6
js/src/proxy/DeadObjectProxy.h
View File

@ -89,6 +89,12 @@ Value DeadProxyTargetValue(ProxyObject* obj);
JSObject* NewDeadProxyObject(JSContext* cx, JSObject* origObj = nullptr);
enum class IsCallableFlag : bool { False, True };
enum class IsConstructorFlag : bool { False, True };
JSObject* NewDeadProxyObject(JSContext* cx, IsCallableFlag isCallable,
IsConstructorFlag isConstructor);
} /* namespace js */
#endif /* proxy_DeadObjectProxy_h */

3
js/src/vm/Compartment.cpp
View File

@ -218,7 +218,8 @@ bool Compartment::getNonWrapperObjectForCurrentCompartment(
// Disallow creating new wrappers if we nuked the object's realm or the
// current compartment.
if (!AllowNewWrapper(this, obj)) {
JSObject* res = NewDeadProxyObject(cx);
JSObject* res = NewDeadProxyObject(cx, IsCallableFlag(obj->isCallable()),
IsConstructorFlag(obj->isConstructor()));
if (!res) {
return false;
}