695238 - Reflect.parse doesn't reject missing RHS in object literals

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Dave Herman [:dherman]]

This should fail:

    Reflect.parse("({foo})")

but doesn't. The problem is that jsemit.cpp does the check (and throws a TypeError with JSMSG_BAD_OBJECT_INIT), and jsreflect.cpp is not doing the same check.

Fix should be easy: just check for the PNX_DESTRUCT bit, same as jsemit.cpp.

Dave

Comment 1

[Dave Herman [:dherman]]

CC'ing Jesse, who may want to feed his fuzzer with some tasty new inputs.

Dave

Comment 2

[Dave Herman [:dherman]]

Attachment: checks PNX_DESTRUCT bit on TOK_RC expression nodes

Comment 3

[Dave Herman [:dherman]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/feeee0906588

Comment 4

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/feeee0906588