Closed Bug 1781061 Opened 2 years ago Closed 2 years ago

Emit JSOp::DebugCheckSelfHosted in more places

Categories

(Core :: JavaScript Engine, enhancement, P1)

enhancement

Tracking

()

RESOLVED FIXED
105 Branch
Tracking Status
firefox105 --- fixed

People

(Reporter: arai, Assigned: arai)

References

(Blocks 1 open bug)

Details

Attachments

(11 files)

48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review
48 bytes, text/x-phabricator-request
Details | Review

Bug 1609432 will add callContentFunction and constructContentFunction to all callsites where the callee can be content functions.
That means, in all other cases, the callee must be self-hosted function or built-in.
We can add JSOp::DebugCheckSelfHosted to all calls except for the above 2, so that
onNativeCall and eager evaluation keeps working.

Blocks: sm-security
Severity: -- → N/A
Type: task → enhancement
Priority: -- → P1

Array.from on an iterable object internally calls
%ArrayIteratorPrototype%.next, which is effectful.

The later patches will add more coverage inside for-of loop inside
self-hosted JS, and that will expose the call on obj[Symbol.iterator]().next,
which can be %ArrayIteratorPrototype%.next or any other function.

Blocks: 1782677
Pushed by arai_a@mac.com:
https://hg.mozilla.org/integration/autoland/rev/5a547dbb387b
Part 0: Do not use Array.from in eager evaluation test. r=nchevobbe
https://hg.mozilla.org/integration/autoland/rev/6dec44311fb1
Part 1: Add missing callContentFunction in sort. r=jandem
https://hg.mozilla.org/integration/autoland/rev/a7621b225cb3
Part 2: Remove self-hosted module code handling. r=jandem
https://hg.mozilla.org/integration/autoland/rev/52431c4b1588
Part 3: Add SelfHostedIter::{Allow,Deny} enum and use it in all functions that can call iteration related function. r=jandem
https://hg.mozilla.org/integration/autoland/rev/f0554d74eedb
Part 4: Cleanup stack comment and remove unused CallOrNewEmitter method. r=jandem
https://hg.mozilla.org/integration/autoland/rev/6f9dde36dbd8
Part 5: Disallow non-name callee in self-hosted JS. r=jandem
https://hg.mozilla.org/integration/autoland/rev/aa5f3bf898bc
Part 6: Add JSOp::CallContentIter. r=jandem
https://hg.mozilla.org/integration/autoland/rev/178d1de9debb
Part 7: Use JSOp::CallContentIter instead of JSOp::CallIter in self-hosted JS. r=jandem
https://hg.mozilla.org/integration/autoland/rev/7e49b9f5abc1
Part 8: Emit JSOp::DebugCheckSelfHosted in all case. r=jandem
https://hg.mozilla.org/integration/autoland/rev/c2480e13b36d
Part 9: Add eager evaluation test for crafted iterable. r=nchevobbe
https://hg.mozilla.org/integration/autoland/rev/19cb3c811aae
Part 10: Add eager evaluation test for reused iterator. r=nchevobbe
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: