Bug 1398601 - Don't allow NSVO in js::CreateObjectsForEnvironmentChain draft
authorTed Campbell <tcampbell@mozilla.com>
Sat, 09 Sep 2017 20:37:18 -0400
changeset 664085 d4f129feb476cc2d6fb731124d6dc025a3504ac5
parent 664084 9d3481f3e0d8b9ad66ecb55c7b901d514c09b619
child 731375 1d4ab78989919fa91c4c209b22e2f59314b691b8
push id79624
push userbmo:tcampbell@mozilla.com
push dateWed, 13 Sep 2017 18:23:23 +0000
bugs1398601
milestone57.0a1
Bug 1398601 - Don't allow NSVO in js::CreateObjectsForEnvironmentChain Seeing an NSVO in CreateObjectsForEnvironmentChain indicates the shared global namespace is about to be polluted, so fix those bugs and turn this to a diagnostic. MozReview-Commit-ID: 7OUef76geJL
js/src/vm/EnvironmentObject.cpp
--- a/js/src/vm/EnvironmentObject.cpp
+++ b/js/src/vm/EnvironmentObject.cpp
@@ -3182,17 +3182,18 @@ js::GetDebugEnvironmentForGlobalLexicalE
 
 bool
 js::CreateObjectsForEnvironmentChain(JSContext* cx, AutoObjectVector& chain,
                                      HandleObject terminatingEnv, MutableHandleObject envObj)
 {
 #ifdef DEBUG
     for (size_t i = 0; i < chain.length(); ++i) {
         assertSameCompartment(cx, chain[i]);
-        MOZ_ASSERT(!chain[i]->is<GlobalObject>());
+        MOZ_ASSERT(!chain[i]->is<GlobalObject>() &&
+                   !chain[i]->is<NonSyntacticVariablesObject>());
     }
 #endif
 
     // Construct With object wrappers for the things on this environment chain
     // and use the result as the thing to scope the function to.
     Rooted<WithEnvironmentObject*> withEnv(cx);
     RootedObject enclosingEnv(cx, terminatingEnv);
     for (size_t i = chain.length(); i > 0; ) {