Closed Bug 1526318 Opened 1 year ago Closed 1 year ago

Add assertions XrayResolveAttribute is not called with selfhosted getters

Categories

(Core :: DOM: Bindings (WebIDL), enhancement)

enhancement
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla67
Tracking Status
firefox67 --- fixed

People

(Reporter: anba, Assigned: anba)

Details

Attachments

(1 file)

XrayResolveAttribute directly accesses JSPropertySpec::accessors::getters::native without a prior check if the getter is self-hosted (or an accessor in the first place). Let's add some assertions to catch misuse more nicely than obscure crashes when later trying to reinterpret a SelfHostedWrapper as a JSNativeWrapper.

Attached patch bug1526318.patchSplinter Review

Assert correct use of XrayResolveAttribute, so we don't crash later on when retrieving the JSPropertySpec fields.

Attachment #9042484 - Flags: review?(bzbarsky)
Comment on attachment 9042484 [details] [diff] [review]
bug1526318.patch

r=me
Attachment #9042484 - Flags: review?(bzbarsky) → review+

Pushed by rgurzau@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/6995ea68c908
Assert the JSPropertySpec in XrayResolveAttribute has a native accessor function. r=bz

Keywords: checkin-needed
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla67
You need to log in before you can comment on or make changes to this bug.