Add assertions XrayResolveAttribute is not called with selfhosted getters

RESOLVED FIXED in Firefox 67

Status

()

enhancement
RESOLVED FIXED
4 months ago
3 months ago

People

(Reporter: anba, Assigned: anba)

Tracking

Trunk
mozilla67
Points:
---

Firefox Tracking Flags

(firefox67 fixed)

Details

Attachments

(1 attachment)

Assignee

Description

4 months ago

XrayResolveAttribute directly accesses JSPropertySpec::accessors::getters::native without a prior check if the getter is self-hosted (or an accessor in the first place). Let's add some assertions to catch misuse more nicely than obscure crashes when later trying to reinterpret a SelfHostedWrapper as a JSNativeWrapper.

Assignee

Comment 1

4 months ago

Assert correct use of XrayResolveAttribute, so we don't crash later on when retrieving the JSPropertySpec fields.

Attachment #9042484 - Flags: review?(bzbarsky)
Comment on attachment 9042484 [details] [diff] [review]
bug1526318.patch

r=me
Attachment #9042484 - Flags: review?(bzbarsky) → review+

Comment 4

3 months ago

Pushed by rgurzau@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6995ea68c908
Assert the JSPropertySpec in XrayResolveAttribute has a native accessor function. r=bz

Keywords: checkin-needed

Comment 5

3 months ago
bugherder
Status: ASSIGNED → RESOLVED
Last Resolved: 3 months ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
You need to log in before you can comment on or make changes to this bug.