Bug 1201124: Unwrap objects before getting their fields in asm.js; r?luke
MozReview-Commit-ID: 8TyHcvq4wnD
--- a/js/src/asmjs/AsmJS.cpp
+++ b/js/src/asmjs/AsmJS.cpp
@@ -7404,23 +7404,30 @@ static bool
LinkFail(JSContext* cx, const char* str)
{
JS_ReportErrorFlagsAndNumberASCII(cx, JSREPORT_WARNING, GetErrorMessage, nullptr,
JSMSG_USE_ASM_LINK_FAIL, str);
return false;
}
static bool
+IsMaybeWrappedScriptedProxy(JSObject* obj)
+{
+ JSObject* unwrapped = UncheckedUnwrap(obj);
+ return unwrapped && IsScriptedProxy(unwrapped);
+}
+
+static bool
GetDataProperty(JSContext* cx, HandleValue objVal, HandleAtom field, MutableHandleValue v)
{
if (!objVal.isObject())
return LinkFail(cx, "accessing property of non-object");
RootedObject obj(cx, &objVal.toObject());
- if (IsScriptedProxy(obj))
+ if (IsMaybeWrappedScriptedProxy(obj))
return LinkFail(cx, "accessing property of a Proxy");
Rooted<PropertyDescriptor> desc(cx);
RootedId id(cx, AtomToId(field));
if (!GetPropertyDescriptor(cx, obj, id, &desc))
return false;
if (!desc.object())
@@ -7685,18 +7692,16 @@ ValidateSimdType(JSContext* cx, const As
{
RootedValue _(cx);
return ValidateSimdType(cx, global, globalVal, &_);
}
static bool
ValidateSimdOperation(JSContext* cx, const AsmJSGlobal& global, HandleValue globalVal)
{
- // SIMD operations are loaded from the SIMD type, so the type must have been
- // validated before the operation.
RootedValue v(cx);
JS_ALWAYS_TRUE(ValidateSimdType(cx, global, globalVal, &v));
if (!GetDataProperty(cx, v, global.field(), &v))
return false;
Native native = nullptr;
switch (global.simdOperationType()) {
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/asm.js/bug1201124-simd-proxy.js
@@ -0,0 +1,25 @@
+// |jit-test| test-also-noasmjs
+load(libdir + "asm.js");
+load(libdir + "asserts.js");
+
+if (typeof newGlobal !== 'function')
+ quit();
+
+var stdlib = new (newGlobal().Proxy)(this, new Proxy({
+ simdGet: 0,
+ getOwnPropertyDescriptor(t, pk) {
+ if (pk === "SIMD" && this.simdGet++ === 1) {
+ return {};
+ }
+ return Reflect.getOwnPropertyDescriptor(t, pk);
+ }
+}, {
+ get(t, pk, r) {
+ print("trap", pk);
+ return Reflect.get(t, pk, r);
+ }
+}));
+
+var m = asmCompile('stdlib', '"use asm"; var i4=stdlib.SIMD.Int32x4; var i4add=i4.add; return {}');
+
+assertAsmLinkFail(m, stdlib);