Bug 1415591: Consider the result of HasProperty as a cx failure in wasm::GetLimits; r?luke
MozReview-Commit-ID: 67pAAdM50xH
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/proxy-has-trap-table.js
@@ -0,0 +1,10 @@
+assertErrorMessage(() => {
+ var desc = {
+ element: "anyfunc",
+ };
+ var proxy = new Proxy({}, {
+ has: true
+ });
+ Object.setPrototypeOf(desc, proxy);
+ let table = new WebAssembly.Table(desc);
+}, TypeError, /proxy handler's has trap/);
--- a/js/src/wasm/WasmJS.cpp
+++ b/js/src/wasm/WasmJS.cpp
@@ -449,17 +449,20 @@ GetLimits(JSContext* cx, HandleObject ob
return false;
JSAtom* maximumAtom = Atomize(cx, "maximum", strlen("maximum"));
if (!maximumAtom)
return false;
RootedId maximumId(cx, AtomToId(maximumAtom));
bool found;
- if (HasProperty(cx, obj, maximumId, &found) && found) {
+ if (!HasProperty(cx, obj, maximumId, &found))
+ return false;
+
+ if (found) {
RootedValue maxVal(cx);
if (!GetProperty(cx, obj, obj, maximumId, &maxVal))
return false;
limits->maximum.emplace();
if (!ToNonWrappingUint32(cx, maxVal, maxMaximum, kind, "maximum size", limits->maximum.ptr()))
return false;