568007 - js_GetReservedSlot is too friendly to api abusers

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[timeless]

Bug 560557 changed js_SetReservedSlot, and I have a patch in my tree to do the same for js_GetReservedSlot, but I neglected to post it there.

6239 js_SetReservedSlot(JSContext *cx, JSObject *obj, uint32 index, jsval v)

here we are fatal to api abusers (per bug 560557):
6249     JS_ASSERT(index < limit || ReservedSlotIndexOK(cx, obj, clasp, index, limit));
here we are fatal to api abusers:
6262         JS_ASSERT(slot < nslots);


6218 js_GetReservedSlot(JSContext *cx, JSObject *obj, uint32 index, jsval *vp)

here we seem to be coddling api abusers:
6229     if (index >= limit && !ReservedSlotIndexOK(cx, obj, clasp, index, limit))
6230         return false;

I think this case should also be fatal.

Jason Orendorff wrote:      
> ... there's the question of how this
> function should behave when the index is out of range. Hence this bug.

...
> In fact we're probably more likely to hit this assertion due to a bad bug in
> SpiderMonkey than for any other reason, our internal reserved-slot uses being
> far more complicated than those of any embedding I've seen.

Brendan Eich wrote (in bug 560557 comment 4 about js_SetReservedSlot):
> I did this out of paranoia over our own internal uses, yes. These seem debugged
> now. Let's just assert as usual.

Comment 1

[timeless]

Attachment: patch

Comment 2

[Jacek Caban]

http://hg.mozilla.org/mozilla-central/rev/9c85f9aaec8c