Closed
Bug 1652567
Opened 4 years ago
Closed 4 years ago
%IteratorHelper% and %WrapForValidIterator% guards don't work cross-realm
Categories
(Core :: JavaScript Engine, defect, P1)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla80
Tracking | Status | |
---|---|---|
firefox80 | --- | fixed |
People
(Reporter: avandolder, Assigned: avandolder)
References
(Blocks 1 open bug)
Details
Attachments
(1 file)
Currently, both WrapForValidIterator
and IteratorHelper
objects use the intrinsic GuardToBuiltin
functions when checking whether the passed object is of the expected type before accessing it's reserved slots. However, this does not work for objects created in different realms.
Assignee | ||
Comment 1•4 years ago
|
||
Assignee | ||
Comment 2•4 years ago
•
|
||
Updated•4 years ago
|
Severity: -- → S4
Priority: -- → P1
Pushed by avandolder@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/38651ec15935
Make IteratorHelper and WrapForValidIterator objects work cross-realm. r=jorendorff,anba
Comment 4•4 years ago
|
||
bugherder |
Status: ASSIGNED → RESOLVED
Closed: 4 years ago
status-firefox80:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla80
You need to log in
before you can comment on or make changes to this bug.
Description
•