1055768 - TemporaryTypeSet::isDOMClass should return false if the set contains primitive types

Status: RESOLVED FIXED

(Core :: JavaScript Engine: JIT, defect)

Description

[Jan de Mooij [:jandem]]

isDOMClass() currently ignores primitive types and this can be error prone, see bug 1054359.

We can change isDOMClass() to return false if primitives are possible and add isDOMClassOrPrimitive (or something) for places where we want the current behavior.

getKnownClass, getTypedArrayType etc probably need the same treatment...

Comment 1

[Jan de Mooij [:jandem]]

(Filing s-s for now until we know there are no similar bugs elsewhere.)

Comment 2

[Boris Zbarsky [:bzbarsky]]

> for places where we want the current behavior

There aren't any, imo.  The only callers of isDOMClass() are makeCallHelper, getPropTryCommonGetter, setPropTryCommonSetter in IonBuilder.  All of these only want it to return true when we know we have an object.

Comment 3

[Eric Faust [:efaust]]

Yeah, there are places where we are "probably already safe", but the cost of looking for other things is a flag check, and the risk is leaving it a footgun. Let's just make it undeniably safe.

Comment 4

[Andrew McCreight [:mccr8]]

Sounds like there are no actual bad places, so let's mark this as audit for now.

Comment 5

[Daniel Veditz [:dveditz]]

We don't need to use the more restrictive component-specific security groups unless a bug is sec-high or sec-critical

Comment 6

[Ted Campbell [:tcampbell]]

TemporaryTypeSet was removed.