899693 - Fix unsafe references near HashableValue::setValue

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Terrence Cole [:terrence]]

Attachment: ur_MapObjectSetValue-v0.diff

We can easily make this a HandleValue.

Comment 1

[Steve Fink [:sfink] [:s:]]

Comment on attachment 783261 [details] [diff] [review]
ur_MapObjectSetValue-v0.diff

Review of attachment 783261 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsiter.h
@@ +299,5 @@
>          ok = ok && Next(cx, iterator, &currentValue);
>          return ok && !currentValue.get().isMagic(JS_NO_ITER_VALUE);
>      }
>  
> +    MutableHandleValue value() {

Why is this a *Mutable*HandleValue? When would you want to change the current value of the iterator? I don't see it used in this patch; am I missing it?

Actually, this doesn't seem like it belongs in this patch at all. It would make more sense in the other patch. Ooh... is it needed there?

Comment 2

[Steve Fink [:sfink] [:s:]]

Comment on attachment 783261 [details] [diff] [review]
ur_MapObjectSetValue-v0.diff

Review of attachment 783261 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/jsiter.h
@@ +299,5 @@
>          ok = ok && Next(cx, iterator, &currentValue);
>          return ok && !currentValue.get().isMagic(JS_NO_ITER_VALUE);
>      }
>  
> +    MutableHandleValue value() {

Oh! It was a non-const reference, so the caller can modify the Value at the current point of iteration. Duh.

Comment 3

[Terrence Cole [:terrence]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/1d49d7996875

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/1d49d7996875