524968 - JSFunction and JS_GetFunctionObject expose internal function objects to JSAPI clients

Status: NEW

(Core :: JavaScript Engine, defect)

Description

[Jason Orendorff [:jorendorff]]

As it stands, JS_GetFunctionObject and JS_CallFunction are unsafe due to the semantics of JSFunction. The plan is:

1. Redefine JSFunction to mean "a function object", meaning that it gets a safe, complete closure, never an internal function object.

2. Rename the internal "everything but the closed-on environment" struct currently called JSFunction. I like JSFunctionBody or JSFunctionCode. Brendan proposed js::Function and pointed out that code already has a few meanings in SM, including JSScript::code.

Comment 1

[Jason Orendorff [:jorendorff]]

The API change affects the semantics of the JSFunction pointers exposed by JS_ConvertArguments, JS_ValueToFunction, JS_ValueToConstructor, and jsdbgapi's JS_GetFrameFunction.

It will make them return different pointers for different closures with the same function body, technically an incompatible change. This won't break much code, if any.

It does not really affect JS_NewFunction, JS_Define{,UC}Function, JS_Compile* as those already return pointers that can be safely passed to JS_GetFunctionObject and JS_CallFunction.

The behavior of JS_GetFunctionName, JS_GetFunctionId, JS_GetFunctionFlags, JS_GetFunctionArity, JS_Decompile*, JS_ObjectIsFunction, JS_CloneFunctionObject will not change.

Comment 2

[Jason Orendorff [:jorendorff]]

Mmmm. This is going to require a change to the semantics (if not the signature) of JSNewScriptHook. It will take some sorting-out.

Comment 3

[Rob Campbell [:rc] (:robcee)]

watching this discussion eagerly as we call these from Firebug a fair bit.

Comment 4

[John J. Barton]

(In reply to comment #0)
> As it stands, JS_GetFunctionObject and JS_CallFunction are unsafe due to the
> semantics of JSFunction. The plan is:
> 
> 1. Redefine JSFunction to mean "a function object", meaning that it gets a
> safe, complete closure, never an internal function object.

How about a new JSFunctionObject returned by safe creators and with getJSFunction() to interface with (internal) consumers of JSFunction.

Then JS_GetFunctionObject returns a JSFunctionObject.