Closed Bug 1652567 Opened 1 year ago Closed 1 year ago

%IteratorHelper% and %WrapForValidIterator% guards don't work cross-realm

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

RESOLVED FIXED
mozilla80
Tracking Status
firefox80 --- fixed

People

(Reporter: avandolder, Assigned: avandolder)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Currently, both WrapForValidIterator and IteratorHelper objects use the intrinsic GuardToBuiltin functions when checking whether the passed object is of the expected type before accessing it's reserved slots. However, this does not work for objects created in different realms.

Severity: -- → S4
Priority: -- → P1
Pushed by avandolder@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/38651ec15935
Make IteratorHelper and WrapForValidIterator objects work cross-realm. r=jorendorff,anba
Status: ASSIGNED → RESOLVED
Closed: 1 year ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla80
You need to log in before you can comment on or make changes to this bug.