Need to check object realm when doing a NewObjectCache lookup

RESOLVED FIXED in Firefox 65

Status

()

RESOLVED FIXED
4 months ago
3 months ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

(Blocks: 1 bug)

unspecified
mozilla65
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox65 fixed)

Details

Attachments

(2 attachments)

(Assignee)

Description

4 months ago
Enabling same-compartment-realms for system realms uncovered a fun bug: the NewObjectCache lookup is based on clasp + one of proto/group/global. If we do the lookup based on the proto, the cache can incorrectly return a cross-realm object with same-compartment-realms. I'll try to write a shell test.

Comment 3

3 months ago
Pushed by jdemooij@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/c24a1c1237ba
part 1 - Add a realm check to the NewObjectCache to fix a bug with same-compartment realms. r=luke
https://hg.mozilla.org/integration/autoland/rev/09493e80dbe7
part 2 - Don't create a TypeNewScript for cross-realm constructors, add more asserts. r=luke

Comment 4

3 months ago
bugherder
https://hg.mozilla.org/mozilla-central/rev/c24a1c1237ba
https://hg.mozilla.org/mozilla-central/rev/09493e80dbe7
Status: ASSIGNED → RESOLVED
Last Resolved: 3 months ago
status-firefox65: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla65
You need to log in before you can comment on or make changes to this bug.