mirrors/gecko-dev
1
0
Fork 1
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-11-11 21:58:41 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Backed out 9 changesets (bug 1142775, bug 1139683, bug 1143810, bug 1142761, bug 1142784, bug 1142794, bug 1144819) for widespread bustage

Browse source 
CLOSED TREE

Backed out changeset 7613fc978d36 (bug 1142794)
Backed out changeset e5f0cb31263d (bug 1142784)
Backed out changeset dcd0af73ac84 (bug 1142784)
Backed out changeset 034f9c8e79ee (bug 1142784)
Backed out changeset ce0ee37e3ca9 (bug 1142775)
Backed out changeset 1519b8f2bbba (bug 1142761)
Backed out changeset 26fd55677841 (bug 1139683)
Backed out changeset 7ebc76a450c3 (bug 1144819)
Backed out changeset 92adb459d519 (bug 1143810)
This commit is contained in:
Phil Ringnalda 2015-03-22 09:34:25 -07:00
parent 735dca6f1b
commit c4745d28b1
70 changed files with 719 additions and 862 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

2
dom/base/WindowNamedPropertiesHandler.cpp
View file

@ -159,7 +159,7 @@ bool
WindowNamedPropertiesHandler::defineProperty(JSContext* aCx, WindowNamedPropertiesHandler::defineProperty(JSContext* aCx,
JS::Handle<JSObject*> aProxy, JS::Handle<JSObject*> aProxy,
JS::Handle<jsid> aId, JS::Handle<jsid> aId,
JS::Handle<JSPropertyDescriptor> aDesc, JS::MutableHandle<JSPropertyDescriptor> aDesc,
JS::ObjectOpResult &result) const JS::ObjectOpResult &result) const
{ {
ErrorResult rv; ErrorResult rv;

2
dom/base/WindowNamedPropertiesHandler.h
View file

@ -28,7 +28,7 @@ public:
virtual bool virtual bool
defineProperty(JSContext* aCx, JS::Handle<JSObject*> aProxy, defineProperty(JSContext* aCx, JS::Handle<JSObject*> aProxy,
JS::Handle<jsid> aId, JS::Handle<jsid> aId,
JS::Handle<JSPropertyDescriptor> aDesc, JS::MutableHandle<JSPropertyDescriptor> aDesc,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
virtual bool virtual bool
ownPropNames(JSContext* aCx, JS::Handle<JSObject*> aProxy, unsigned flags, ownPropNames(JSContext* aCx, JS::Handle<JSObject*> aProxy, unsigned flags,

15
dom/base/nsGlobalWindow.cpp
View file

@ -621,7 +621,7 @@ public:
virtual bool defineProperty(JSContext* cx, virtual bool defineProperty(JSContext* cx,
JS::Handle<JSObject*> proxy, JS::Handle<JSObject*> proxy,
JS::Handle<jsid> id, JS::Handle<jsid> id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
virtual bool ownPropertyKeys(JSContext *cx, virtual bool ownPropertyKeys(JSContext *cx,
JS::Handle<JSObject*> proxy, JS::Handle<JSObject*> proxy,
@ -643,8 +643,9 @@ public:
JS::Handle<jsid> id, JS::Handle<jsid> id,
JS::MutableHandle<JS::Value> vp) const override; JS::MutableHandle<JS::Value> vp) const override;
virtual bool set(JSContext *cx, JS::Handle<JSObject*> proxy, virtual bool set(JSContext *cx, JS::Handle<JSObject*> proxy,
JS::Handle<jsid> id, JS::Handle<JS::Value> v, JS::Handle<JSObject*> receiver,
JS::Handle<JS::Value> receiver, JS::Handle<jsid> id,
JS::MutableHandle<JS::Value> vp,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
// SpiderMonkey extensions // SpiderMonkey extensions
@ -781,7 +782,7 @@ bool
nsOuterWindowProxy::defineProperty(JSContext* cx, nsOuterWindowProxy::defineProperty(JSContext* cx,
JS::Handle<JSObject*> proxy, JS::Handle<JSObject*> proxy,
JS::Handle<jsid> id, JS::Handle<jsid> id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result) const JS::ObjectOpResult &result) const
{ {
int32_t index = GetArrayIndexFromId(cx, id); int32_t index = GetArrayIndexFromId(cx, id);
@ -908,9 +909,9 @@ nsOuterWindowProxy::get(JSContext *cx, JS::Handle<JSObject*> proxy,
bool bool
nsOuterWindowProxy::set(JSContext *cx, JS::Handle<JSObject*> proxy, nsOuterWindowProxy::set(JSContext *cx, JS::Handle<JSObject*> proxy,
JS::Handle<JSObject*> receiver,
JS::Handle<jsid> id, JS::Handle<jsid> id,
JS::Handle<JS::Value> v, JS::MutableHandle<JS::Value> vp,
JS::Handle<JS::Value> receiver,
JS::ObjectOpResult &result) const JS::ObjectOpResult &result) const
{ {
int32_t index = GetArrayIndexFromId(cx, id); int32_t index = GetArrayIndexFromId(cx, id);
@ -920,7 +921,7 @@ nsOuterWindowProxy::set(JSContext *cx, JS::Handle<JSObject*> proxy,
return result.failReadOnly(); return result.failReadOnly();
} }
return js::Wrapper::set(cx, proxy, id, v, receiver, result); return js::Wrapper::set(cx, proxy, receiver, id, vp, result);
} }
bool bool

2
dom/bindings/BindingUtils.cpp
View file

@ -1439,7 +1439,7 @@ XrayResolveOwnProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
bool bool
XrayDefineProperty(JSContext* cx, JS::Handle<JSObject*> wrapper, XrayDefineProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
JS::Handle<JSObject*> obj, JS::Handle<jsid> id, JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result, bool *defined) JS::ObjectOpResult &result, bool *defined)
{ {
if (!js::IsProxy(obj)) if (!js::IsProxy(obj))

2
dom/bindings/BindingUtils.h
View file

@ -2464,7 +2464,7 @@ XrayResolveOwnProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
bool bool
XrayDefineProperty(JSContext* cx, JS::Handle<JSObject*> wrapper, XrayDefineProperty(JSContext* cx, JS::Handle<JSObject*> wrapper,
JS::Handle<JSObject*> obj, JS::Handle<jsid> id, JS::Handle<JSObject*> obj, JS::Handle<jsid> id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result, JS::ObjectOpResult &result,
bool *defined); bool *defined);

32
dom/bindings/Codegen.py
View file

@ -9805,7 +9805,7 @@ class CGProxySpecialOperation(CGPerSignatureCall):
false. false.
""" """
def __init__(self, descriptor, operation, checkFound=True, def __init__(self, descriptor, operation, checkFound=True,
argumentHandleValue=None, resultVar=None, foundVar=None): argumentMutableValue=None, resultVar=None, foundVar=None):
self.checkFound = checkFound self.checkFound = checkFound
self.foundVar = foundVar or "found" self.foundVar = foundVar or "found"
@ -9830,12 +9830,12 @@ class CGProxySpecialOperation(CGPerSignatureCall):
treatNullAs=argument.treatNullAs, treatNullAs=argument.treatNullAs,
sourceDescription=("value being assigned to %s setter" % sourceDescription=("value being assigned to %s setter" %
descriptor.interface.identifier.name)) descriptor.interface.identifier.name))
if argumentHandleValue is None: if argumentMutableValue is None:
argumentHandleValue = "desc.value()" argumentMutableValue = "desc.value()"
templateValues = { templateValues = {
"declName": argument.identifier.name, "declName": argument.identifier.name,
"holderName": argument.identifier.name + "_holder", "holderName": argument.identifier.name + "_holder",
"val": argumentHandleValue, "val": argumentMutableValue,
"obj": "obj", "obj": "obj",
"passedToJSImpl": "false" "passedToJSImpl": "false"
} }
@ -9880,10 +9880,10 @@ class CGProxyIndexedOperation(CGProxySpecialOperation):
foundVar: See the docstring for CGProxySpecialOperation. foundVar: See the docstring for CGProxySpecialOperation.
""" """
def __init__(self, descriptor, name, doUnwrap=True, checkFound=True, def __init__(self, descriptor, name, doUnwrap=True, checkFound=True,
argumentHandleValue=None, resultVar=None, foundVar=None): argumentMutableValue=None, resultVar=None, foundVar=None):
self.doUnwrap = doUnwrap self.doUnwrap = doUnwrap
CGProxySpecialOperation.__init__(self, descriptor, name, checkFound, CGProxySpecialOperation.__init__(self, descriptor, name, checkFound,
argumentHandleValue=argumentHandleValue, argumentMutableValue=argumentMutableValue,
resultVar=resultVar, resultVar=resultVar,
foundVar=foundVar) foundVar=foundVar)
@ -9941,9 +9941,9 @@ class CGProxyIndexedSetter(CGProxyIndexedOperation):
""" """
Class to generate a call to an indexed setter. Class to generate a call to an indexed setter.
""" """
def __init__(self, descriptor, argumentHandleValue=None): def __init__(self, descriptor, argumentMutableValue=None):
CGProxyIndexedOperation.__init__(self, descriptor, 'IndexedSetter', CGProxyIndexedOperation.__init__(self, descriptor, 'IndexedSetter',
argumentHandleValue=argumentHandleValue) argumentMutableValue=argumentMutableValue)
class CGProxyIndexedDeleter(CGProxyIndexedOperation): class CGProxyIndexedDeleter(CGProxyIndexedOperation):
@ -9971,10 +9971,10 @@ class CGProxyNamedOperation(CGProxySpecialOperation):
foundVar: See the docstring for CGProxySpecialOperation. foundVar: See the docstring for CGProxySpecialOperation.
""" """
def __init__(self, descriptor, name, value=None, argumentHandleValue=None, def __init__(self, descriptor, name, value=None, argumentMutableValue=None,
resultVar=None, foundVar=None): resultVar=None, foundVar=None):
CGProxySpecialOperation.__init__(self, descriptor, name, CGProxySpecialOperation.__init__(self, descriptor, name,
argumentHandleValue=argumentHandleValue, argumentMutableValue=argumentMutableValue,
resultVar=resultVar, resultVar=resultVar,
foundVar=foundVar) foundVar=foundVar)
self.value = value self.value = value
@ -10072,9 +10072,9 @@ class CGProxyNamedSetter(CGProxyNamedOperation):
""" """
Class to generate a call to a named setter. Class to generate a call to a named setter.
""" """
def __init__(self, descriptor, argumentHandleValue=None): def __init__(self, descriptor, argumentMutableValue=None):
CGProxyNamedOperation.__init__(self, descriptor, 'NamedSetter', CGProxyNamedOperation.__init__(self, descriptor, 'NamedSetter',
argumentHandleValue=argumentHandleValue) argumentMutableValue=argumentMutableValue)
class CGProxyNamedDeleter(CGProxyNamedOperation): class CGProxyNamedDeleter(CGProxyNamedOperation):
@ -10244,7 +10244,7 @@ class CGDOMJSProxyHandler_defineProperty(ClassMethod):
args = [Argument('JSContext*', 'cx'), args = [Argument('JSContext*', 'cx'),
Argument('JS::Handle<JSObject*>', 'proxy'), Argument('JS::Handle<JSObject*>', 'proxy'),
Argument('JS::Handle<jsid>', 'id'), Argument('JS::Handle<jsid>', 'id'),
Argument('JS::Handle<JSPropertyDescriptor>', 'desc'), Argument('JS::MutableHandle<JSPropertyDescriptor>', 'desc'),
Argument('JS::ObjectOpResult&', 'opresult'), Argument('JS::ObjectOpResult&', 'opresult'),
Argument('bool*', 'defined')] Argument('bool*', 'defined')]
ClassMethod.__init__(self, "defineProperty", "bool", args, virtual=True, override=True, const=True) ClassMethod.__init__(self, "defineProperty", "bool", args, virtual=True, override=True, const=True)
@ -10691,7 +10691,7 @@ class CGDOMJSProxyHandler_setCustom(ClassMethod):
args = [Argument('JSContext*', 'cx'), args = [Argument('JSContext*', 'cx'),
Argument('JS::Handle<JSObject*>', 'proxy'), Argument('JS::Handle<JSObject*>', 'proxy'),
Argument('JS::Handle<jsid>', 'id'), Argument('JS::Handle<jsid>', 'id'),
Argument('JS::Handle<JS::Value>', 'v'), Argument('JS::MutableHandle<JS::Value>', 'vp'),
Argument('bool*', 'done')] Argument('bool*', 'done')]
ClassMethod.__init__(self, "setCustom", "bool", args, virtual=True, override=True, const=True) ClassMethod.__init__(self, "setCustom", "bool", args, virtual=True, override=True, const=True)
self.descriptor = descriptor self.descriptor = descriptor
@ -10716,7 +10716,7 @@ class CGDOMJSProxyHandler_setCustom(ClassMethod):
raise ValueError("In interface " + self.descriptor.name + ": " + raise ValueError("In interface " + self.descriptor.name + ": " +
"Can't cope with [OverrideBuiltins] and unforgeable members") "Can't cope with [OverrideBuiltins] and unforgeable members")
callSetter = CGProxyNamedSetter(self.descriptor, argumentHandleValue="v") callSetter = CGProxyNamedSetter(self.descriptor, argumentMutableValue="vp")
return (assertion + return (assertion +
callSetter.define() + callSetter.define() +
"*done = true;\n" "*done = true;\n"
@ -10741,7 +10741,7 @@ class CGDOMJSProxyHandler_setCustom(ClassMethod):
""", """,
callSetter=CGProxyIndexedSetter(self.descriptor, callSetter=CGProxyIndexedSetter(self.descriptor,
argumentHandleValue="v").define()) argumentMutableValue="vp").define())
else: else:
setIndexed = "" setIndexed = ""

13
dom/bindings/DOMJSProxyHandler.cpp
View file

@ -195,7 +195,7 @@ BaseDOMProxyHandler::getOwnPropertyDescriptor(JSContext* cx,
bool bool
DOMProxyHandler::defineProperty(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id, DOMProxyHandler::defineProperty(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result, bool *defined) const JS::ObjectOpResult &result, bool *defined) const
{ {
if (desc.hasGetterObject() && desc.setter() == JS_StrictPropertyStub) { if (desc.hasGetterObject() && desc.setter() == JS_StrictPropertyStub) {
@ -219,14 +219,13 @@ DOMProxyHandler::defineProperty(JSContext* cx, JS::Handle<JSObject*> proxy, JS::
} }
bool bool
DOMProxyHandler::set(JSContext *cx, Handle<JSObject*> proxy, Handle<jsid> id, DOMProxyHandler::set(JSContext *cx, Handle<JSObject*> proxy, Handle<JSObject*> receiver,
Handle<JS::Value> v, Handle<JS::Value> receiver, Handle<jsid> id, MutableHandle<JS::Value> vp, ObjectOpResult &result) const
ObjectOpResult &result) const
{ {
MOZ_ASSERT(!xpc::WrapperFactory::IsXrayWrapper(proxy), MOZ_ASSERT(!xpc::WrapperFactory::IsXrayWrapper(proxy),
"Should not have a XrayWrapper here"); "Should not have a XrayWrapper here");
bool done; bool done;
if (!setCustom(cx, proxy, id, v, &done)) { if (!setCustom(cx, proxy, id, vp, &done)) {
return false; return false;
} }
if (done) { if (done) {
@ -253,7 +252,7 @@ DOMProxyHandler::set(JSContext *cx, Handle<JSObject*> proxy, Handle<jsid> id,
} }
} }
return js::SetPropertyIgnoringNamedGetter(cx, proxy, id, v, receiver, desc, result); return js::SetPropertyIgnoringNamedGetter(cx, proxy, id, vp, receiver, &desc, result);
} }
bool bool
@ -351,7 +350,7 @@ IdToInt32(JSContext* cx, JS::Handle<jsid> id)
bool bool
DOMProxyHandler::setCustom(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id, DOMProxyHandler::setCustom(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
JS::Handle<JS::Value> v, bool *done) const JS::MutableHandle<JS::Value> vp, bool *done) const
{ {
*done = false; *done = false;
return true; return true;

10
dom/bindings/DOMJSProxyHandler.h
View file

@ -105,14 +105,14 @@ public:
{} {}
bool defineProperty(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id, bool defineProperty(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result) const override JS::ObjectOpResult &result) const override
{ {
bool unused; bool unused;
return defineProperty(cx, proxy, id, desc, result, &unused); return defineProperty(cx, proxy, id, desc, result, &unused);
} }
virtual bool defineProperty(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id, virtual bool defineProperty(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result, bool *defined) const; JS::ObjectOpResult &result, bool *defined) const;
bool delete_(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id, bool delete_(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
@ -122,8 +122,8 @@ public:
const override; const override;
bool has(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id, bool has(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
bool* bp) const override; bool* bp) const override;
bool set(JSContext *cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id, bool set(JSContext *cx, JS::Handle<JSObject*> proxy, JS::Handle<JSObject*> receiver,
JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::ObjectOpResult &result) JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp, JS::ObjectOpResult &result)
const override; const override;
/* /*
@ -132,7 +132,7 @@ public:
* *done to false. * *done to false.
*/ */
virtual bool setCustom(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id, virtual bool setCustom(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
JS::Handle<JS::Value> v, bool *done) const; JS::MutableHandle<JS::Value> vp, bool *done) const;
static JSObject* GetExpandoObject(JSObject* obj); static JSObject* GetExpandoObject(JSObject* obj);

14
js/ipc/JavaScriptBase.h
View file

@ -71,9 +71,10 @@ class JavaScriptBase : public WrapperOwner, public WrapperAnswer, public Base
ReturnStatus *rs, JSVariant *result) { ReturnStatus *rs, JSVariant *result) {
return Answer::RecvGet(ObjectId::deserialize(objId), receiverVar, id, rs, result); return Answer::RecvGet(ObjectId::deserialize(objId), receiverVar, id, rs, result);
} }
bool RecvSet(const uint64_t &objId, const JSIDVariant &id, const JSVariant &value, bool RecvSet(const uint64_t &objId, const ObjectVariant &receiverVar,
const JSVariant &receiverVar, ReturnStatus *rs) { const JSIDVariant &id, const JSVariant &value, ReturnStatus *rs,
return Answer::RecvSet(ObjectId::deserialize(objId), id, value, receiverVar, rs); JSVariant *result) {
return Answer::RecvSet(ObjectId::deserialize(objId), receiverVar, id, value, rs, result);
} }
bool RecvIsExtensible(const uint64_t &objId, ReturnStatus *rs, bool RecvIsExtensible(const uint64_t &objId, ReturnStatus *rs,
@ -160,9 +161,10 @@ class JavaScriptBase : public WrapperOwner, public WrapperAnswer, public Base
ReturnStatus *rs, JSVariant *result) { ReturnStatus *rs, JSVariant *result) {
return Base::SendGet(objId.serialize(), receiverVar, id, rs, result); return Base::SendGet(objId.serialize(), receiverVar, id, rs, result);
} }
bool SendSet(const ObjectId &objId, const JSIDVariant &id, const JSVariant &value, bool SendSet(const ObjectId &objId, const ObjectVariant &receiverVar,
const JSVariant &receiverVar, ReturnStatus *rs) { const JSIDVariant &id, const JSVariant &value, ReturnStatus *rs,
return Base::SendSet(objId.serialize(), id, value, receiverVar, rs); JSVariant *result) {
return Base::SendSet(objId.serialize(), receiverVar, id, value, rs, result);
} }
bool SendIsExtensible(const ObjectId &objId, ReturnStatus *rs, bool SendIsExtensible(const ObjectId &objId, ReturnStatus *rs,

2
js/ipc/PJavaScript.ipdl
View file

@ -33,7 +33,7 @@ both:
prio(high) sync Has(uint64_t objId, JSIDVariant id) returns (ReturnStatus rs, bool has); prio(high) sync Has(uint64_t objId, JSIDVariant id) returns (ReturnStatus rs, bool has);
prio(high) sync HasOwn(uint64_t objId, JSIDVariant id) returns (ReturnStatus rs, bool has); prio(high) sync HasOwn(uint64_t objId, JSIDVariant id) returns (ReturnStatus rs, bool has);
prio(high) sync Get(uint64_t objId, ObjectVariant receiver, JSIDVariant id) returns (ReturnStatus rs, JSVariant result); prio(high) sync Get(uint64_t objId, ObjectVariant receiver, JSIDVariant id) returns (ReturnStatus rs, JSVariant result);
prio(high) sync Set(uint64_t objId, JSIDVariant id, JSVariant value, JSVariant receiver) returns (ReturnStatus rs); prio(high) sync Set(uint64_t objId, ObjectVariant receiver, JSIDVariant id, JSVariant value) returns (ReturnStatus rs, JSVariant result);
prio(high) sync IsExtensible(uint64_t objId) returns (ReturnStatus rs, bool result); prio(high) sync IsExtensible(uint64_t objId) returns (ReturnStatus rs, bool result);
prio(high) sync CallOrConstruct(uint64_t objId, JSParam[] argv, bool construct) returns (ReturnStatus rs, JSVariant result, JSParam[] outparams); prio(high) sync CallOrConstruct(uint64_t objId, JSParam[] argv, bool construct) returns (ReturnStatus rs, JSVariant result, JSParam[] outparams);

21
js/ipc/WrapperAnswer.cpp
View file

@ -308,17 +308,26 @@ WrapperAnswer::RecvGet(const ObjectId &objId, const ObjectVariant &receiverVar,
} }
bool bool
WrapperAnswer::RecvSet(const ObjectId &objId, const JSIDVariant &idVar, const JSVariant &value, WrapperAnswer::RecvSet(const ObjectId &objId, const ObjectVariant &receiverVar,
const JSVariant &receiverVar, ReturnStatus *rs) const JSIDVariant &idVar, const JSVariant &value, ReturnStatus *rs,
JSVariant *resultValue)
{ {
// We may run scripted setters. // We may run scripted setters.
AutoEntryScript aes(xpc::NativeGlobal(scopeForTargetObjects())); AutoEntryScript aes(xpc::NativeGlobal(scopeForTargetObjects()));
JSContext *cx = aes.cx(); JSContext *cx = aes.cx();
// The outparam will be written to the buffer, so it must be set even if
// the parent won't read it.
*resultValue = UndefinedVariant();
RootedObject obj(cx, findObjectById(cx, objId)); RootedObject obj(cx, findObjectById(cx, objId));
if (!obj) if (!obj)
return fail(cx, rs); return fail(cx, rs);
RootedObject receiver(cx, fromObjectVariant(cx, receiverVar));
if (!receiver)
return fail(cx, rs);
LOG("set %s[%s] = %s", ReceiverObj(objId), Identifier(idVar), InVariant(value)); LOG("set %s[%s] = %s", ReceiverObj(objId), Identifier(idVar), InVariant(value));
RootedId id(cx); RootedId id(cx);
@ -329,12 +338,12 @@ WrapperAnswer::RecvSet(const ObjectId &objId, const JSIDVariant &idVar, const JS
if (!fromVariant(cx, value, &val)) if (!fromVariant(cx, value, &val))
return fail(cx, rs); return fail(cx, rs);
RootedValue receiver(cx); ObjectOpResult result;
if (!fromVariant(cx, receiverVar, &receiver)) RootedValue receiverVal(cx, ObjectValue(*receiver));
if (!JS_ForwardSetPropertyTo(cx, obj, id, val, receiverVal, result))
return fail(cx, rs); return fail(cx, rs);
ObjectOpResult result; if (!toVariant(cx, val, resultValue))
if (!JS_ForwardSetPropertyTo(cx, obj, id, val, receiver, result))
return fail(cx, rs); return fail(cx, rs);
return ok(rs, result); return ok(rs, result);

5
js/ipc/WrapperAnswer.h
View file

@ -37,8 +37,9 @@ class WrapperAnswer : public virtual JavaScriptShared
bool RecvGet(const ObjectId &objId, const ObjectVariant &receiverVar, bool RecvGet(const ObjectId &objId, const ObjectVariant &receiverVar,
const JSIDVariant &id, const JSIDVariant &id,
ReturnStatus *rs, JSVariant *result); ReturnStatus *rs, JSVariant *result);
bool RecvSet(const ObjectId &objId, const JSIDVariant &id, const JSVariant &value, bool RecvSet(const ObjectId &objId, const ObjectVariant &receiverVar,
const JSVariant &receiverVar, ReturnStatus *rs); const JSIDVariant &id, const JSVariant &value, ReturnStatus *rs,
JSVariant *result);
bool RecvIsExtensible(const ObjectId &objId, ReturnStatus *rs, bool RecvIsExtensible(const ObjectId &objId, ReturnStatus *rs,
bool *result); bool *result);

39
js/ipc/WrapperOwner.cpp
View file

@ -97,7 +97,7 @@ class CPOWProxyHandler : public BaseProxyHandler
virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id, virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
MutableHandle<JSPropertyDescriptor> desc) const override; MutableHandle<JSPropertyDescriptor> desc) const override;
virtual bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id, virtual bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const override; ObjectOpResult &result) const override;
virtual bool ownPropertyKeys(JSContext *cx, HandleObject proxy, virtual bool ownPropertyKeys(JSContext *cx, HandleObject proxy,
AutoIdVector &props) const override; AutoIdVector &props) const override;
@ -110,8 +110,9 @@ class CPOWProxyHandler : public BaseProxyHandler
virtual bool has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp) const override; virtual bool has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp) const override;
virtual bool get(JSContext *cx, HandleObject proxy, HandleObject receiver, virtual bool get(JSContext *cx, HandleObject proxy, HandleObject receiver,
HandleId id, MutableHandleValue vp) const override; HandleId id, MutableHandleValue vp) const override;
virtual bool set(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, JS::HandleValue v, virtual bool set(JSContext *cx, JS::HandleObject proxy, JS::HandleObject receiver,
JS::HandleValue receiver, JS::ObjectOpResult &result) const override; JS::HandleId id, JS::MutableHandleValue vp,
JS::ObjectOpResult &result) const override;
virtual bool call(JSContext *cx, HandleObject proxy, const CallArgs &args) const override; virtual bool call(JSContext *cx, HandleObject proxy, const CallArgs &args) const override;
virtual bool construct(JSContext *cx, HandleObject proxy, const CallArgs &args) const override; virtual bool construct(JSContext *cx, HandleObject proxy, const CallArgs &args) const override;
@ -212,7 +213,7 @@ WrapperOwner::getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, Handle
bool bool
CPOWProxyHandler::defineProperty(JSContext *cx, HandleObject proxy, HandleId id, CPOWProxyHandler::defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const ObjectOpResult &result) const
{ {
FORWARD(defineProperty, (cx, proxy, id, desc, result)); FORWARD(defineProperty, (cx, proxy, id, desc, result));
@ -220,7 +221,7 @@ CPOWProxyHandler::defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
bool bool
WrapperOwner::defineProperty(JSContext *cx, HandleObject proxy, HandleId id, WrapperOwner::defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) ObjectOpResult &result)
{ {
ObjectId objId = idOf(proxy); ObjectId objId = idOf(proxy);
@ -516,37 +517,41 @@ WrapperOwner::get(JSContext *cx, HandleObject proxy, HandleObject receiver,
} }
bool bool
CPOWProxyHandler::set(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, JS::HandleValue v, CPOWProxyHandler::set(JSContext *cx, JS::HandleObject proxy, JS::HandleObject receiver,
JS::HandleValue receiver, JS::ObjectOpResult &result) const JS::HandleId id, JS::MutableHandleValue vp, JS::ObjectOpResult &result) const
{ {
FORWARD(set, (cx, proxy, id, v, receiver, result)); FORWARD(set, (cx, proxy, receiver, id, vp, result));
} }
bool bool
WrapperOwner::set(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, JS::HandleValue v, WrapperOwner::set(JSContext *cx, JS::HandleObject proxy, JS::HandleObject receiver,
JS::HandleValue receiver, JS::ObjectOpResult &result) JS::HandleId id, JS::MutableHandleValue vp, JS::ObjectOpResult &result)
{ {
ObjectId objId = idOf(proxy); ObjectId objId = idOf(proxy);
ObjectVariant receiverVar;
if (!toObjectVariant(cx, receiver, &receiverVar))
return false;
JSIDVariant idVar; JSIDVariant idVar;
if (!toJSIDVariant(cx, id, &idVar)) if (!toJSIDVariant(cx, id, &idVar))
return false; return false;
JSVariant val; JSVariant val;
if (!toVariant(cx, v, &val)) if (!toVariant(cx, vp, &val))
return false;
JSVariant receiverVar;
if (!toVariant(cx, receiver, &receiverVar))
return false; return false;
ReturnStatus status; ReturnStatus status;
if (!SendSet(objId, idVar, val, receiverVar, &status)) JSVariant resultValue;
if (!SendSet(objId, receiverVar, idVar, val, &status, &resultValue))
return ipcfail(cx); return ipcfail(cx);
LOG_STACK(); LOG_STACK();
return ok(cx, status, result); if (!ok(cx, status, result))
return false;
return fromVariant(cx, resultValue, vp);
} }
bool bool

11
js/ipc/WrapperOwner.h
View file

@ -32,7 +32,7 @@ class WrapperOwner : public virtual JavaScriptShared
bool getOwnPropertyDescriptor(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, bool getOwnPropertyDescriptor(JSContext *cx, JS::HandleObject proxy, JS::HandleId id,
JS::MutableHandle<JSPropertyDescriptor> desc); JS::MutableHandle<JSPropertyDescriptor> desc);
bool defineProperty(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, bool defineProperty(JSContext *cx, JS::HandleObject proxy, JS::HandleId id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result); JS::ObjectOpResult &result);
bool ownPropertyKeys(JSContext *cx, JS::HandleObject proxy, JS::AutoIdVector &props); bool ownPropertyKeys(JSContext *cx, JS::HandleObject proxy, JS::AutoIdVector &props);
bool delete_(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, bool delete_(JSContext *cx, JS::HandleObject proxy, JS::HandleId id,
@ -42,8 +42,8 @@ class WrapperOwner : public virtual JavaScriptShared
bool has(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, bool *bp); bool has(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, bool *bp);
bool get(JSContext *cx, JS::HandleObject proxy, JS::HandleObject receiver, bool get(JSContext *cx, JS::HandleObject proxy, JS::HandleObject receiver,
JS::HandleId id, JS::MutableHandleValue vp); JS::HandleId id, JS::MutableHandleValue vp);
bool set(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, JS::HandleValue v, bool set(JSContext *cx, JS::HandleObject proxy, JS::HandleObject receiver,
JS::HandleValue receiver, JS::ObjectOpResult &result); JS::HandleId id, JS::MutableHandleValue vp, JS::ObjectOpResult &result);
bool callOrConstruct(JSContext *cx, JS::HandleObject proxy, const JS::CallArgs &args, bool callOrConstruct(JSContext *cx, JS::HandleObject proxy, const JS::CallArgs &args,
bool construct); bool construct);
@ -128,8 +128,9 @@ class WrapperOwner : public virtual JavaScriptShared
virtual bool SendGet(const ObjectId &objId, const ObjectVariant &receiverVar, virtual bool SendGet(const ObjectId &objId, const ObjectVariant &receiverVar,
const JSIDVariant &id, const JSIDVariant &id,
ReturnStatus *rs, JSVariant *result) = 0; ReturnStatus *rs, JSVariant *result) = 0;
virtual bool SendSet(const ObjectId &objId, const JSIDVariant &id, const JSVariant &value, virtual bool SendSet(const ObjectId &objId, const ObjectVariant &receiverVar,
const JSVariant &receiverVar, ReturnStatus *rs) = 0; const JSIDVariant &id, const JSVariant &value,
ReturnStatus *rs, JSVariant *result) = 0;
virtual bool SendIsExtensible(const ObjectId &objId, ReturnStatus *rs, virtual bool SendIsExtensible(const ObjectId &objId, ReturnStatus *rs,
bool *result) = 0; bool *result) = 0;

8
js/public/Class.h
View file

@ -333,8 +333,8 @@ typedef bool
(* LookupPropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleId id, (* LookupPropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
JS::MutableHandleObject objp, JS::MutableHandle<Shape*> propp); JS::MutableHandleObject objp, JS::MutableHandle<Shape*> propp);
typedef bool typedef bool
(* DefinePropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleId id, (* DefinePropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleId id, JS::HandleValue value,
JS::Handle<JSPropertyDescriptor> desc, JSGetterOp getter, JSSetterOp setter, unsigned attrs,
JS::ObjectOpResult &result); JS::ObjectOpResult &result);
typedef bool typedef bool
(* HasPropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleId id, bool *foundp); (* HasPropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleId id, bool *foundp);
@ -342,8 +342,8 @@ typedef bool
(* GetPropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleObject receiver, JS::HandleId id, (* GetPropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleObject receiver, JS::HandleId id,
JS::MutableHandleValue vp); JS::MutableHandleValue vp);
typedef bool typedef bool
(* SetPropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleId id, JS::HandleValue v, (* SetPropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleObject receiver, JS::HandleId id,
JS::HandleValue receiver, JS::ObjectOpResult &result); JS::MutableHandleValue vp, JS::ObjectOpResult &result);
typedef bool typedef bool
(* GetOwnPropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleId id, (* GetOwnPropertyOp)(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
JS::MutableHandle<JSPropertyDescriptor> desc); JS::MutableHandle<JSPropertyDescriptor> desc);

14
js/public/Proxy.h
View file

@ -18,7 +18,6 @@ namespace js {
using JS::AutoIdVector; using JS::AutoIdVector;
using JS::CallArgs; using JS::CallArgs;
using JS::Handle;
using JS::HandleId; using JS::HandleId;
using JS::HandleObject; using JS::HandleObject;
using JS::HandleValue; using JS::HandleValue;
@ -253,7 +252,7 @@ class JS_FRIEND_API(BaseProxyHandler)
virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id, virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
MutableHandle<JSPropertyDescriptor> desc) const = 0; MutableHandle<JSPropertyDescriptor> desc) const = 0;
virtual bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id, virtual bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const = 0; ObjectOpResult &result) const = 0;
virtual bool ownPropertyKeys(JSContext *cx, HandleObject proxy, virtual bool ownPropertyKeys(JSContext *cx, HandleObject proxy,
AutoIdVector &props) const = 0; AutoIdVector &props) const = 0;
@ -295,8 +294,8 @@ class JS_FRIEND_API(BaseProxyHandler)
virtual bool has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp) const; virtual bool has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp) const;
virtual bool get(JSContext *cx, HandleObject proxy, HandleObject receiver, virtual bool get(JSContext *cx, HandleObject proxy, HandleObject receiver,
HandleId id, MutableHandleValue vp) const; HandleId id, MutableHandleValue vp) const;
virtual bool set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, virtual bool set(JSContext *cx, HandleObject proxy, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) const; HandleId id, MutableHandleValue vp, ObjectOpResult &result) const;
/* /*
* [[Call]] and [[Construct]] are standard internal methods but according * [[Call]] and [[Construct]] are standard internal methods but according
@ -374,7 +373,7 @@ class JS_FRIEND_API(DirectProxyHandler) : public BaseProxyHandler
virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id, virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
MutableHandle<JSPropertyDescriptor> desc) const override; MutableHandle<JSPropertyDescriptor> desc) const override;
virtual bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id, virtual bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const override; ObjectOpResult &result) const override;
virtual bool ownPropertyKeys(JSContext *cx, HandleObject proxy, virtual bool ownPropertyKeys(JSContext *cx, HandleObject proxy,
AutoIdVector &props) const override; AutoIdVector &props) const override;
@ -395,8 +394,9 @@ class JS_FRIEND_API(DirectProxyHandler) : public BaseProxyHandler
bool *bp) const override; bool *bp) const override;
virtual bool get(JSContext *cx, HandleObject proxy, HandleObject receiver, virtual bool get(JSContext *cx, HandleObject proxy, HandleObject receiver,
HandleId id, MutableHandleValue vp) const override; HandleId id, MutableHandleValue vp) const override;
virtual bool set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, virtual bool set(JSContext *cx, HandleObject proxy, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) const override; HandleId id, MutableHandleValue vp,
ObjectOpResult &result) const override;
virtual bool call(JSContext *cx, HandleObject proxy, const CallArgs &args) const override; virtual bool call(JSContext *cx, HandleObject proxy, const CallArgs &args) const override;
virtual bool construct(JSContext *cx, HandleObject proxy, const CallArgs &args) const override; virtual bool construct(JSContext *cx, HandleObject proxy, const CallArgs &args) const override;

24
js/src/builtin/TypedObject.cpp
View file

@ -1751,8 +1751,8 @@ ReportPropertyError(JSContext *cx,
} }
bool bool
TypedObject::obj_defineProperty(JSContext *cx, HandleObject obj, HandleId id, TypedObject::obj_defineProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v,
Handle<JSPropertyDescriptor> desc, GetterOp getter, SetterOp setter, unsigned attrs,
ObjectOpResult &result) ObjectOpResult &result)
{ {
Rooted<TypedObject *> typedObj(cx, &obj->as<TypedObject>()); Rooted<TypedObject *> typedObj(cx, &obj->as<TypedObject>());
@ -1904,8 +1904,8 @@ TypedObject::obj_getArrayElement(JSContext *cx,
} }
bool bool
TypedObject::obj_setProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, TypedObject::obj_setProperty(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result) MutableHandleValue vp, ObjectOpResult &result)
{ {
Rooted<TypedObject *> typedObj(cx, &obj->as<TypedObject>()); Rooted<TypedObject *> typedObj(cx, &obj->as<TypedObject>());
@ -1919,7 +1919,7 @@ TypedObject::obj_setProperty(JSContext *cx, HandleObject obj, HandleId id, Handl
case type::Array: { case type::Array: {
if (JSID_IS_ATOM(id, cx->names().length)) { if (JSID_IS_ATOM(id, cx->names().length)) {
if (receiver.isObject() && obj == &receiver.toObject()) { if (obj == receiver) {
JS_ReportErrorNumber(cx, GetErrorMessage, JS_ReportErrorNumber(cx, GetErrorMessage,
nullptr, JSMSG_CANT_REDEFINE_ARRAY_LENGTH); nullptr, JSMSG_CANT_REDEFINE_ARRAY_LENGTH);
return false; return false;
@ -1929,8 +1929,8 @@ TypedObject::obj_setProperty(JSContext *cx, HandleObject obj, HandleId id, Handl
uint32_t index; uint32_t index;
if (IdIsIndex(id, &index)) { if (IdIsIndex(id, &index)) {
if (!receiver.isObject() || obj != &receiver.toObject()) if (obj != receiver)
return SetPropertyByDefining(cx, obj, id, v, receiver, false, result); return SetPropertyByDefining(cx, obj, receiver, id, vp, false, result);
if (index >= uint32_t(typedObj->length())) { if (index >= uint32_t(typedObj->length())) {
JS_ReportErrorNumber(cx, GetErrorMessage, JS_ReportErrorNumber(cx, GetErrorMessage,
@ -1941,7 +1941,7 @@ TypedObject::obj_setProperty(JSContext *cx, HandleObject obj, HandleId id, Handl
Rooted<TypeDescr*> elementType(cx); Rooted<TypeDescr*> elementType(cx);
elementType = &typedObj->typeDescr().as<ArrayTypeDescr>().elementType(); elementType = &typedObj->typeDescr().as<ArrayTypeDescr>().elementType();
size_t offset = elementType->size() * index; size_t offset = elementType->size() * index;
if (!ConvertAndCopyTo(cx, elementType, typedObj, offset, NullPtr(), v)) if (!ConvertAndCopyTo(cx, elementType, typedObj, offset, NullPtr(), vp))
return false; return false;
return result.succeed(); return result.succeed();
} }
@ -1955,19 +1955,19 @@ TypedObject::obj_setProperty(JSContext *cx, HandleObject obj, HandleId id, Handl
if (!descr->fieldIndex(id, &fieldIndex)) if (!descr->fieldIndex(id, &fieldIndex))
break; break;
if (!receiver.isObject() || obj != &receiver.toObject()) if (obj != receiver)
return SetPropertyByDefining(cx, obj, id, v, receiver, false, result); return SetPropertyByDefining(cx, obj, receiver, id, vp, false, result);
size_t offset = descr->fieldOffset(fieldIndex); size_t offset = descr->fieldOffset(fieldIndex);
Rooted<TypeDescr*> fieldType(cx, &descr->fieldDescr(fieldIndex)); Rooted<TypeDescr*> fieldType(cx, &descr->fieldDescr(fieldIndex));
RootedAtom fieldName(cx, &descr->fieldName(fieldIndex)); RootedAtom fieldName(cx, &descr->fieldName(fieldIndex));
if (!ConvertAndCopyTo(cx, fieldType, typedObj, offset, fieldName, v)) if (!ConvertAndCopyTo(cx, fieldType, typedObj, offset, fieldName, vp))
return false; return false;
return result.succeed(); return result.succeed();
} }
} }
return SetPropertyOnProto(cx, obj, id, v, receiver, result); return SetPropertyOnProto(cx, obj, receiver, id, vp, result);
} }
bool bool

8
js/src/builtin/TypedObject.h
View file

@ -528,8 +528,8 @@ class TypedObject : public JSObject
static bool obj_lookupElement(JSContext *cx, HandleObject obj, uint32_t index, static bool obj_lookupElement(JSContext *cx, HandleObject obj, uint32_t index,
MutableHandleObject objp, MutableHandleShape propp); MutableHandleObject objp, MutableHandleShape propp);
static bool obj_defineProperty(JSContext *cx, HandleObject obj, HandleId id, static bool obj_defineProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v,
Handle<JSPropertyDescriptor> desc, GetterOp getter, SetterOp setter, unsigned attrs,
ObjectOpResult &result); ObjectOpResult &result);
static bool obj_hasProperty(JSContext *cx, HandleObject obj, HandleId id, bool *foundp); static bool obj_hasProperty(JSContext *cx, HandleObject obj, HandleId id, bool *foundp);
@ -540,8 +540,8 @@ class TypedObject : public JSObject
static bool obj_getElement(JSContext *cx, HandleObject obj, HandleObject receiver, static bool obj_getElement(JSContext *cx, HandleObject obj, HandleObject receiver,
uint32_t index, MutableHandleValue vp); uint32_t index, MutableHandleValue vp);
static bool obj_setProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, static bool obj_setProperty(JSContext *cx, HandleObject obj, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result); HandleId id, MutableHandleValue vp, ObjectOpResult &result);
static bool obj_getOwnPropertyDescriptor(JSContext *cx, HandleObject obj, HandleId id, static bool obj_getOwnPropertyDescriptor(JSContext *cx, HandleObject obj, HandleId id,
MutableHandle<JSPropertyDescriptor> desc); MutableHandle<JSPropertyDescriptor> desc);

2
js/src/jit/BaselineIC.cpp
View file

@ -8364,7 +8364,7 @@ DoSetPropFallback(JSContext *cx, BaselineFrame *frame, ICSetProp_Fallback *stub_
MOZ_ASSERT(op == JSOP_SETPROP || op == JSOP_STRICTSETPROP); MOZ_ASSERT(op == JSOP_SETPROP || op == JSOP_STRICTSETPROP);
RootedValue v(cx, rhs); RootedValue v(cx, rhs);
if (!PutProperty(cx, obj, id, v, op == JSOP_STRICTSETPROP)) if (!PutProperty(cx, obj, id, &v, op == JSOP_STRICTSETPROP))
return false; return false;
} }

7
js/src/jit/VMFunctions.cpp
View file

@ -429,6 +429,7 @@ bool
SetProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, HandleValue value, SetProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, HandleValue value,
bool strict, jsbytecode *pc) bool strict, jsbytecode *pc)
{ {
RootedValue v(cx, value);
RootedId id(cx, NameToId(name)); RootedId id(cx, NameToId(name));
JSOp op = JSOp(*pc); JSOp op = JSOp(*pc);
@ -442,21 +443,21 @@ SetProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, HandleValu
return true; return true;
} }
RootedValue receiver(cx, ObjectValue(*obj));
ObjectOpResult result; ObjectOpResult result;
if (MOZ_LIKELY(!obj->getOps()->setProperty)) { if (MOZ_LIKELY(!obj->getOps()->setProperty)) {
if (!NativeSetProperty( if (!NativeSetProperty(
cx, obj.as<NativeObject>(), id, value, receiver, cx, obj.as<NativeObject>(), obj.as<NativeObject>(), id,
(op == JSOP_SETNAME || op == JSOP_STRICTSETNAME || (op == JSOP_SETNAME || op == JSOP_STRICTSETNAME ||
op == JSOP_SETGNAME || op == JSOP_STRICTSETGNAME) op == JSOP_SETGNAME || op == JSOP_STRICTSETGNAME)
? Unqualified ? Unqualified
: Qualified, : Qualified,
&v,
result)) result))
{ {
return false; return false;
} }
} else { } else {
if (!SetProperty(cx, obj, id, value, receiver, result)) if (!SetProperty(cx, obj, obj, id, &v, result))
return false; return false;
} }
return result.checkStrictErrorOrWarning(cx, obj, id, strict); return result.checkStrictErrorOrWarning(cx, obj, id, strict);

1
js/src/js.msg
View file

@ -82,7 +82,6 @@ MSG_DEF(JSMSG_EMPTY_ARRAY_REDUCE, 0, JSEXN_TYPEERR, "reduce of empty array
MSG_DEF(JSMSG_UNEXPECTED_TYPE, 2, JSEXN_TYPEERR, "{0} is {1}") MSG_DEF(JSMSG_UNEXPECTED_TYPE, 2, JSEXN_TYPEERR, "{0} is {1}")
MSG_DEF(JSMSG_MISSING_FUN_ARG, 2, JSEXN_TYPEERR, "missing argument {0} when calling function {1}") MSG_DEF(JSMSG_MISSING_FUN_ARG, 2, JSEXN_TYPEERR, "missing argument {0} when calling function {1}")
MSG_DEF(JSMSG_NOT_NONNULL_OBJECT, 1, JSEXN_TYPEERR, "{0} is not a non-null object") MSG_DEF(JSMSG_NOT_NONNULL_OBJECT, 1, JSEXN_TYPEERR, "{0} is not a non-null object")
MSG_DEF(JSMSG_SET_NON_OBJECT_RECEIVER, 1, JSEXN_TYPEERR, "can't assign to properties of {0}: not an object")
MSG_DEF(JSMSG_INVALID_DESCRIPTOR, 0, JSEXN_TYPEERR, "property descriptors must not specify a value or be writable when a getter or setter has been specified") MSG_DEF(JSMSG_INVALID_DESCRIPTOR, 0, JSEXN_TYPEERR, "property descriptors must not specify a value or be writable when a getter or setter has been specified")
MSG_DEF(JSMSG_OBJECT_NOT_EXTENSIBLE, 1, JSEXN_TYPEERR, "{0} is not extensible") MSG_DEF(JSMSG_OBJECT_NOT_EXTENSIBLE, 1, JSEXN_TYPEERR, "{0} is not extensible")
MSG_DEF(JSMSG_CANT_REDEFINE_PROP, 1, JSEXN_TYPEERR, "can't redefine non-configurable property {0}") MSG_DEF(JSMSG_CANT_REDEFINE_PROP, 1, JSEXN_TYPEERR, "can't redefine non-configurable property {0}")

6
js/src/jsapi-tests/testSetPropertyIgnoringNamedGetter.cpp
View file

@ -27,13 +27,13 @@ class CustomProxyHandler : public DirectProxyHandler {
return impl(cx, proxy, id, desc, true); return impl(cx, proxy, id, desc, true);
} }
bool set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, HandleValue receiver, bool set(JSContext *cx, HandleObject proxy, HandleObject receiver,
ObjectOpResult &result) const override HandleId id, MutableHandleValue vp, ObjectOpResult &result) const override
{ {
Rooted<JSPropertyDescriptor> desc(cx); Rooted<JSPropertyDescriptor> desc(cx);
if (!DirectProxyHandler::getPropertyDescriptor(cx, proxy, id, &desc)) if (!DirectProxyHandler::getPropertyDescriptor(cx, proxy, id, &desc))
return false; return false;
return SetPropertyIgnoringNamedGetter(cx, proxy, id, v, receiver, desc, result); return SetPropertyIgnoringNamedGetter(cx, proxy, id, vp, receiver, &desc, result);
} }
private: private:

36
js/src/jsapi.cpp
View file

@ -147,7 +147,7 @@ JS::ObjectOpResult::reportStrictErrorOrWarning(JSContext *cx, HandleObject obj,
MOZ_ASSERT(!ok()); MOZ_ASSERT(!ok());
unsigned flags = strict ? JSREPORT_ERROR : (JSREPORT_WARNING | JSREPORT_STRICT); unsigned flags = strict ? JSREPORT_ERROR : (JSREPORT_WARNING | JSREPORT_STRICT);
if (code_ == JSMSG_OBJECT_NOT_EXTENSIBLE || code_ == JSMSG_SET_NON_OBJECT_RECEIVER) { if (code_ == JSMSG_OBJECT_NOT_EXTENSIBLE) {
RootedValue val(cx, ObjectValue(*obj)); RootedValue val(cx, ObjectValue(*obj));
return ReportValueErrorFlags(cx, flags, code_, JSDVG_IGNORE_STACK, val, return ReportValueErrorFlags(cx, flags, code_, JSDVG_IGNORE_STACK, val,
NullPtr(), nullptr, nullptr); NullPtr(), nullptr, nullptr);
@ -2205,12 +2205,10 @@ DefinePropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue val
// it's just a plain old data property. However the JS_Define* APIs use // it's just a plain old data property. However the JS_Define* APIs use
// null getter and setter to mean "default to the Class getProperty and // null getter and setter to mean "default to the Class getProperty and
// setProperty ops". // setProperty ops".
if (!(attrs & (JSPROP_GETTER | JSPROP_SETTER))) {
if (!getter) if (!getter)
getter = obj->getClass()->getProperty; getter = obj->getClass()->getProperty;
if (!setter) if (!setter)
setter = obj->getClass()->setProperty; setter = obj->getClass()->setProperty;
}
if (getter == JS_PropertyStub) if (getter == JS_PropertyStub)
getter = nullptr; getter = nullptr;
if (setter == JS_StrictPropertyStub) if (setter == JS_StrictPropertyStub)
@ -2830,13 +2828,13 @@ JS_GetUCProperty(JSContext *cx, HandleObject obj, const char16_t *name, size_t n
JS_PUBLIC_API(bool) JS_PUBLIC_API(bool)
JS_SetPropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue v) JS_SetPropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue v)
{ {
RootedValue value(cx, v);
AssertHeapIsIdle(cx); AssertHeapIsIdle(cx);
CHECK_REQUEST(cx); CHECK_REQUEST(cx);
assertSameCompartment(cx, obj, id); assertSameCompartment(cx, obj, id);
RootedValue receiver(cx, ObjectValue(*obj));
ObjectOpResult ignored; ObjectOpResult ignored;
return SetProperty(cx, obj, id, v, receiver, ignored); return SetProperty(cx, obj, obj, id, &value, ignored);
} }
JS_PUBLIC_API(bool) JS_PUBLIC_API(bool)
@ -2847,60 +2845,66 @@ JS_ForwardSetPropertyTo(JSContext *cx, HandleObject obj, HandleId id, HandleValu
CHECK_REQUEST(cx); CHECK_REQUEST(cx);
assertSameCompartment(cx, obj, id, receiver); assertSameCompartment(cx, obj, id, receiver);
return SetProperty(cx, obj, id, v, receiver, result); // XXX Bug 603201 will eliminate this ToObject.
RootedObject receiverObj(cx, ToObject(cx, receiver));
if (!receiverObj)
return false;
RootedValue value(cx, v);
return SetProperty(cx, obj, receiverObj, id, &value, result);
} }
static bool static bool
SetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleValue v) SetElement(JSContext *cx, HandleObject obj, uint32_t index, MutableHandleValue vp)
{ {
AssertHeapIsIdle(cx); AssertHeapIsIdle(cx);
CHECK_REQUEST(cx); CHECK_REQUEST(cx);
assertSameCompartment(cx, obj, v); assertSameCompartment(cx, obj, vp);
RootedValue receiver(cx, ObjectValue(*obj));
ObjectOpResult ignored; ObjectOpResult ignored;
return SetElement(cx, obj, index, v, receiver, ignored); return SetElement(cx, obj, obj, index, vp, ignored);
} }
JS_PUBLIC_API(bool) JS_PUBLIC_API(bool)
JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleValue v) JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleValue v)
{ {
return SetElement(cx, obj, index, v); RootedValue value(cx, v);
return SetElement(cx, obj, index, &value);
} }
JS_PUBLIC_API(bool) JS_PUBLIC_API(bool)
JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleObject v) JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleObject v)
{ {
RootedValue value(cx, ObjectOrNullValue(v)); RootedValue value(cx, ObjectOrNullValue(v));
return SetElement(cx, obj, index, value); return SetElement(cx, obj, index, &value);
} }
JS_PUBLIC_API(bool) JS_PUBLIC_API(bool)
JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleString v) JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleString v)
{ {
RootedValue value(cx, StringValue(v)); RootedValue value(cx, StringValue(v));
return SetElement(cx, obj, index, value); return SetElement(cx, obj, index, &value);
} }
JS_PUBLIC_API(bool) JS_PUBLIC_API(bool)
JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, int32_t v) JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, int32_t v)
{ {
RootedValue value(cx, NumberValue(v)); RootedValue value(cx, NumberValue(v));
return SetElement(cx, obj, index, value); return SetElement(cx, obj, index, &value);
} }
JS_PUBLIC_API(bool) JS_PUBLIC_API(bool)
JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, uint32_t v) JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, uint32_t v)
{ {
RootedValue value(cx, NumberValue(v)); RootedValue value(cx, NumberValue(v));
return SetElement(cx, obj, index, value); return SetElement(cx, obj, index, &value);
} }
JS_PUBLIC_API(bool) JS_PUBLIC_API(bool)
JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, double v) JS_SetElement(JSContext *cx, HandleObject obj, uint32_t index, double v)
{ {
RootedValue value(cx, NumberValue(v)); RootedValue value(cx, NumberValue(v));
return SetElement(cx, obj, index, value); return SetElement(cx, obj, index, &value);
} }
JS_PUBLIC_API(bool) JS_PUBLIC_API(bool)

12
js/src/jsapi.h
View file

@ -2600,18 +2600,6 @@ class MutablePropertyDescriptorOperations : public PropertyDescriptorOperations<
value().setUndefined(); value().setUndefined();
} }
void initFields(HandleObject obj, HandleValue v, unsigned attrs,
JSGetterOp getterOp, JSSetterOp setterOp) {
MOZ_ASSERT(getterOp != JS_PropertyStub);
MOZ_ASSERT(setterOp != JS_StrictPropertyStub);
object().set(obj);
value().set(v);
setAttributes(attrs);
setGetter(getterOp);
setSetter(setterOp);
}
void assign(JSPropertyDescriptor &other) { void assign(JSPropertyDescriptor &other) {
object().set(other.obj); object().set(other.obj);
setAttributes(other.attrs); setAttributes(other.attrs);

12
js/src/jsarray.cpp
View file

@ -364,7 +364,8 @@ SetArrayElement(JSContext *cx, HandleObject obj, double index, HandleValue v)
if (!ToId(cx, index, &id)) if (!ToId(cx, index, &id))
return false; return false;
return SetProperty(cx, obj, id, v); RootedValue tmp(cx, v);
return SetProperty(cx, obj, obj, id, &tmp);
} }
/* /*
@ -433,7 +434,7 @@ bool
js::SetLengthProperty(JSContext *cx, HandleObject obj, double length) js::SetLengthProperty(JSContext *cx, HandleObject obj, double length)
{ {
RootedValue v(cx, NumberValue(length)); RootedValue v(cx, NumberValue(length));
return SetProperty(cx, obj, cx->names().length, v); return SetProperty(cx, obj, obj, cx->names().length, &v);
} }
/* /*
@ -1269,10 +1270,11 @@ InitArrayElements(JSContext *cx, HandleObject obj, uint32_t start, uint32_t coun
do { do {
value = *vector++; value = *vector++;
indexv = DoubleValue(index); indexv = DoubleValue(index);
if (!ValueToId<CanGC>(cx, indexv, &id)) if (!ValueToId<CanGC>(cx, indexv, &id) ||
return false; !SetProperty(cx, obj, obj, id, &value))
if (!SetProperty(cx, obj, id, value)) {
return false; return false;
}
index += 1; index += 1;
} while (vector != end); } while (vector != end);

20
js/src/jscntxtinlines.h
View file

@ -332,6 +332,26 @@ CallJSDeletePropertyOp(JSContext *cx, JSDeletePropertyOp op, HandleObject receiv
return result.succeed(); return result.succeed();
} }
inline bool
CallSetter(JSContext *cx, HandleObject obj, HandleId id, SetterOp op, unsigned attrs,
MutableHandleValue vp, ObjectOpResult &result)
{
if (attrs & JSPROP_SETTER) {
RootedValue opv(cx, CastAsObjectJsval(op));
if (!InvokeGetterOrSetter(cx, obj, opv, 1, vp.address(), vp))
return false;
return result.succeed();
}
if (attrs & JSPROP_GETTER)
return result.fail(JSMSG_GETTER_ONLY);
if (!op)
return result.succeed();
return CallJSSetterOp(cx, op, obj, id, vp, result);
}
inline uintptr_t inline uintptr_t
GetNativeStackLimit(ExclusiveContext *cx) GetNativeStackLimit(ExclusiveContext *cx)
{ {

12
js/src/jsfriendapi.h
View file

@ -359,8 +359,8 @@ extern JS_FRIEND_API(bool)
proxy_LookupProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id, JS::MutableHandleObject objp, proxy_LookupProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id, JS::MutableHandleObject objp,
JS::MutableHandle<Shape*> propp); JS::MutableHandle<Shape*> propp);
extern JS_FRIEND_API(bool) extern JS_FRIEND_API(bool)
proxy_DefineProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id, proxy_DefineProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id, JS::HandleValue value,
JS::Handle<JSPropertyDescriptor> desc, JSGetterOp getter, JSSetterOp setter, unsigned attrs,
JS::ObjectOpResult &result); JS::ObjectOpResult &result);
extern JS_FRIEND_API(bool) extern JS_FRIEND_API(bool)
proxy_HasProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id, bool *foundp); proxy_HasProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id, bool *foundp);
@ -368,8 +368,8 @@ extern JS_FRIEND_API(bool)
proxy_GetProperty(JSContext *cx, JS::HandleObject obj, JS::HandleObject receiver, JS::HandleId id, proxy_GetProperty(JSContext *cx, JS::HandleObject obj, JS::HandleObject receiver, JS::HandleId id,
JS::MutableHandleValue vp); JS::MutableHandleValue vp);
extern JS_FRIEND_API(bool) extern JS_FRIEND_API(bool)
proxy_SetProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id, JS::HandleValue bp, proxy_SetProperty(JSContext *cx, JS::HandleObject obj, JS::HandleObject receiver, JS::HandleId id,
JS::HandleValue receiver, JS::ObjectOpResult &result); JS::MutableHandleValue bp, JS::ObjectOpResult &result);
extern JS_FRIEND_API(bool) extern JS_FRIEND_API(bool)
proxy_GetOwnPropertyDescriptor(JSContext *cx, JS::HandleObject obj, JS::HandleId id, proxy_GetOwnPropertyDescriptor(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
JS::MutableHandle<JSPropertyDescriptor> desc); JS::MutableHandle<JSPropertyDescriptor> desc);
@ -2632,8 +2632,8 @@ ForwardToNative(JSContext *cx, JSNative native, const JS::CallArgs &args);
*/ */
JS_FRIEND_API(bool) JS_FRIEND_API(bool)
SetPropertyIgnoringNamedGetter(JSContext *cx, JS::HandleObject obj, JS::HandleId id, SetPropertyIgnoringNamedGetter(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
JS::HandleValue v, JS::HandleValue receiver, JS::MutableHandleValue vp, JS::HandleObject receiver,
JS::Handle<JSPropertyDescriptor> ownDesc, JS::MutableHandle<JSPropertyDescriptor> ownDesc,
JS::ObjectOpResult &result); JS::ObjectOpResult &result);
JS_FRIEND_API(void) JS_FRIEND_API(void)

54
js/src/jsobj.cpp
View file

@ -689,7 +689,7 @@ js::StandardDefineProperty(JSContext *cx, HandleObject obj, HandleId id,
if (obj->is<ProxyObject>()) { if (obj->is<ProxyObject>()) {
Rooted<PropertyDescriptor> pd(cx, desc); Rooted<PropertyDescriptor> pd(cx, desc);
pd.object().set(obj); pd.object().set(obj);
return Proxy::defineProperty(cx, obj, id, pd, result); return Proxy::defineProperty(cx, obj, id, &pd, result);
} }
return result.fail(JSMSG_OBJECT_NOT_EXTENSIBLE); return result.fail(JSMSG_OBJECT_NOT_EXTENSIBLE);
} }
@ -1584,26 +1584,25 @@ js::CreateThisForFunction(JSContext *cx, HandleObject callee, NewObjectKind newK
} }
/* static */ bool /* static */ bool
JSObject::nonNativeSetProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, JSObject::nonNativeSetProperty(JSContext *cx, HandleObject obj, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) HandleId id, MutableHandleValue vp, ObjectOpResult &result)
{ {
RootedValue value(cx, v);
if (MOZ_UNLIKELY(obj->watched())) { if (MOZ_UNLIKELY(obj->watched())) {
WatchpointMap *wpmap = cx->compartment()->watchpointMap; WatchpointMap *wpmap = cx->compartment()->watchpointMap;
if (wpmap && !wpmap->triggerWatchpoint(cx, obj, id, &value)) if (wpmap && !wpmap->triggerWatchpoint(cx, obj, id, vp))
return false; return false;
} }
return obj->getOps()->setProperty(cx, obj, id, value, receiver, result); return obj->getOps()->setProperty(cx, obj, receiver, id, vp, result);
} }
/* static */ bool /* static */ bool
JSObject::nonNativeSetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleValue v, JSObject::nonNativeSetElement(JSContext *cx, HandleObject obj, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) uint32_t index, MutableHandleValue vp, ObjectOpResult &result)
{ {
RootedId id(cx); RootedId id(cx);
if (!IndexToId(cx, index, &id)) if (!IndexToId(cx, index, &id))
return false; return false;
return nonNativeSetProperty(cx, obj, id, v, receiver, result); return nonNativeSetProperty(cx, obj, receiver, id, vp, result);
} }
JS_FRIEND_API(bool) JS_FRIEND_API(bool)
@ -3193,30 +3192,23 @@ js::GetOwnPropertyDescriptor(JSContext *cx, HandleObject obj, HandleId id,
return true; return true;
} }
bool
js::DefineProperty(JSContext *cx, HandleObject obj, HandleId id, Handle<PropertyDescriptor> desc,
ObjectOpResult &result)
{
if (DefinePropertyOp op = obj->getOps()->defineProperty)
return op(cx, obj, id, desc, result);
return NativeDefineProperty(cx, obj.as<NativeObject>(), id, desc, result);
}
bool bool
js::DefineProperty(ExclusiveContext *cx, HandleObject obj, HandleId id, HandleValue value, js::DefineProperty(ExclusiveContext *cx, HandleObject obj, HandleId id, HandleValue value,
JSGetterOp getter, JSSetterOp setter, unsigned attrs, JSGetterOp getter, JSSetterOp setter, unsigned attrs,
ObjectOpResult &result) ObjectOpResult &result)
{ {
MOZ_ASSERT(getter != JS_PropertyStub);
MOZ_ASSERT(setter != JS_StrictPropertyStub);
MOZ_ASSERT(!(attrs & JSPROP_PROPOP_ACCESSORS)); MOZ_ASSERT(!(attrs & JSPROP_PROPOP_ACCESSORS));
Rooted<PropertyDescriptor> desc(cx); DefinePropertyOp op = obj->getOps()->defineProperty;
desc.initFields(obj, value, attrs, getter, setter); if (op) {
if (DefinePropertyOp op = obj->getOps()->defineProperty) {
if (!cx->shouldBeJSContext()) if (!cx->shouldBeJSContext())
return false; return false;
return op(cx->asJSContext(), obj, id, desc, result); return op(cx->asJSContext(), obj, id, value, getter, setter, attrs, result);
} }
return NativeDefineProperty(cx, obj.as<NativeObject>(), id, desc, result); return NativeDefineProperty(cx, obj.as<NativeObject>(), id, value, getter, setter, attrs,
result);
} }
bool bool
@ -3279,6 +3271,22 @@ js::DefineElement(ExclusiveContext *cx, HandleObject obj, uint32_t index, Handle
return DefineProperty(cx, obj, id, value, getter, setter, attrs); return DefineProperty(cx, obj, id, value, getter, setter, attrs);
} }
bool
js::SetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, HandlePropertyName name,
MutableHandleValue vp)
{
RootedId id(cx, NameToId(name));
return SetProperty(cx, obj, receiver, id, vp);
}
bool
js::PutProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, MutableHandleValue value,
bool strict)
{
RootedId id(cx, NameToId(name));
return PutProperty(cx, obj, id, value, strict);
}
/*** SpiderMonkey nonstandard internal methods ***************************************************/ /*** SpiderMonkey nonstandard internal methods ***************************************************/

80
js/src/jsobj.h
View file

@ -478,12 +478,12 @@ class JSObject : public js::gc::Cell
bool callMethod(JSContext *cx, js::HandleId id, unsigned argc, js::Value *argv, bool callMethod(JSContext *cx, js::HandleId id, unsigned argc, js::Value *argv,
js::MutableHandleValue vp); js::MutableHandleValue vp);
static bool nonNativeSetProperty(JSContext *cx, js::HandleObject obj, js::HandleId id, static bool nonNativeSetProperty(JSContext *cx, js::HandleObject obj,
js::HandleValue v, js::HandleValue receiver, js::HandleObject receiver, js::HandleId id,
JS::ObjectOpResult &result); js::MutableHandleValue vp, JS::ObjectOpResult &result);
static bool nonNativeSetElement(JSContext *cx, js::HandleObject obj, uint32_t index, static bool nonNativeSetElement(JSContext *cx, js::HandleObject obj,
js::HandleValue v, js::HandleValue receiver, js::HandleObject receiver, uint32_t index,
JS::ObjectOpResult &result); js::MutableHandleValue vp, JS::ObjectOpResult &result);
static bool swap(JSContext *cx, JS::HandleObject a, JS::HandleObject b); static bool swap(JSContext *cx, JS::HandleObject a, JS::HandleObject b);
@ -768,10 +768,6 @@ extern bool
StandardDefineProperty(JSContext *cx, HandleObject obj, HandleId id, StandardDefineProperty(JSContext *cx, HandleObject obj, HandleId id,
Handle<PropertyDescriptor> desc); Handle<PropertyDescriptor> desc);
extern bool
DefineProperty(JSContext *cx, HandleObject obj, HandleId id,
Handle<PropertyDescriptor> desc, ObjectOpResult &result);
extern bool extern bool
DefineProperty(ExclusiveContext *cx, HandleObject obj, HandleId id, HandleValue value, DefineProperty(ExclusiveContext *cx, HandleObject obj, HandleId id, HandleValue value,
JSGetterOp getter, JSSetterOp setter, unsigned attrs, ObjectOpResult &result); JSGetterOp getter, JSSetterOp setter, unsigned attrs, ObjectOpResult &result);
@ -853,52 +849,49 @@ inline bool
GetElementNoGC(JSContext *cx, JSObject *obj, JSObject *receiver, uint32_t index, Value *vp); GetElementNoGC(JSContext *cx, JSObject *obj, JSObject *receiver, uint32_t index, Value *vp);
/* /*
* ES6 [[Set]]. Carry out the assignment `obj[id] = v`. * ES6 [[Set]]. Carry out the assignment `obj[id] = vp`.
* *
* The `receiver` argument has to do with how [[Set]] interacts with the * The `receiver` argument has to do with how [[Set]] interacts with the
* prototype chain and proxies. It's hard to explain and ES6 doesn't really * prototype chain and proxies. It's hard to explain and ES6 doesn't really
* try. Long story short, if you just want bog-standard assignment, pass * try. Long story short, if you just want bog-standard assignment, pass the
* `ObjectValue(*obj)` as receiver. Or better, use one of the signatures that * same object as both obj and receiver.
* doesn't have a receiver parameter.
* *
* Callers pass obj != receiver e.g. when a proxy is involved, obj is the * When obj != receiver, it's a reasonable guess that a proxy is involved, obj
* proxy's target, and the proxy is using SetProperty to finish an assignment * is the proxy's target, and the proxy is using SetProperty to finish an
* that started out as `receiver[id] = v`, by delegating it to obj. * assignment that started out as `receiver[id] = vp`, by delegating it to obj.
*
* Strict errors: ES6 specifies that this method returns a boolean value
* indicating whether assignment "succeeded". We currently take a `strict`
* argument instead, but this has to change. See bug 1113369.
*/ */
inline bool inline bool
SetProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, SetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result); MutableHandleValue vp, ObjectOpResult &result);
inline bool inline bool
SetProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v) SetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, PropertyName *name,
{ MutableHandleValue vp, ObjectOpResult &result)
RootedValue receiver(cx, ObjectValue(*obj));
ObjectOpResult result;
return SetProperty(cx, obj, id, v, receiver, result) &&
result.checkStrict(cx, obj, id);
}
inline bool
SetProperty(JSContext *cx, HandleObject obj, PropertyName *name, HandleValue v,
HandleValue receiver, ObjectOpResult &result)
{ {
RootedId id(cx, NameToId(name)); RootedId id(cx, NameToId(name));
return SetProperty(cx, obj, id, v, receiver, result); return SetProperty(cx, obj, receiver, id, vp, result);
} }
inline bool inline bool
SetProperty(JSContext *cx, HandleObject obj, PropertyName *name, HandleValue v) SetElement(JSContext *cx, HandleObject obj, HandleObject receiver, uint32_t index,
MutableHandleValue vp, ObjectOpResult &result);
inline bool
SetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
MutableHandleValue vp)
{ {
RootedId id(cx, NameToId(name));
RootedValue receiver(cx, ObjectValue(*obj));
ObjectOpResult result; ObjectOpResult result;
return SetProperty(cx, obj, id, v, receiver, result) && return SetProperty(cx, obj, receiver, id, vp, result) &&
result.checkStrict(cx, obj, id); result.checkStrict(cx, receiver, id);
} }
inline bool extern bool
SetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleValue v, SetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, HandlePropertyName name,
HandleValue receiver, ObjectOpResult &result); MutableHandleValue vp);
/* /*
* ES6 draft rev 31 (15 Jan 2015) 7.3.3 Put (O, P, V, Throw), except that on * ES6 draft rev 31 (15 Jan 2015) 7.3.3 Put (O, P, V, Throw), except that on
@ -906,14 +899,17 @@ SetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleValue v,
* don't bother doing. * don't bother doing.
*/ */
inline bool inline bool
PutProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, bool strict) PutProperty(JSContext *cx, HandleObject obj, HandleId id, MutableHandleValue value, bool strict)
{ {
RootedValue receiver(cx, ObjectValue(*obj));
ObjectOpResult result; ObjectOpResult result;
return SetProperty(cx, obj, id, v, receiver, result) && return SetProperty(cx, obj, obj, id, value, result) &&
result.checkStrictErrorOrWarning(cx, obj, id, strict); result.checkStrictErrorOrWarning(cx, obj, id, strict);
} }
extern bool
PutProperty(JSContext *cx, HandleObject obj, HandlePropertyName name, MutableHandleValue value,
bool strict);
/* /*
* ES6 [[Delete]]. Equivalent to the JS code `delete obj[id]`. * ES6 [[Delete]]. Equivalent to the JS code `delete obj[id]`.
*/ */

2
js/src/jsstr.cpp
View file

@ -2168,7 +2168,7 @@ class MOZ_STACK_CLASS StringRegExpGuard
// Handle everything else generically (including throwing if .lastIndex is non-writable). // Handle everything else generically (including throwing if .lastIndex is non-writable).
RootedValue zero(cx, Int32Value(0)); RootedValue zero(cx, Int32Value(0));
return SetProperty(cx, obj_, cx->names().lastIndex, zero); return SetProperty(cx, obj_, obj_, cx->names().lastIndex, &zero);
} }
RegExpShared &regExp() { return *re_; } RegExpShared &regExp() { return *re_; }

8
js/src/jswrapper.h
View file

@ -117,7 +117,7 @@ class JS_FRIEND_API(CrossCompartmentWrapper) : public Wrapper
virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject wrapper, HandleId id, virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject wrapper, HandleId id,
MutableHandle<JSPropertyDescriptor> desc) const override; MutableHandle<JSPropertyDescriptor> desc) const override;
virtual bool defineProperty(JSContext *cx, HandleObject wrapper, HandleId id, virtual bool defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const override; ObjectOpResult &result) const override;
virtual bool ownPropertyKeys(JSContext *cx, HandleObject wrapper, virtual bool ownPropertyKeys(JSContext *cx, HandleObject wrapper,
AutoIdVector &props) const override; AutoIdVector &props) const override;
@ -137,8 +137,8 @@ class JS_FRIEND_API(CrossCompartmentWrapper) : public Wrapper
virtual bool has(JSContext *cx, HandleObject wrapper, HandleId id, bool *bp) const override; virtual bool has(JSContext *cx, HandleObject wrapper, HandleId id, bool *bp) const override;
virtual bool get(JSContext *cx, HandleObject wrapper, HandleObject receiver, virtual bool get(JSContext *cx, HandleObject wrapper, HandleObject receiver,
HandleId id, MutableHandleValue vp) const override; HandleId id, MutableHandleValue vp) const override;
virtual bool set(JSContext *cx, HandleObject wrapper, HandleId id, HandleValue v, virtual bool set(JSContext *cx, HandleObject wrapper, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result) const override; MutableHandleValue vp, ObjectOpResult &result) const override;
virtual bool call(JSContext *cx, HandleObject wrapper, const CallArgs &args) const override; virtual bool call(JSContext *cx, HandleObject wrapper, const CallArgs &args) const override;
virtual bool construct(JSContext *cx, HandleObject wrapper, const CallArgs &args) const override; virtual bool construct(JSContext *cx, HandleObject wrapper, const CallArgs &args) const override;
@ -185,7 +185,7 @@ class JS_FRIEND_API(SecurityWrapper) : public Base
bool *bp) const override; bool *bp) const override;
virtual bool defineProperty(JSContext *cx, HandleObject wrapper, HandleId id, virtual bool defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const override; ObjectOpResult &result) const override;
virtual bool isExtensible(JSContext *cx, HandleObject wrapper, bool *extensible) const override; virtual bool isExtensible(JSContext *cx, HandleObject wrapper, bool *extensible) const override;
virtual bool preventExtensions(JSContext *cx, HandleObject wrapper, virtual bool preventExtensions(JSContext *cx, HandleObject wrapper,

44
js/src/proxy/BaseProxyHandler.cpp
View file

@ -61,7 +61,8 @@ BaseProxyHandler::get(JSContext *cx, HandleObject proxy, HandleObject receiver,
return true; return true;
} }
if (desc.hasGetterObject()) if (desc.hasGetterObject())
return InvokeGetter(cx, receiver, ObjectValue(*desc.getterObject()), vp); return InvokeGetterOrSetter(cx, receiver, ObjectValue(*desc.getterObject()),
0, nullptr, vp);
if (!desc.isShared()) if (!desc.isShared())
vp.set(desc.value()); vp.set(desc.value());
else else
@ -71,8 +72,8 @@ BaseProxyHandler::get(JSContext *cx, HandleObject proxy, HandleObject receiver,
} }
bool bool
BaseProxyHandler::set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, BaseProxyHandler::set(JSContext *cx, HandleObject proxy, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) const HandleId id, MutableHandleValue vp, ObjectOpResult &result) const
{ {
assertEnteredPolicy(cx, proxy, id, SET); assertEnteredPolicy(cx, proxy, id, SET);
@ -87,16 +88,15 @@ BaseProxyHandler::set(JSContext *cx, HandleObject proxy, HandleId id, HandleValu
// The rest is factored out into a separate function with a weird name. // The rest is factored out into a separate function with a weird name.
// This algorithm continues just below. // This algorithm continues just below.
return SetPropertyIgnoringNamedGetter(cx, proxy, id, v, receiver, ownDesc, result); return SetPropertyIgnoringNamedGetter(cx, proxy, id, vp, receiver, &ownDesc, result);
} }
bool bool
js::SetPropertyIgnoringNamedGetter(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, js::SetPropertyIgnoringNamedGetter(JSContext *cx, HandleObject obj, HandleId id,
HandleValue receiver, Handle<PropertyDescriptor> ownDesc_, MutableHandleValue vp, HandleObject receiver,
MutableHandle<PropertyDescriptor> ownDesc,
ObjectOpResult &result) ObjectOpResult &result)
{ {
Rooted<PropertyDescriptor> ownDesc(cx, ownDesc_);
// Step 4. // Step 4.
if (!ownDesc.object()) { if (!ownDesc.object()) {
// The spec calls this variable "parent", but that word has weird // The spec calls this variable "parent", but that word has weird
@ -105,33 +105,31 @@ js::SetPropertyIgnoringNamedGetter(JSContext *cx, HandleObject obj, HandleId id,
if (!GetPrototype(cx, obj, &proto)) if (!GetPrototype(cx, obj, &proto))
return false; return false;
if (proto) if (proto)
return SetProperty(cx, proto, id, v, receiver, result); return SetProperty(cx, proto, receiver, id, vp, result);
// Step 4.d. // Change ownDesc to be a complete descriptor for a configurable,
ownDesc.setDataDescriptor(UndefinedHandleValue, JSPROP_ENUMERATE); // writable, enumerable data property. Then fall through to step 5.
ownDesc.clear();
ownDesc.setAttributes(JSPROP_ENUMERATE);
} }
// Step 5. // Step 5.
if (ownDesc.isDataDescriptor()) { if (ownDesc.isDataDescriptor()) {
// Steps 5.a-b. // Steps 5.a-b, adapted to our nonstandard implementation of ES6
// [[Set]] return values.
if (!ownDesc.writable()) if (!ownDesc.writable())
return result.fail(JSMSG_READ_ONLY); return result.fail(JSMSG_READ_ONLY);
if (!receiver.isObject())
return result.fail(JSMSG_SET_NON_OBJECT_RECEIVER);
RootedObject receiverObj(cx, &receiver.toObject());
// Nonstandard SpiderMonkey special case: setter ops. // Nonstandard SpiderMonkey special case: setter ops.
SetterOp setter = ownDesc.setter(); SetterOp setter = ownDesc.setter();
MOZ_ASSERT(setter != JS_StrictPropertyStub); MOZ_ASSERT(setter != JS_StrictPropertyStub);
if (setter && setter != JS_StrictPropertyStub) { if (setter && setter != JS_StrictPropertyStub)
RootedValue valCopy(cx, v); return CallSetter(cx, receiver, id, setter, ownDesc.attributes(), vp, result);
return CallJSSetterOp(cx, setter, receiverObj, id, &valCopy, result);
}
// Steps 5.c-d. Adapt for SpiderMonkey by using HasOwnProperty instead // Steps 5.c-d. Adapt for SpiderMonkey by using HasOwnProperty instead
// of the standard [[GetOwnProperty]]. // of the standard [[GetOwnProperty]].
bool existingDescriptor; bool existingDescriptor;
if (!HasOwnProperty(cx, receiverObj, id, &existingDescriptor)) if (!HasOwnProperty(cx, receiver, id, &existingDescriptor))
return false; return false;
// Steps 5.e-f. // Steps 5.e-f.
@ -142,10 +140,10 @@ js::SetPropertyIgnoringNamedGetter(JSContext *cx, HandleObject obj, HandleId id,
// A very old nonstandard SpiderMonkey extension: default to the Class // A very old nonstandard SpiderMonkey extension: default to the Class
// getter and setter ops. // getter and setter ops.
const Class *clasp = receiverObj->getClass(); const Class *clasp = receiver->getClass();
MOZ_ASSERT(clasp->getProperty != JS_PropertyStub); MOZ_ASSERT(clasp->getProperty != JS_PropertyStub);
MOZ_ASSERT(clasp->setProperty != JS_StrictPropertyStub); MOZ_ASSERT(clasp->setProperty != JS_StrictPropertyStub);
return DefineProperty(cx, receiverObj, id, v, clasp->getProperty, clasp->setProperty, return DefineProperty(cx, receiver, id, vp, clasp->getProperty, clasp->setProperty,
attrs, result); attrs, result);
} }
@ -157,7 +155,7 @@ js::SetPropertyIgnoringNamedGetter(JSContext *cx, HandleObject obj, HandleId id,
if (!setter) if (!setter)
return result.fail(JSMSG_GETTER_ONLY); return result.fail(JSMSG_GETTER_ONLY);
RootedValue setterValue(cx, ObjectValue(*setter)); RootedValue setterValue(cx, ObjectValue(*setter));
if (!InvokeSetter(cx, receiver, setterValue, v)) if (!InvokeGetterOrSetter(cx, receiver, setterValue, 1, vp.address(), vp))
return false; return false;
return result.succeed(); return result.succeed();
} }

17
js/src/proxy/CrossCompartmentWrapper.cpp
View file

@ -49,13 +49,13 @@ CrossCompartmentWrapper::getOwnPropertyDescriptor(JSContext *cx, HandleObject wr
bool bool
CrossCompartmentWrapper::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id, CrossCompartmentWrapper::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
Handle<PropertyDescriptor> desc, MutableHandle<PropertyDescriptor> desc,
ObjectOpResult &result) const ObjectOpResult &result) const
{ {
Rooted<PropertyDescriptor> desc2(cx, desc); Rooted<PropertyDescriptor> desc2(cx, desc);
PIERCE(cx, wrapper, PIERCE(cx, wrapper,
cx->compartment()->wrap(cx, &desc2), cx->compartment()->wrap(cx, &desc2),
Wrapper::defineProperty(cx, wrapper, id, desc2, result), Wrapper::defineProperty(cx, wrapper, id, &desc2, result),
NOTHING); NOTHING);
} }
@ -169,15 +169,14 @@ CrossCompartmentWrapper::get(JSContext *cx, HandleObject wrapper, HandleObject r
} }
bool bool
CrossCompartmentWrapper::set(JSContext *cx, HandleObject wrapper, HandleId id, HandleValue v, CrossCompartmentWrapper::set(JSContext *cx, HandleObject wrapper, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) const HandleId id, MutableHandleValue vp, ObjectOpResult &result) const
{ {
RootedValue valCopy(cx, v); RootedObject receiverCopy(cx, receiver);
RootedValue receiverCopy(cx, receiver);
PIERCE(cx, wrapper, PIERCE(cx, wrapper,
cx->compartment()->wrap(cx, &valCopy) && cx->compartment()->wrap(cx, &receiverCopy) &&
cx->compartment()->wrap(cx, &receiverCopy), cx->compartment()->wrap(cx, vp),
Wrapper::set(cx, wrapper, id, valCopy, receiverCopy, result), Wrapper::set(cx, wrapper, receiverCopy, id, vp, result),
NOTHING); NOTHING);
} }

2
js/src/proxy/DeadObjectProxy.cpp
View file

@ -32,7 +32,7 @@ DeadObjectProxy::getOwnPropertyDescriptor(JSContext *cx, HandleObject wrapper, H
bool bool
DeadObjectProxy::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id, DeadObjectProxy::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
Handle<PropertyDescriptor> desc, MutableHandle<PropertyDescriptor> desc,
ObjectOpResult &result) const ObjectOpResult &result) const
{ {
JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_DEAD_OBJECT); JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_DEAD_OBJECT);

2
js/src/proxy/DeadObjectProxy.h
View file

@ -22,7 +22,7 @@ class DeadObjectProxy : public BaseProxyHandler
virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject wrapper, HandleId id, virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject wrapper, HandleId id,
MutableHandle<JSPropertyDescriptor> desc) const override; MutableHandle<JSPropertyDescriptor> desc) const override;
virtual bool defineProperty(JSContext *cx, HandleObject wrapper, HandleId id, virtual bool defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const override; ObjectOpResult &result) const override;
virtual bool ownPropertyKeys(JSContext *cx, HandleObject wrapper, virtual bool ownPropertyKeys(JSContext *cx, HandleObject wrapper,
AutoIdVector &props) const override; AutoIdVector &props) const override;

8
js/src/proxy/DirectProxyHandler.cpp
View file

@ -34,7 +34,7 @@ DirectProxyHandler::getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy,
bool bool
DirectProxyHandler::defineProperty(JSContext *cx, HandleObject proxy, HandleId id, DirectProxyHandler::defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<PropertyDescriptor> desc, MutableHandle<PropertyDescriptor> desc,
ObjectOpResult &result) const ObjectOpResult &result) const
{ {
assertEnteredPolicy(cx, proxy, id, SET); assertEnteredPolicy(cx, proxy, id, SET);
@ -216,12 +216,12 @@ DirectProxyHandler::get(JSContext *cx, HandleObject proxy, HandleObject receiver
} }
bool bool
DirectProxyHandler::set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, DirectProxyHandler::set(JSContext *cx, HandleObject proxy, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) const HandleId id, MutableHandleValue vp, ObjectOpResult &result) const
{ {
assertEnteredPolicy(cx, proxy, id, SET); assertEnteredPolicy(cx, proxy, id, SET);
RootedObject target(cx, proxy->as<ProxyObject>().target()); RootedObject target(cx, proxy->as<ProxyObject>().target());
return SetProperty(cx, target, id, v, receiver, result); return SetProperty(cx, target, receiver, id, vp, result);
} }
bool bool

28
js/src/proxy/Proxy.cpp
View file

@ -134,7 +134,7 @@ Proxy::getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
bool bool
Proxy::defineProperty(JSContext *cx, HandleObject proxy, HandleId id, Proxy::defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<PropertyDescriptor> desc, ObjectOpResult &result) MutableHandle<PropertyDescriptor> desc, ObjectOpResult &result)
{ {
JS_CHECK_RECURSION(cx, return false); JS_CHECK_RECURSION(cx, return false);
const BaseProxyHandler *handler = proxy->as<ProxyObject>().handler(); const BaseProxyHandler *handler = proxy->as<ProxyObject>().handler();
@ -307,8 +307,8 @@ Proxy::callProp(JSContext *cx, HandleObject proxy, HandleObject receiver, Handle
} }
bool bool
Proxy::set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, HandleValue receiver, Proxy::set(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id,
ObjectOpResult &result) MutableHandleValue vp, ObjectOpResult &result)
{ {
JS_CHECK_RECURSION(cx, return false); JS_CHECK_RECURSION(cx, return false);
const BaseProxyHandler *handler = proxy->as<ProxyObject>().handler(); const BaseProxyHandler *handler = proxy->as<ProxyObject>().handler();
@ -321,9 +321,9 @@ Proxy::set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, Handle
// Special case. See the comment on BaseProxyHandler::mHasPrototype. // Special case. See the comment on BaseProxyHandler::mHasPrototype.
if (handler->hasPrototype()) if (handler->hasPrototype())
return handler->BaseProxyHandler::set(cx, proxy, id, v, receiver, result); return handler->BaseProxyHandler::set(cx, proxy, receiver, id, vp, result);
return handler->set(cx, proxy, id, v, receiver, result); return handler->set(cx, proxy, receiver, id, vp, result);
} }
bool bool
@ -559,11 +559,17 @@ js::proxy_LookupProperty(JSContext *cx, HandleObject obj, HandleId id,
} }
bool bool
js::proxy_DefineProperty(JSContext *cx, HandleObject obj, HandleId id, js::proxy_DefineProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue value,
Handle<JSPropertyDescriptor> desc, GetterOp getter, SetterOp setter, unsigned attrs,
ObjectOpResult &result) ObjectOpResult &result)
{ {
return Proxy::defineProperty(cx, obj, id, desc, result); Rooted<PropertyDescriptor> desc(cx);
desc.object().set(obj);
desc.value().set(value);
desc.setAttributes(attrs);
desc.setGetter(getter);
desc.setSetter(setter);
return Proxy::defineProperty(cx, obj, id, &desc, result);
} }
bool bool
@ -580,10 +586,10 @@ js::proxy_GetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, Ha
} }
bool bool
js::proxy_SetProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, js::proxy_SetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result) MutableHandleValue vp, ObjectOpResult &result)
{ {
return Proxy::set(cx, obj, id, v, receiver, result); return Proxy::set(cx, obj, receiver, id, vp, result);
} }
bool bool

6
js/src/proxy/Proxy.h
View file

@ -29,7 +29,7 @@ class Proxy
static bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id, static bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
MutableHandle<JSPropertyDescriptor> desc); MutableHandle<JSPropertyDescriptor> desc);
static bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id, static bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<JSPropertyDescriptor> desc, ObjectOpResult &result); MutableHandle<JSPropertyDescriptor> desc, ObjectOpResult &result);
static bool ownPropertyKeys(JSContext *cx, HandleObject proxy, AutoIdVector &props); static bool ownPropertyKeys(JSContext *cx, HandleObject proxy, AutoIdVector &props);
static bool delete_(JSContext *cx, HandleObject proxy, HandleId id, ObjectOpResult &result); static bool delete_(JSContext *cx, HandleObject proxy, HandleId id, ObjectOpResult &result);
static bool enumerate(JSContext *cx, HandleObject proxy, MutableHandleObject objp); static bool enumerate(JSContext *cx, HandleObject proxy, MutableHandleObject objp);
@ -42,8 +42,8 @@ class Proxy
static bool has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp); static bool has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp);
static bool get(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id, static bool get(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id,
MutableHandleValue vp); MutableHandleValue vp);
static bool set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, static bool set(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result); MutableHandleValue vp, ObjectOpResult &result);
static bool call(JSContext *cx, HandleObject proxy, const CallArgs &args); static bool call(JSContext *cx, HandleObject proxy, const CallArgs &args);
static bool construct(JSContext *cx, HandleObject proxy, const CallArgs &args); static bool construct(JSContext *cx, HandleObject proxy, const CallArgs &args);

14
js/src/proxy/ScriptedDirectProxyHandler.cpp
View file

@ -550,7 +550,7 @@ ScriptedDirectProxyHandler::getOwnPropertyDescriptor(JSContext *cx, HandleObject
// ES6 draft rev 31 (15 Jan 2015) 9.5.6 Proxy.[[DefineOwnProperty]](P, Desc) // ES6 draft rev 31 (15 Jan 2015) 9.5.6 Proxy.[[DefineOwnProperty]](P, Desc)
bool bool
ScriptedDirectProxyHandler::defineProperty(JSContext *cx, HandleObject proxy, HandleId id, ScriptedDirectProxyHandler::defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<PropertyDescriptor> desc, MutableHandle<PropertyDescriptor> desc,
ObjectOpResult &result) const ObjectOpResult &result) const
{ {
// steps 2-4 // steps 2-4
@ -922,8 +922,8 @@ ScriptedDirectProxyHandler::get(JSContext *cx, HandleObject proxy, HandleObject
// ES6 draft rev 32 (2015 Feb 2) 9.5.9 Proxy.[[Set]](P, V, Receiver) // ES6 draft rev 32 (2015 Feb 2) 9.5.9 Proxy.[[Set]](P, V, Receiver)
bool bool
ScriptedDirectProxyHandler::set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, ScriptedDirectProxyHandler::set(JSContext *cx, HandleObject proxy, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) const HandleId id, MutableHandleValue vp, ObjectOpResult &result) const
{ {
// step 2-3 (Steps 1 and 4 are irrelevant assertions.) // step 2-3 (Steps 1 and 4 are irrelevant assertions.)
RootedObject handler(cx, GetDirectProxyHandlerObject(proxy)); RootedObject handler(cx, GetDirectProxyHandlerObject(proxy));
@ -940,7 +940,7 @@ ScriptedDirectProxyHandler::set(JSContext *cx, HandleObject proxy, HandleId id,
// step 8 // step 8
if (trap.isUndefined()) if (trap.isUndefined())
return SetProperty(cx, target, id, v, receiver, result); return SetProperty(cx, target, receiver, id, vp, result);
// step 9-10 // step 9-10
RootedValue value(cx); RootedValue value(cx);
@ -949,8 +949,8 @@ ScriptedDirectProxyHandler::set(JSContext *cx, HandleObject proxy, HandleId id,
Value argv[] = { Value argv[] = {
ObjectOrNullValue(target), ObjectOrNullValue(target),
value, value,
v.get(), vp.get(),
receiver.get() ObjectValue(*receiver)
}; };
RootedValue trapResult(cx); RootedValue trapResult(cx);
if (!Invoke(cx, ObjectValue(*handler), trap, ArrayLength(argv), argv, &trapResult)) if (!Invoke(cx, ObjectValue(*handler), trap, ArrayLength(argv), argv, &trapResult))
@ -969,7 +969,7 @@ ScriptedDirectProxyHandler::set(JSContext *cx, HandleObject proxy, HandleId id,
if (desc.object()) { if (desc.object()) {
if (desc.isDataDescriptor() && !desc.configurable() && !desc.writable()) { if (desc.isDataDescriptor() && !desc.configurable() && !desc.writable()) {
bool same; bool same;
if (!SameValue(cx, v, desc.value(), &same)) if (!SameValue(cx, vp, desc.value(), &same))
return false; return false;
if (!same) { if (!same) {
JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_CANT_SET_NW_NC); JS_ReportErrorNumber(cx, GetErrorMessage, nullptr, JSMSG_CANT_SET_NW_NC);

6
js/src/proxy/ScriptedDirectProxyHandler.h
View file

@ -22,7 +22,7 @@ class ScriptedDirectProxyHandler : public BaseProxyHandler {
virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id, virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
MutableHandle<JSPropertyDescriptor> desc) const override; MutableHandle<JSPropertyDescriptor> desc) const override;
virtual bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id, virtual bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const override; ObjectOpResult &result) const override;
virtual bool ownPropertyKeys(JSContext *cx, HandleObject proxy, virtual bool ownPropertyKeys(JSContext *cx, HandleObject proxy,
AutoIdVector &props) const override; AutoIdVector &props) const override;
@ -46,8 +46,8 @@ class ScriptedDirectProxyHandler : public BaseProxyHandler {
virtual bool has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp) const override; virtual bool has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp) const override;
virtual bool get(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id, virtual bool get(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id,
MutableHandleValue vp) const override; MutableHandleValue vp) const override;
virtual bool set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, virtual bool set(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result) const override; MutableHandleValue vp, ObjectOpResult &result) const override;
virtual bool call(JSContext *cx, HandleObject proxy, const CallArgs &args) const override; virtual bool call(JSContext *cx, HandleObject proxy, const CallArgs &args) const override;
virtual bool construct(JSContext *cx, HandleObject proxy, const CallArgs &args) const override; virtual bool construct(JSContext *cx, HandleObject proxy, const CallArgs &args) const override;

65
js/src/proxy/ScriptedIndirectProxyHandler.cpp
View file

@ -10,7 +10,6 @@
#include "jsapi.h" #include "jsapi.h"
#include "jscntxt.h" #include "jscntxt.h"
#include "jscntxtinlines.h"
#include "jsobjinlines.h" #include "jsobjinlines.h"
using namespace js; using namespace js;
@ -197,7 +196,7 @@ ScriptedIndirectProxyHandler::getOwnPropertyDescriptor(JSContext *cx, HandleObje
bool bool
ScriptedIndirectProxyHandler::defineProperty(JSContext *cx, HandleObject proxy, HandleId id, ScriptedIndirectProxyHandler::defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<PropertyDescriptor> desc, MutableHandle<PropertyDescriptor> desc,
ObjectOpResult &result) const ObjectOpResult &result) const
{ {
RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy)); RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
@ -304,55 +303,30 @@ ScriptedIndirectProxyHandler::get(JSContext *cx, HandleObject proxy, HandleObjec
} }
bool bool
ScriptedIndirectProxyHandler::set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, ScriptedIndirectProxyHandler::set(JSContext *cx, HandleObject proxy, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) const HandleId id, MutableHandleValue vp, ObjectOpResult &result) const
{ {
RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy)); RootedObject handler(cx, GetIndirectProxyHandlerObject(proxy));
RootedValue idv(cx); RootedValue idv(cx);
if (!IdToStringOrSymbol(cx, id, &idv)) if (!IdToStringOrSymbol(cx, id, &idv))
return false; return false;
JS::AutoValueArray<3> argv(cx); JS::AutoValueArray<3> argv(cx);
argv[0].set(receiver); argv[0].setObjectOrNull(receiver);
argv[1].set(idv); argv[1].set(idv);
argv[2].set(v); argv[2].set(vp);
RootedValue fval(cx); RootedValue fval(cx);
if (!GetDerivedTrap(cx, handler, cx->names().set, &fval)) if (!GetDerivedTrap(cx, handler, cx->names().set, &fval))
return false; return false;
if (!IsCallable(fval)) if (!IsCallable(fval))
return derivedSet(cx, proxy, id, v, receiver, result); return derivedSet(cx, proxy, receiver, id, vp, result);
if (!Trap(cx, handler, fval, 3, argv.begin(), &idv)) if (!Trap(cx, handler, fval, 3, argv.begin(), &idv))
return false; return false;
return result.succeed(); return result.succeed();
} }
static bool
CallSetter(JSContext *cx, HandleValue receiver, HandleId id, SetterOp op, unsigned attrs,
HandleValue v, ObjectOpResult &result)
{
if (attrs & JSPROP_SETTER) {
RootedValue fval(cx, CastAsObjectJsval(op));
if (!InvokeSetter(cx, receiver, fval, v))
return false;
return result.succeed();
}
if (attrs & JSPROP_GETTER)
return result.fail(JSMSG_GETTER_ONLY);
if (!receiver.isObject())
return result.fail(JSMSG_SET_NON_OBJECT_RECEIVER);
RootedObject receiverObj(cx, &receiver.toObject());
if (!op)
return result.succeed();
RootedValue valCopy(cx, v);
return CallJSSetterOp(cx, op, receiverObj, id, &valCopy, result);
}
bool bool
ScriptedIndirectProxyHandler::derivedSet(JSContext *cx, HandleObject proxy, HandleId id, ScriptedIndirectProxyHandler::derivedSet(JSContext *cx, HandleObject proxy, HandleObject receiver,
HandleValue v, HandleValue receiver, HandleId id, MutableHandleValue vp,
ObjectOpResult &result) const ObjectOpResult &result) const
{ {
// Find an own or inherited property. The code here is strange for maximum // Find an own or inherited property. The code here is strange for maximum
@ -383,7 +357,7 @@ ScriptedIndirectProxyHandler::derivedSet(JSContext *cx, HandleObject proxy, Hand
return result.fail(descIsOwn ? JSMSG_READ_ONLY : JSMSG_CANT_REDEFINE_PROP); return result.fail(descIsOwn ? JSMSG_READ_ONLY : JSMSG_CANT_REDEFINE_PROP);
if (desc.hasSetterObject() || desc.setter()) { if (desc.hasSetterObject() || desc.setter()) {
if (!CallSetter(cx, receiver, id, desc.setter(), desc.attributes(), v, result)) if (!CallSetter(cx, receiver, id, desc.setter(), desc.attributes(), vp, result))
return false; return false;
if (!result) if (!result)
return true; return true;
@ -394,21 +368,22 @@ ScriptedIndirectProxyHandler::derivedSet(JSContext *cx, HandleObject proxy, Hand
return result.succeed(); return result.succeed();
} }
} }
desc.value().set(v); desc.value().set(vp.get());
if (descIsOwn) { if (descIsOwn) {
MOZ_ASSERT(desc.object() == proxy); MOZ_ASSERT(desc.object() == proxy);
return this->defineProperty(cx, proxy, id, desc, result); return this->defineProperty(cx, proxy, id, &desc, result);
} }
} else { return DefineProperty(cx, receiver, id, desc.value(), desc.getter(), desc.setter(),
desc.setDataDescriptor(v, JSPROP_ENUMERATE); desc.attributes(), result);
} }
desc.object().set(receiver);
if (!receiver.isObject()) desc.value().set(vp.get());
return result.fail(JSMSG_SET_NON_OBJECT_RECEIVER); desc.setAttributes(JSPROP_ENUMERATE);
RootedObject receiverObj(cx, &receiver.toObject()); desc.setGetter(nullptr);
desc.object().set(receiverObj); desc.setSetter(nullptr); // Pick up the class getter/setter.
return DefineProperty(cx, receiverObj, id, desc, result); return DefineProperty(cx, receiver, id, desc.value(), nullptr, nullptr, JSPROP_ENUMERATE,
result);
} }
bool bool

10
js/src/proxy/ScriptedIndirectProxyHandler.h
View file

@ -23,7 +23,7 @@ class ScriptedIndirectProxyHandler : public BaseProxyHandler
virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id, virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
MutableHandle<JSPropertyDescriptor> desc) const override; MutableHandle<JSPropertyDescriptor> desc) const override;
virtual bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id, virtual bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const override; ObjectOpResult &result) const override;
virtual bool ownPropertyKeys(JSContext *cx, HandleObject proxy, virtual bool ownPropertyKeys(JSContext *cx, HandleObject proxy,
AutoIdVector &props) const override; AutoIdVector &props) const override;
@ -37,8 +37,8 @@ class ScriptedIndirectProxyHandler : public BaseProxyHandler
virtual bool has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp) const override; virtual bool has(JSContext *cx, HandleObject proxy, HandleId id, bool *bp) const override;
virtual bool get(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id, virtual bool get(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id,
MutableHandleValue vp) const override; MutableHandleValue vp) const override;
virtual bool set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, virtual bool set(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result) const override; MutableHandleValue vp, ObjectOpResult &result) const override;
/* SpiderMonkey extensions. */ /* SpiderMonkey extensions. */
virtual bool getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id, virtual bool getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
@ -55,8 +55,8 @@ class ScriptedIndirectProxyHandler : public BaseProxyHandler
static const ScriptedIndirectProxyHandler singleton; static const ScriptedIndirectProxyHandler singleton;
private: private:
bool derivedSet(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, bool derivedSet(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result) const; MutableHandleValue vp, ObjectOpResult &result) const;
}; };
/* Derived class to handle Proxy.createFunction() */ /* Derived class to handle Proxy.createFunction() */

4
js/src/proxy/SecurityWrapper.cpp
View file

@ -103,8 +103,8 @@ SecurityWrapper<Base>::boxedValue_unbox(JSContext *cx, HandleObject obj, Mutable
template <class Base> template <class Base>
bool bool
SecurityWrapper<Base>::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id, SecurityWrapper<Base>::defineProperty(JSContext *cx, HandleObject wrapper,
Handle<PropertyDescriptor> desc, HandleId id, MutableHandle<PropertyDescriptor> desc,
ObjectOpResult &result) const ObjectOpResult &result) const
{ {
if (desc.getter() || desc.setter()) { if (desc.getter() || desc.setter()) {

2
js/src/vm/Debugger.cpp
View file

@ -7637,7 +7637,7 @@ DebuggerEnv_setVariable(JSContext *cx, unsigned argc, Value *vp)
} }
/* Just set the property. */ /* Just set the property. */
if (!SetProperty(cx, env, id, v)) if (!SetProperty(cx, env, env, id, &v))
return false; return false;
} }

6
js/src/vm/GlobalObject.h
View file

@ -612,7 +612,11 @@ class GlobalObject : public NativeObject
MOZ_ASSERT(cx->runtime()->isSelfHostingGlobal(self)); MOZ_ASSERT(cx->runtime()->isSelfHostingGlobal(self));
#endif #endif
RootedObject holder(cx, intrinsicsHolder()); RootedObject holder(cx, intrinsicsHolder());
return SetProperty(cx, holder, name, value); RootedValue valCopy(cx, value);
ObjectOpResult result;
bool ok = SetProperty(cx, holder, holder, name, &valCopy, result);
MOZ_ASSERT_IF(ok, result);
return ok;
} }
bool getSelfHostedFunction(JSContext *cx, HandleAtom selfHostedName, HandleAtom name, bool getSelfHostedFunction(JSContext *cx, HandleAtom selfHostedName, HandleAtom name,

11
js/src/vm/Interpreter-inl.h
View file

@ -308,6 +308,7 @@ SetNameOperation(JSContext *cx, JSScript *script, jsbytecode *pc, HandleObject s
bool strict = *pc == JSOP_STRICTSETNAME || *pc == JSOP_STRICTSETGNAME; bool strict = *pc == JSOP_STRICTSETNAME || *pc == JSOP_STRICTSETGNAME;
RootedPropertyName name(cx, script->getName(pc)); RootedPropertyName name(cx, script->getName(pc));
RootedValue valCopy(cx, val);
// In strict mode, assigning to an undeclared global variable is an // In strict mode, assigning to an undeclared global variable is an
// error. To detect this, we call NativeSetProperty directly and pass // error. To detect this, we call NativeSetProperty directly and pass
@ -315,13 +316,12 @@ SetNameOperation(JSContext *cx, JSScript *script, jsbytecode *pc, HandleObject s
bool ok; bool ok;
ObjectOpResult result; ObjectOpResult result;
RootedId id(cx, NameToId(name)); RootedId id(cx, NameToId(name));
RootedValue receiver(cx, ObjectValue(*scope));
if (scope->isUnqualifiedVarObj()) { if (scope->isUnqualifiedVarObj()) {
MOZ_ASSERT(!scope->getOps()->setProperty); MOZ_ASSERT(!scope->getOps()->setProperty);
ok = NativeSetProperty(cx, scope.as<NativeObject>(), id, val, receiver, Unqualified, ok = NativeSetProperty(cx, scope.as<NativeObject>(), scope.as<NativeObject>(), id,
result); Unqualified, &valCopy, result);
} else { } else {
ok = SetProperty(cx, scope, id, val, receiver, result); ok = SetProperty(cx, scope, scope, id, &valCopy, result);
} }
return ok && result.checkStrictErrorOrWarning(cx, scope, id, strict); return ok && result.checkStrictErrorOrWarning(cx, scope, id, strict);
} }
@ -336,7 +336,8 @@ InitPropertyOperation(JSContext *cx, JSOp op, HandleObject obj, HandleId id, Han
} }
MOZ_ASSERT(obj->as<UnboxedPlainObject>().layout().lookup(id)); MOZ_ASSERT(obj->as<UnboxedPlainObject>().layout().lookup(id));
return PutProperty(cx, obj, id, rhs, false); RootedValue v(cx, rhs);
return PutProperty(cx, obj, id, &v, false);
} }
inline bool inline bool

65
js/src/vm/Interpreter.cpp
View file

@ -313,20 +313,52 @@ GetNameOperation(JSContext *cx, InterpreterFrame *fp, jsbytecode *pc, MutableHan
} }
static bool static bool
SetPropertyOperation(JSContext *cx, JSOp op, HandleValue lval, HandleId id, HandleValue rval) SetObjectProperty(JSContext *cx, JSOp op, HandleValue lval, HandleId id, MutableHandleValue rref)
{ {
MOZ_ASSERT(op == JSOP_SETPROP || op == JSOP_STRICTSETPROP); MOZ_ASSERT(lval.isObject());
RootedObject obj(cx, &lval.toObject());
ObjectOpResult result;
if (MOZ_LIKELY(!obj->getOps()->setProperty)) {
if (!NativeSetProperty(cx, obj.as<NativeObject>(), obj.as<NativeObject>(), id,
Qualified, rref, result))
{
return false;
}
} else {
if (!SetProperty(cx, obj, obj, id, rref, result))
return false;
}
return result.checkStrictErrorOrWarning(cx, obj, id, op == JSOP_STRICTSETPROP);
}
static bool
SetPrimitiveProperty(JSContext *cx, JSOp op, HandleValue lval, HandleId id,
MutableHandleValue rref)
{
MOZ_ASSERT(lval.isPrimitive());
RootedObject obj(cx, ToObjectFromStack(cx, lval)); RootedObject obj(cx, ToObjectFromStack(cx, lval));
if (!obj) if (!obj)
return false; return false;
// Note: ES6 specifies that the value lval, not obj, is passed as receiver
// to obj's [[Set]] internal method. See bug 603201.
RootedValue receiver(cx, ObjectValue(*obj)); RootedValue receiver(cx, ObjectValue(*obj));
ObjectOpResult result; return SetObjectProperty(cx, op, receiver, id, rref);
return SetProperty(cx, obj, id, rval, receiver, result) && }
result.checkStrictErrorOrWarning(cx, obj, id, op == JSOP_STRICTSETPROP);
static bool
SetPropertyOperation(JSContext *cx, JSOp op, HandleValue lval, HandleId id, HandleValue rval)
{
MOZ_ASSERT(op == JSOP_SETPROP || op == JSOP_STRICTSETPROP);
RootedValue rref(cx, rval);
if (lval.isPrimitive())
return SetPrimitiveProperty(cx, op, lval, id, &rref);
return SetObjectProperty(cx, op, lval, id, &rref);
} }
bool bool
@ -584,7 +616,8 @@ js::InvokeConstructor(JSContext *cx, Value fval, unsigned argc, const Value *arg
} }
bool bool
js::InvokeGetter(JSContext *cx, JSObject *obj, Value fval, MutableHandleValue rval) js::InvokeGetterOrSetter(JSContext *cx, JSObject *obj, Value fval, unsigned argc,
Value *argv, MutableHandleValue rval)
{ {
/* /*
* Invoke could result in another try to get or set the same id again, see * Invoke could result in another try to get or set the same id again, see
@ -592,16 +625,7 @@ js::InvokeGetter(JSContext *cx, JSObject *obj, Value fval, MutableHandleValue rv
*/ */
JS_CHECK_RECURSION(cx, return false); JS_CHECK_RECURSION(cx, return false);
return Invoke(cx, ObjectValue(*obj), fval, 0, nullptr, rval); return Invoke(cx, ObjectValue(*obj), fval, argc, argv, rval);
}
bool
js::InvokeSetter(JSContext *cx, const Value &thisv, Value fval, HandleValue v)
{
JS_CHECK_RECURSION(cx, return false);
RootedValue ignored(cx);
return Invoke(cx, thisv, fval, 1, v.address(), &ignored);
} }
bool bool
@ -1379,7 +1403,7 @@ SetObjectElementOperation(JSContext *cx, Handle<JSObject*> obj, HandleId id, con
return false; return false;
RootedValue tmp(cx, value); RootedValue tmp(cx, value);
return PutProperty(cx, obj, id, tmp, strict); return PutProperty(cx, obj, id, &tmp, strict);
} }
static MOZ_NEVER_INLINE bool static MOZ_NEVER_INLINE bool
@ -3861,8 +3885,7 @@ js::DefFunOperation(JSContext *cx, HandleScript script, HandleObject scopeChain,
*/ */
/* Step 5f. */ /* Step 5f. */
RootedId id(cx, NameToId(name)); return PutProperty(cx, parent, name, &rval, script->strict());
return PutProperty(cx, parent, id, rval, script->strict());
} }
bool bool

8
js/src/vm/Interpreter.h
View file

@ -76,14 +76,12 @@ Invoke(JSContext *cx, const Value &thisv, const Value &fval, unsigned argc, cons
MutableHandleValue rval); MutableHandleValue rval);
/* /*
* These helpers take care of the infinite-recursion check necessary for * This helper takes care of the infinite-recursion check necessary for
* getter/setter calls. * getter/setter calls.
*/ */
extern bool extern bool
InvokeGetter(JSContext *cx, JSObject *obj, Value fval, MutableHandleValue rval); InvokeGetterOrSetter(JSContext *cx, JSObject *obj, Value fval, unsigned argc, Value *argv,
MutableHandleValue rval);
extern bool
InvokeSetter(JSContext *cx, const Value &thisv, Value fval, HandleValue v);
/* /*
* InvokeConstructor implement a function call from a constructor context * InvokeConstructor implement a function call from a constructor context

6
js/src/vm/NativeObject-inl.h
View file

@ -73,7 +73,8 @@ NativeObject::clearShouldConvertDoubleElements()
} }
inline void inline void
NativeObject::setDenseElementWithType(ExclusiveContext *cx, uint32_t index, const Value &val) NativeObject::setDenseElementWithType(ExclusiveContext *cx, uint32_t index,
const Value &val)
{ {
// Avoid a slow AddTypePropertyId call if the type is the same as the type // Avoid a slow AddTypePropertyId call if the type is the same as the type
// of the previous element. // of the previous element.
@ -84,7 +85,8 @@ NativeObject::setDenseElementWithType(ExclusiveContext *cx, uint32_t index, cons
} }
inline void inline void
NativeObject::initDenseElementWithType(ExclusiveContext *cx, uint32_t index, const Value &val) NativeObject::initDenseElementWithType(ExclusiveContext *cx, uint32_t index,
const Value &val)
{ {
MOZ_ASSERT(!shouldConvertDoubleElements()); MOZ_ASSERT(!shouldConvertDoubleElements());
AddTypePropertyId(cx, this, JSID_VOID, val); AddTypePropertyId(cx, this, JSID_VOID, val);

327
js/src/vm/NativeObject.cpp
View file

@ -981,59 +981,6 @@ NativeObject::addDataProperty(ExclusiveContext *cx, HandlePropertyName name,
return addProperty(cx, self, id, nullptr, nullptr, slot, attrs, 0); return addProperty(cx, self, id, nullptr, nullptr, slot, attrs, 0);
} }
template <AllowGC allowGC>
bool
js::NativeLookupOwnProperty(ExclusiveContext *cx,
typename MaybeRooted<NativeObject*, allowGC>::HandleType obj,
typename MaybeRooted<jsid, allowGC>::HandleType id,
typename MaybeRooted<Shape*, allowGC>::MutableHandleType propp)
{
bool done;
return LookupOwnPropertyInline<allowGC>(cx, obj, id, propp, &done);
}
template bool
js::NativeLookupOwnProperty<CanGC>(ExclusiveContext *cx, HandleNativeObject obj, HandleId id,
MutableHandleShape propp);
template bool
js::NativeLookupOwnProperty<NoGC>(ExclusiveContext *cx, NativeObject *obj, jsid id,
FakeMutableHandle<Shape*> propp);
template <AllowGC allowGC>
bool
js::NativeLookupProperty(ExclusiveContext *cx,
typename MaybeRooted<NativeObject*, allowGC>::HandleType obj,
typename MaybeRooted<jsid, allowGC>::HandleType id,
typename MaybeRooted<JSObject*, allowGC>::MutableHandleType objp,
typename MaybeRooted<Shape*, allowGC>::MutableHandleType propp)
{
return LookupPropertyInline<allowGC>(cx, obj, id, objp, propp);
}
template bool
js::NativeLookupProperty<CanGC>(ExclusiveContext *cx, HandleNativeObject obj, HandleId id,
MutableHandleObject objp, MutableHandleShape propp);
template bool
js::NativeLookupProperty<NoGC>(ExclusiveContext *cx, NativeObject *obj, jsid id,
FakeMutableHandle<JSObject*> objp,
FakeMutableHandle<Shape*> propp);
bool
js::NativeLookupElement(JSContext *cx, HandleNativeObject obj, uint32_t index,
MutableHandleObject objp, MutableHandleShape propp)
{
RootedId id(cx);
if (!IndexToId(cx, index, &id))
return false;
return LookupPropertyInline<CanGC>(cx, obj, id, objp, propp);
}
/*** [[DefineOwnProperty]] ***********************************************************************/
/* /*
* Backward compatibility requires allowing addProperty hooks to mutate the * Backward compatibility requires allowing addProperty hooks to mutate the
* nominal initial value of a slotful property, while GC safety wants that * nominal initial value of a slotful property, while GC safety wants that
@ -1130,8 +1077,8 @@ UpdateShapeTypeAndValue(ExclusiveContext *cx, NativeObject *obj, Shape *shape, c
} }
static bool static bool
NativeSetExistingDataProperty(JSContext *cx, HandleNativeObject obj, HandleShape shape, NativeSet(JSContext *cx, HandleNativeObject obj, HandleObject receiver,
HandleValue v, HandleValue receiver, ObjectOpResult &result); HandleShape shape, MutableHandleValue vp, ObjectOpResult &result);
static inline bool static inline bool
DefinePropertyOrElement(ExclusiveContext *cx, HandleNativeObject obj, HandleId id, DefinePropertyOrElement(ExclusiveContext *cx, HandleNativeObject obj, HandleId id,
@ -1220,13 +1167,10 @@ DefinePropertyOrElement(ExclusiveContext *cx, HandleNativeObject obj, HandleId i
return false; return false;
if (callSetterAfterwards && setter) { if (callSetterAfterwards && setter) {
MOZ_ASSERT(!(attrs & JSPROP_GETTER));
MOZ_ASSERT(!(attrs & JSPROP_SETTER));
if (!cx->shouldBeJSContext()) if (!cx->shouldBeJSContext())
return false; return false;
RootedValue receiver(cx, ObjectValue(*obj)); RootedValue nvalue(cx, value);
return NativeSetExistingDataProperty(cx->asJSContext(), obj, shape, value, receiver, return NativeSet(cx->asJSContext(), obj, obj, shape, &nvalue, result);
result);
} }
return result.succeed(); return result.succeed();
@ -1341,19 +1285,18 @@ CheckAccessorRedefinition(ExclusiveContext *cx, HandleObject obj, HandleShape sh
} }
bool bool
js::NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, HandleId id, js::NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, HandleId id, HandleValue value,
Handle<JSPropertyDescriptor> desc, GetterOp getter, SetterOp setter, unsigned attrs,
ObjectOpResult &result) ObjectOpResult &result)
{ {
GetterOp getter = desc.getter();
SetterOp setter = desc.setter();
unsigned attrs = desc.attributes();
MOZ_ASSERT(getter != JS_PropertyStub); MOZ_ASSERT(getter != JS_PropertyStub);
MOZ_ASSERT(setter != JS_StrictPropertyStub); MOZ_ASSERT(setter != JS_StrictPropertyStub);
MOZ_ASSERT(!(attrs & JSPROP_PROPOP_ACCESSORS)); MOZ_ASSERT(!(attrs & JSPROP_PROPOP_ACCESSORS));
AutoRooterGetterSetter gsRoot(cx, attrs, &getter, &setter);
RootedShape shape(cx); RootedShape shape(cx);
RootedValue updateValue(cx, desc.value()); RootedValue updateValue(cx, value);
bool shouldDefine = true; bool shouldDefine = true;
/* /*
@ -1361,7 +1304,7 @@ js::NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, HandleId
* update the attributes and property ops. A getter or setter is really * update the attributes and property ops. A getter or setter is really
* only half of a property. * only half of a property.
*/ */
if (desc.isAccessorDescriptor()) { if (attrs & (JSPROP_GETTER | JSPROP_SETTER)) {
if (!NativeLookupOwnProperty<CanGC>(cx, obj, id, &shape)) if (!NativeLookupOwnProperty<CanGC>(cx, obj, id, &shape))
return false; return false;
if (shape) { if (shape) {
@ -1395,7 +1338,7 @@ js::NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, HandleId
shouldDefine = false; shouldDefine = false;
} }
} }
} else if (desc.hasValue()) { } else if (!(attrs & JSPROP_IGNORE_VALUE)) {
// If we did a normal lookup here, it would cause resolve hook recursion in // If we did a normal lookup here, it would cause resolve hook recursion in
// the following case. Suppose the first script we run in a lazy global is // the following case. Suppose the first script we run in a lazy global is
// |parseInt()|. // |parseInt()|.
@ -1500,20 +1443,60 @@ js::NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, HandleId
return result.succeed(); return result.succeed();
} }
template <AllowGC allowGC>
bool bool
js::NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, HandleId id, js::NativeLookupOwnProperty(ExclusiveContext *cx,
HandleValue value, GetterOp getter, SetterOp setter, unsigned attrs, typename MaybeRooted<NativeObject*, allowGC>::HandleType obj,
ObjectOpResult &result) typename MaybeRooted<jsid, allowGC>::HandleType id,
typename MaybeRooted<Shape*, allowGC>::MutableHandleType propp)
{ {
Rooted<PropertyDescriptor> desc(cx); bool done;
desc.initFields(obj, value, attrs, getter, setter); return LookupOwnPropertyInline<allowGC>(cx, obj, id, propp, &done);
return NativeDefineProperty(cx, obj, id, desc, result); }
template bool
js::NativeLookupOwnProperty<CanGC>(ExclusiveContext *cx, HandleNativeObject obj, HandleId id,
MutableHandleShape propp);
template bool
js::NativeLookupOwnProperty<NoGC>(ExclusiveContext *cx, NativeObject *obj, jsid id,
FakeMutableHandle<Shape*> propp);
template <AllowGC allowGC>
bool
js::NativeLookupProperty(ExclusiveContext *cx,
typename MaybeRooted<NativeObject*, allowGC>::HandleType obj,
typename MaybeRooted<jsid, allowGC>::HandleType id,
typename MaybeRooted<JSObject*, allowGC>::MutableHandleType objp,
typename MaybeRooted<Shape*, allowGC>::MutableHandleType propp)
{
return LookupPropertyInline<allowGC>(cx, obj, id, objp, propp);
}
template bool
js::NativeLookupProperty<CanGC>(ExclusiveContext *cx, HandleNativeObject obj, HandleId id,
MutableHandleObject objp, MutableHandleShape propp);
template bool
js::NativeLookupProperty<NoGC>(ExclusiveContext *cx, NativeObject *obj, jsid id,
FakeMutableHandle<JSObject*> objp,
FakeMutableHandle<Shape*> propp);
bool
js::NativeLookupElement(JSContext *cx, HandleNativeObject obj, uint32_t index,
MutableHandleObject objp, MutableHandleShape propp)
{
RootedId id(cx);
if (!IndexToId(cx, index, &id))
return false;
return LookupPropertyInline<CanGC>(cx, obj, id, objp, propp);
} }
bool bool
js::NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, PropertyName *name, js::NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, PropertyName *name,
HandleValue value, GetterOp getter, SetterOp setter, unsigned attrs, HandleValue value, GetterOp getter, SetterOp setter,
ObjectOpResult &result) unsigned attrs, ObjectOpResult &result)
{ {
RootedId id(cx, NameToId(name)); RootedId id(cx, NameToId(name));
return NativeDefineProperty(cx, obj, id, value, getter, setter, attrs, result); return NativeDefineProperty(cx, obj, id, value, getter, setter, attrs, result);
@ -1521,8 +1504,8 @@ js::NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, PropertyN
bool bool
js::NativeDefineElement(ExclusiveContext *cx, HandleNativeObject obj, uint32_t index, js::NativeDefineElement(ExclusiveContext *cx, HandleNativeObject obj, uint32_t index,
HandleValue value, GetterOp getter, SetterOp setter, unsigned attrs, HandleValue value, GetterOp getter, SetterOp setter,
ObjectOpResult &result) unsigned attrs, ObjectOpResult &result)
{ {
RootedId id(cx); RootedId id(cx);
if (index <= JSID_INT_MAX) { if (index <= JSID_INT_MAX) {
@ -1567,7 +1550,6 @@ js::NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, PropertyN
return NativeDefineProperty(cx, obj, id, value, getter, setter, attrs); return NativeDefineProperty(cx, obj, id, value, getter, setter, attrs);
} }
/*** [[HasProperty]] *****************************************************************************/ /*** [[HasProperty]] *****************************************************************************/
// ES6 draft rev31 9.1.7.1 OrdinaryHasProperty // ES6 draft rev31 9.1.7.1 OrdinaryHasProperty
@ -1620,7 +1602,6 @@ js::NativeHasProperty(JSContext *cx, HandleNativeObject obj, HandleId id, bool *
} }
} }
/*** [[Get]] *************************************************************************************/ /*** [[Get]] *************************************************************************************/
static inline bool static inline bool
@ -1630,7 +1611,7 @@ CallGetter(JSContext* cx, HandleObject receiver, HandleShape shape, MutableHandl
if (shape->hasGetterValue()) { if (shape->hasGetterValue()) {
Value fval = shape->getterValue(); Value fval = shape->getterValue();
return InvokeGetter(cx, receiver, fval, vp); return InvokeGetterOrSetter(cx, receiver, fval, 0, 0, vp);
} }
RootedId id(cx, shape->propid()); RootedId id(cx, shape->propid());
@ -1946,7 +1927,6 @@ js::GetPropertyForNameLookup(JSContext *cx, HandleObject obj, HandleId id, Mutab
return NativeGetPropertyInline<CanGC>(cx, obj.as<NativeObject>(), obj, id, NameLookup, vp); return NativeGetPropertyInline<CanGC>(cx, obj.as<NativeObject>(), obj, id, NameLookup, vp);
} }
/*** [[Set]] *************************************************************************************/ /*** [[Set]] *************************************************************************************/
static bool static bool
@ -1978,18 +1958,13 @@ MaybeReportUndeclaredVarAssignment(JSContext *cx, JSString *propname)
* or finds a writable data property on the prototype chain, we end up here. * or finds a writable data property on the prototype chain, we end up here.
* Finish the [[Set]] by defining a new property on receiver. * Finish the [[Set]] by defining a new property on receiver.
* *
* This implements ES6 draft rev 28, 9.1.9 [[Set]] steps 5.b-f, but it * This implements ES6 draft rev 28, 9.1.9 [[Set]] steps 5.c-f, but it
* is really old code and there are a few barnacles. * is really old code and there are a few barnacles.
*/ */
bool bool
js::SetPropertyByDefining(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, js::SetPropertyByDefining(JSContext *cx, HandleObject obj, HandleObject receiver,
HandleValue receiverValue, bool objHasOwn, ObjectOpResult &result) HandleId id, HandleValue v, bool objHasOwn, ObjectOpResult &result)
{ {
// Step 5.b.
if (!receiverValue.isObject())
return result.fail(JSMSG_SET_NON_OBJECT_RECEIVER);
RootedObject receiver(cx, &receiverValue.toObject());
// Step 5.c-d: Test whether receiver has an existing own property // Step 5.c-d: Test whether receiver has an existing own property
// receiver[id]. The spec calls [[GetOwnProperty]]; js::HasOwnProperty is // receiver[id]. The spec calls [[GetOwnProperty]]; js::HasOwnProperty is
// the same thing except faster in the non-proxy case. Sometimes we can // the same thing except faster in the non-proxy case. Sometimes we can
@ -2042,8 +2017,6 @@ js::SetPropertyByDefining(JSContext *cx, HandleObject obj, HandleId id, HandleVa
if (!receiver->is<NativeObject>()) if (!receiver->is<NativeObject>())
return DefineProperty(cx, receiver, id, v, getter, setter, attrs, result); return DefineProperty(cx, receiver, id, v, getter, setter, attrs, result);
// If the receiver is native, there is one more legacy wrinkle: the class
// JSSetterOp is called after defining the new property.
Rooted<NativeObject*> nativeReceiver(cx, &receiver->as<NativeObject>()); Rooted<NativeObject*> nativeReceiver(cx, &receiver->as<NativeObject>());
return DefinePropertyOrElement(cx, nativeReceiver, id, getter, setter, attrs, v, true, result); return DefinePropertyOrElement(cx, nativeReceiver, id, getter, setter, attrs, v, true, result);
} }
@ -2051,15 +2024,15 @@ js::SetPropertyByDefining(JSContext *cx, HandleObject obj, HandleId id, HandleVa
// When setting |id| for |receiver| and |obj| has no property for id, continue // When setting |id| for |receiver| and |obj| has no property for id, continue
// the search up the prototype chain. // the search up the prototype chain.
bool bool
js::SetPropertyOnProto(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, js::SetPropertyOnProto(JSContext *cx, HandleObject obj, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) HandleId id, MutableHandleValue vp, ObjectOpResult &result)
{ {
MOZ_ASSERT(!obj->is<ProxyObject>()); MOZ_ASSERT(!obj->is<ProxyObject>());
RootedObject proto(cx, obj->getProto()); RootedObject proto(cx, obj->getProto());
if (proto) if (proto)
return SetProperty(cx, proto, id, v, receiver, result); return SetProperty(cx, proto, receiver, id, vp, result);
return SetPropertyByDefining(cx, obj, id, v, receiver, false, result); return SetPropertyByDefining(cx, obj, receiver, id, vp, false, result);
} }
/* /*
@ -2068,20 +2041,22 @@ js::SetPropertyOnProto(JSContext *cx, HandleObject obj, HandleId id, HandleValue
* *
* FIXME: This should be updated to follow ES6 draft rev 28, section 9.1.9, * FIXME: This should be updated to follow ES6 draft rev 28, section 9.1.9,
* steps 4.d.i and 5. * steps 4.d.i and 5.
*
* Note that receiver is not necessarily native.
*/ */
static bool static bool
SetNonexistentProperty(JSContext *cx, HandleNativeObject obj, HandleId id, HandleValue v, SetNonexistentProperty(JSContext *cx, HandleNativeObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, QualifiedBool qualified, ObjectOpResult &result) QualifiedBool qualified, HandleValue v, ObjectOpResult &result)
{ {
// We should never add properties to lexical blocks. // We should never add properties to lexical blocks.
MOZ_ASSERT_IF(receiver.isObject(), !receiver.toObject().is<BlockObject>()); MOZ_ASSERT(!receiver->is<BlockObject>());
if (!qualified && receiver.isObject() && receiver.toObject().isUnqualifiedVarObj()) { if (receiver->isUnqualifiedVarObj() && !qualified) {
if (!MaybeReportUndeclaredVarAssignment(cx, JSID_TO_STRING(id))) if (!MaybeReportUndeclaredVarAssignment(cx, JSID_TO_STRING(id)))
return false; return false;
} }
return SetPropertyByDefining(cx, obj, id, v, receiver, false, result); return SetPropertyByDefining(cx, obj, receiver, id, v, false, result);
} }
/* /*
@ -2089,12 +2064,12 @@ SetNonexistentProperty(JSContext *cx, HandleNativeObject obj, HandleId id, Handl
* array element. * array element.
*/ */
static bool static bool
SetDenseOrTypedArrayElement(JSContext *cx, HandleNativeObject obj, uint32_t index, HandleValue v, SetDenseOrTypedArrayElement(JSContext *cx, HandleNativeObject obj, uint32_t index,
ObjectOpResult &result) MutableHandleValue vp, ObjectOpResult &result)
{ {
if (IsAnyTypedArray(obj)) { if (IsAnyTypedArray(obj)) {
double d; double d;
if (!ToNumber(cx, v, &d)) if (!ToNumber(cx, vp, &d))
return false; return false;
// Silently do nothing for out-of-bounds sets, for consistency with // Silently do nothing for out-of-bounds sets, for consistency with
@ -2116,152 +2091,128 @@ SetDenseOrTypedArrayElement(JSContext *cx, HandleNativeObject obj, uint32_t inde
if (!obj->maybeCopyElementsForWrite(cx)) if (!obj->maybeCopyElementsForWrite(cx))
return false; return false;
obj->setDenseElementWithType(cx, index, v); obj->setDenseElementWithType(cx, index, vp);
return result.succeed(); return result.succeed();
} }
/* /*
* Finish assignment to a shapeful data property of a native object obj. This * Finish assignment to a shapeful property of a native object obj. This
* conforms to no standard and there is a lot of legacy baggage here. * conforms to no standard and there is a lot of legacy baggage here.
*/ */
static bool static bool
NativeSetExistingDataProperty(JSContext *cx, HandleNativeObject obj, HandleShape shape, NativeSet(JSContext *cx, HandleNativeObject obj, HandleObject receiver,
HandleValue v, HandleValue receiver, ObjectOpResult &result) HandleShape shape, MutableHandleValue vp, ObjectOpResult &result)
{ {
MOZ_ASSERT(obj->isNative()); MOZ_ASSERT(obj->isNative());
MOZ_ASSERT(shape->isDataDescriptor());
if (shape->hasDefaultSetter()) {
if (shape->hasSlot()) { if (shape->hasSlot()) {
// The common path. Standard data property. /* If shape has a stub setter, just store vp. */
if (shape->hasDefaultSetter()) {
// Global properties declared with 'var' will be initially // Global properties declared with 'var' will be initially
// defined with an undefined value, so don't treat the initial // defined with an undefined value, so don't treat the initial
// assignments to such properties as overwrites. // assignments to such properties as overwrites.
bool overwriting = !obj->is<GlobalObject>() || !obj->getSlot(shape->slot()).isUndefined(); bool overwriting = !obj->is<GlobalObject>() || !obj->getSlot(shape->slot()).isUndefined();
obj->setSlotWithType(cx, shape, v, overwriting); obj->setSlotWithType(cx, shape, vp, overwriting);
return result.succeed(); return result.succeed();
} }
}
// Bizarre: shared (slotless) property that's writable but has no if (!shape->hasSlot()) {
// JSSetterOp. JS code can't define such a property, but it can be done /*
// through the JSAPI. Treat it as non-writable. * Allow API consumers to create shared properties with stub setters.
* Such properties effectively function as data descriptors which are
* not writable, so attempting to set such a property should do nothing
* or throw if we're in strict mode.
*/
if (!shape->hasGetterValue() && shape->hasDefaultSetter())
return result.fail(JSMSG_GETTER_ONLY); return result.fail(JSMSG_GETTER_ONLY);
} }
MOZ_ASSERT(!obj->is<DynamicWithObject>()); // See bug 1128681. RootedValue ovp(cx, vp);
uint32_t sample = cx->runtime()->propertyRemovals; uint32_t sample = cx->runtime()->propertyRemovals;
RootedId id(cx, shape->propid()); if (!shape->set(cx, obj, receiver, vp, result))
RootedValue value(cx, v);
if (!CallJSSetterOp(cx, shape->setterOp(), obj, id, &value, result))
return false; return false;
// Update any slot for the shape with the value produced by the setter, /*
// unless the setter deleted the shape. * Update any slot for the shape with the value produced by the setter,
* unless the setter deleted the shape.
*/
if (shape->hasSlot() && if (shape->hasSlot() &&
(MOZ_LIKELY(cx->runtime()->propertyRemovals == sample) || (MOZ_LIKELY(cx->runtime()->propertyRemovals == sample) ||
obj->contains(cx, shape))) obj->contains(cx, shape)))
{ {
obj->setSlot(shape->slot(), value); obj->setSlot(shape->slot(), vp);
} }
return true; // result is populated by CallJSSetterOp above. return true; // result is populated by shape->set() above.
} }
/* /*
* Finish the assignment `receiver[id] = v` when an existing property (shape) * Implement "the rest of" assignment to receiver[id] when an existing property
* has been found on a native object (pobj). This implements ES6 draft rev 32 * (shape) has been found on a native object (pobj).
* (2015 Feb 2) 9.1.9 steps 5 and 6.
* *
* It is necessary to pass both id and shape because shape could be an implicit * It is necessary to pass both id and shape because shape could be an implicit
* dense or typed array element (i.e. not actually a pointer to a Shape). * dense or typed array element (i.e. not actually a pointer to a Shape).
*/ */
static bool static bool
SetExistingProperty(JSContext *cx, HandleNativeObject obj, HandleId id, HandleValue v, SetExistingProperty(JSContext *cx, HandleNativeObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, HandleNativeObject pobj, HandleShape shape, HandleNativeObject pobj, HandleShape shape, MutableHandleValue vp,
ObjectOpResult &result) ObjectOpResult &result)
{ {
// Step 5 for dense elements.
if (IsImplicitDenseOrTypedArrayElement(shape)) { if (IsImplicitDenseOrTypedArrayElement(shape)) {
// Step 5.a is a no-op: all dense elements are writable. /* ES5 8.12.4 [[Put]] step 2, for a dense data property on pobj. */
if (pobj == receiver)
// Pure optimization for the common case: return SetDenseOrTypedArrayElement(cx, pobj, JSID_TO_INT(id), vp, result);
if (receiver.isObject() && pobj == &receiver.toObject()) } else {
return SetDenseOrTypedArrayElement(cx, pobj, JSID_TO_INT(id), v, result); /* ES5 8.12.4 [[Put]] step 2. */
if (shape->isAccessorDescriptor()) {
// Steps 5.b-f. if (shape->hasDefaultSetter())
return SetPropertyByDefining(cx, obj, id, v, receiver, obj == pobj, result); return result.fail(JSMSG_GETTER_ONLY);
} } else {
MOZ_ASSERT(shape->isDataDescriptor());
// Step 5 for all other properties.
if (shape->isDataDescriptor()) {
// Step 5.a.
if (!shape->writable()) if (!shape->writable())
return result.fail(JSMSG_READ_ONLY); return result.fail(JSMSG_READ_ONLY);
}
// steps 5.c-f. if (pobj == receiver) {
if (receiver.isObject() && pobj == &receiver.toObject()) {
// Pure optimization for the common case. There's no point performing
// the lookup in step 5.c again, as our caller just did it for us. The
// result is |shape|.
// Steps 5.e.i-ii.
if (pobj->is<ArrayObject>() && id == NameToId(cx->names().length)) { if (pobj->is<ArrayObject>() && id == NameToId(cx->names().length)) {
Rooted<ArrayObject*> arr(cx, &pobj->as<ArrayObject>()); Rooted<ArrayObject*> arr(cx, &pobj->as<ArrayObject>());
return ArraySetLength(cx, arr, id, shape->attributes(), v, result); return ArraySetLength(cx, arr, id, shape->attributes(), vp, result);
} }
return NativeSetExistingDataProperty(cx, obj, shape, v, receiver, result); return NativeSet(cx, obj, receiver, shape, vp, result);
} }
// SpiderMonkey special case: assigning to an inherited slotless // pobj[id] is not an own property of receiver. Call the setter or shadow it.
// property causes the setter to be called, instead of shadowing, if (!shape->shadowable() &&
// unless the existing property is JSPROP_SHADOWABLE (see bug 552432)
// or it's the array length property.
if (!shape->hasSlot() &&
!shape->hasShadowable() &&
!(pobj->is<ArrayObject>() && id == NameToId(cx->names().length))) !(pobj->is<ArrayObject>() && id == NameToId(cx->names().length)))
{ {
// Even weirder sub-special-case: inherited slotless data property // Weird special case: slotless property with default setter.
// with default setter. Wut. if (shape->hasDefaultSetter() && !shape->hasGetterValue())
if (shape->hasDefaultSetter())
return result.succeed(); return result.succeed();
RootedValue valCopy(cx, v); return shape->set(cx, obj, receiver, vp, result);
return CallJSSetterOp(cx, shape->setterOp(), obj, id, &valCopy, result); }
} }
// Shadow pobj[id] by defining a new data property receiver[id]. // Shadow pobj[id] by defining a new data property receiver[id].
// Delegate everything to SetPropertyByDefining. return SetPropertyByDefining(cx, obj, receiver, id, vp, obj == pobj, result);
return SetPropertyByDefining(cx, obj, id, v, receiver, obj == pobj, result);
}
// Steps 6-11.
MOZ_ASSERT(shape->isAccessorDescriptor());
MOZ_ASSERT_IF(!shape->hasSetterObject(), shape->hasDefaultSetter());
if (shape->hasDefaultSetter())
return result.fail(JSMSG_GETTER_ONLY);
Value setter = ObjectValue(*shape->setterObject());
if (!InvokeSetter(cx, receiver, setter, v))
return false;
return result.succeed();
} }
bool bool
js::NativeSetProperty(JSContext *cx, HandleNativeObject obj, HandleId id, HandleValue value, js::NativeSetProperty(JSContext *cx, HandleNativeObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, QualifiedBool qualified, ObjectOpResult &result) QualifiedBool qualified, MutableHandleValue vp, ObjectOpResult &result)
{ {
// Fire watchpoints, if any. // Fire watchpoints, if any.
RootedValue v(cx, value);
if (MOZ_UNLIKELY(obj->watched())) { if (MOZ_UNLIKELY(obj->watched())) {
WatchpointMap *wpmap = cx->compartment()->watchpointMap; WatchpointMap *wpmap = cx->compartment()->watchpointMap;
if (wpmap && !wpmap->triggerWatchpoint(cx, obj, id, &v)) if (wpmap && !wpmap->triggerWatchpoint(cx, obj, id, vp))
return false; return false;
} }
// Step numbers below reference ES6 rev 27 9.1.9, the [[Set]] internal // Step numbers below reference ES6 rev 27 9.1.9, the [[Set]] internal
// method for ordinary objects. We substitute our own names for these names // method for ordinary objects. We substitute our own names for these names
// used in the spec: O -> pobj, P -> id, ownDesc -> shape. // used in the spec: O -> pobj, P -> id, V -> *vp, ownDesc -> shape.
RootedShape shape(cx); RootedShape shape(cx);
RootedNativeObject pobj(cx, obj); RootedNativeObject pobj(cx, obj);
@ -2276,7 +2227,7 @@ js::NativeSetProperty(JSContext *cx, HandleNativeObject obj, HandleId id, Handle
if (shape) { if (shape) {
// Steps 5-6. // Steps 5-6.
return SetExistingProperty(cx, obj, id, v, receiver, pobj, shape, result); return SetExistingProperty(cx, obj, receiver, id, pobj, shape, vp, result);
} }
// Steps 4.a-b. The check for 'done' on this next line is tricky. // Steps 4.a-b. The check for 'done' on this next line is tricky.
@ -2290,7 +2241,7 @@ js::NativeSetProperty(JSContext *cx, HandleNativeObject obj, HandleId id, Handle
RootedObject proto(cx, done ? nullptr : pobj->getProto()); RootedObject proto(cx, done ? nullptr : pobj->getProto());
if (!proto) { if (!proto) {
// Step 4.d.i (and step 5). // Step 4.d.i (and step 5).
return SetNonexistentProperty(cx, obj, id, v, receiver, qualified, result); return SetNonexistentProperty(cx, obj, receiver, id, qualified, vp, result);
} }
// Step 4.c.i. If the prototype is also native, this step is a // Step 4.c.i. If the prototype is also native, this step is a
@ -2307,23 +2258,23 @@ js::NativeSetProperty(JSContext *cx, HandleNativeObject obj, HandleId id, Handle
if (!HasProperty(cx, proto, id, &found)) if (!HasProperty(cx, proto, id, &found))
return false; return false;
if (!found) if (!found)
return SetNonexistentProperty(cx, obj, id, v, receiver, qualified, result); return SetNonexistentProperty(cx, obj, receiver, id, qualified, vp, result);
} }
return SetProperty(cx, proto, id, v, receiver, result); return SetProperty(cx, proto, receiver, id, vp, result);
} }
pobj = &proto->as<NativeObject>(); pobj = &proto->as<NativeObject>();
} }
} }
bool bool
js::NativeSetElement(JSContext *cx, HandleNativeObject obj, uint32_t index, HandleValue v, js::NativeSetElement(JSContext *cx, HandleNativeObject obj, HandleObject receiver, uint32_t index,
HandleValue receiver, ObjectOpResult &result) MutableHandleValue vp, ObjectOpResult &result)
{ {
RootedId id(cx); RootedId id(cx);
if (!IndexToId(cx, index, &id)) if (!IndexToId(cx, index, &id))
return false; return false;
return NativeSetProperty(cx, obj, id, v, receiver, Qualified, result); return NativeSetProperty(cx, obj, receiver, id, Qualified, vp, result);
} }
/*** [[Delete]] **********************************************************************************/ /*** [[Delete]] **********************************************************************************/

37
js/src/vm/NativeObject.h
View file

@ -1255,11 +1255,6 @@ IsObjectValueInCompartment(Value v, JSCompartment *comp)
* (9.4.2), Strings (9.4.3), and so on. * (9.4.2), Strings (9.4.3), and so on.
*/ */
extern bool
NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, HandleId id,
Handle<PropertyDescriptor> desc,
ObjectOpResult &result);
extern bool extern bool
NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, HandleId id, HandleValue value, NativeDefineProperty(ExclusiveContext *cx, HandleNativeObject obj, HandleId id, HandleValue value,
JSGetterOp getter, JSSetterOp setter, unsigned attrs, JSGetterOp getter, JSSetterOp setter, unsigned attrs,
@ -1312,12 +1307,12 @@ NativeGetElement(JSContext *cx, HandleNativeObject obj, uint32_t index, MutableH
} }
bool bool
SetPropertyByDefining(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, SetPropertyByDefining(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, bool objHasOwn, ObjectOpResult &result); HandleValue v, bool objHasOwn, ObjectOpResult &result);
bool bool
SetPropertyOnProto(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, SetPropertyOnProto(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result); MutableHandleValue vp, ObjectOpResult &result);
/* /*
* Indicates whether an assignment operation is qualified (`x.y = 0`) or * Indicates whether an assignment operation is qualified (`x.y = 0`) or
@ -1332,12 +1327,12 @@ enum QualifiedBool {
}; };
extern bool extern bool
NativeSetProperty(JSContext *cx, HandleNativeObject obj, HandleId id, HandleValue v, NativeSetProperty(JSContext *cx, HandleNativeObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, QualifiedBool qualified, ObjectOpResult &result); QualifiedBool qualified, MutableHandleValue vp, ObjectOpResult &result);
extern bool extern bool
NativeSetElement(JSContext *cx, HandleNativeObject obj, uint32_t index, HandleValue v, NativeSetElement(JSContext *cx, HandleNativeObject obj, HandleObject receiver, uint32_t index,
HandleValue receiver, ObjectOpResult &result); MutableHandleValue vp, ObjectOpResult &result);
extern bool extern bool
NativeDeleteProperty(JSContext *cx, HandleNativeObject obj, HandleId id, ObjectOpResult &result); NativeDeleteProperty(JSContext *cx, HandleNativeObject obj, HandleId id, ObjectOpResult &result);
@ -1448,21 +1443,21 @@ js::GetPropertyNoGC(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, V
} }
inline bool inline bool
js::SetProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, js::SetProperty(JSContext *cx, HandleObject obj, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) HandleId id, MutableHandleValue vp, ObjectOpResult &result)
{ {
if (obj->getOps()->setProperty) if (obj->getOps()->setProperty)
return JSObject::nonNativeSetProperty(cx, obj, id, v, receiver, result); return JSObject::nonNativeSetProperty(cx, obj, receiver, id, vp, result);
return NativeSetProperty(cx, obj.as<NativeObject>(), id, v, receiver, Qualified, result); return NativeSetProperty(cx, obj.as<NativeObject>(), receiver, id, Qualified, vp, result);
} }
inline bool inline bool
js::SetElement(JSContext *cx, HandleObject obj, uint32_t index, HandleValue v, js::SetElement(JSContext *cx, HandleObject obj, HandleObject receiver, uint32_t index,
HandleValue receiver, ObjectOpResult &result) MutableHandleValue vp, ObjectOpResult &result)
{ {
if (obj->getOps()->setProperty) if (obj->getOps()->setProperty)
return JSObject::nonNativeSetElement(cx, obj, index, v, receiver, result); return JSObject::nonNativeSetElement(cx, obj, receiver, index, vp, result);
return NativeSetElement(cx, obj.as<NativeObject>(), index, v, receiver, result); return NativeSetElement(cx, obj.as<NativeObject>(), receiver, index, vp, result);
} }
#endif /* vm_NativeObject_h */ #endif /* vm_NativeObject_h */

37
js/src/vm/ScopeObject.cpp
View file

@ -298,7 +298,7 @@ CallObject::createHollowForDebug(JSContext *cx, HandleFunction callee)
RootedScript script(cx, callee->nonLazyScript()); RootedScript script(cx, callee->nonLazyScript());
for (BindingIter bi(script); !bi.done(); bi++) { for (BindingIter bi(script); !bi.done(); bi++) {
id = NameToId(bi->name()); id = NameToId(bi->name());
if (!SetProperty(cx, callobj, id, optimizedOut)) if (!SetProperty(cx, callobj, callobj, id, &optimizedOut))
return nullptr; return nullptr;
} }
@ -469,11 +469,12 @@ with_LookupProperty(JSContext *cx, HandleObject obj, HandleId id,
} }
static bool static bool
with_DefineProperty(JSContext *cx, HandleObject obj, HandleId id, Handle<PropertyDescriptor> desc, with_DefineProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue value,
JSGetterOp getter, JSSetterOp setter, unsigned attrs,
ObjectOpResult &result) ObjectOpResult &result)
{ {
RootedObject actual(cx, &obj->as<DynamicWithObject>().object()); RootedObject actual(cx, &obj->as<DynamicWithObject>().object());
return DefineProperty(cx, actual, id, desc, result); return DefineProperty(cx, actual, id, value, getter, setter, attrs, result);
} }
static bool static bool
@ -492,14 +493,14 @@ with_GetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, HandleI
} }
static bool static bool
with_SetProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, with_SetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result) MutableHandleValue vp, ObjectOpResult &result)
{ {
RootedObject actual(cx, &obj->as<DynamicWithObject>().object()); RootedObject actual(cx, &obj->as<DynamicWithObject>().object());
RootedValue actualReceiver(cx, receiver); RootedObject actualReceiver(cx, receiver);
if (receiver.isObject() && &receiver.toObject() == obj) if (receiver == obj)
actualReceiver.setObject(*actual); actualReceiver = actual;
return SetProperty(cx, actual, id, v, actualReceiver, result); return SetProperty(cx, actual, actualReceiver, id, vp, result);
} }
static bool static bool
@ -930,8 +931,8 @@ uninitialized_GetProperty(JSContext *cx, HandleObject obj, HandleObject receiver
} }
static bool static bool
uninitialized_SetProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, uninitialized_SetProperty(JSContext *cx, HandleObject obj, HandleObject receiver, HandleId id,
HandleValue receiver, ObjectOpResult &result) MutableHandleValue vp, ObjectOpResult &result)
{ {
ReportUninitializedLexicalId(cx, id); ReportUninitializedLexicalId(cx, id);
return false; return false;
@ -1593,8 +1594,8 @@ class DebugScopeProxy : public BaseProxyHandler
} }
} }
bool set(JSContext *cx, HandleObject proxy, HandleId id, HandleValue v, HandleValue receiver, bool set(JSContext *cx, HandleObject proxy, HandleObject receiver, HandleId id,
ObjectOpResult &result) const override MutableHandleValue vp, ObjectOpResult &result) const override
{ {
Rooted<DebugScopeObject*> debugScope(cx, &proxy->as<DebugScopeObject>()); Rooted<DebugScopeObject*> debugScope(cx, &proxy->as<DebugScopeObject>());
Rooted<ScopeObject*> scope(cx, &proxy->as<DebugScopeObject>().scope()); Rooted<ScopeObject*> scope(cx, &proxy->as<DebugScopeObject>().scope());
@ -1603,25 +1604,21 @@ class DebugScopeProxy : public BaseProxyHandler
return Throw(cx, id, JSMSG_DEBUG_CANT_SET_OPT_ENV); return Throw(cx, id, JSMSG_DEBUG_CANT_SET_OPT_ENV);
AccessResult access; AccessResult access;
RootedValue valCopy(cx, v); if (!handleUnaliasedAccess(cx, debugScope, scope, id, SET, vp, &access))
if (!handleUnaliasedAccess(cx, debugScope, scope, id, SET, &valCopy, &access))
return false; return false;
switch (access) { switch (access) {
case ACCESS_UNALIASED: case ACCESS_UNALIASED:
return result.succeed(); return result.succeed();
case ACCESS_GENERIC: case ACCESS_GENERIC:
{ return SetProperty(cx, scope, scope, id, vp, result);
RootedValue scopeVal(cx, ObjectValue(*scope));
return SetProperty(cx, scope, id, v, scopeVal, result);
}
default: default:
MOZ_CRASH("bad AccessResult"); MOZ_CRASH("bad AccessResult");
} }
} }
bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id, bool defineProperty(JSContext *cx, HandleObject proxy, HandleId id,
Handle<PropertyDescriptor> desc, MutableHandle<PropertyDescriptor> desc,
ObjectOpResult &result) const override ObjectOpResult &result) const override
{ {
Rooted<ScopeObject*> scope(cx, &proxy->as<DebugScopeObject>().scope()); Rooted<ScopeObject*> scope(cx, &proxy->as<DebugScopeObject>().scope());

4
js/src/vm/SelfHosting.cpp
View file

@ -336,10 +336,10 @@ js::intrinsic_UnsafePutElements(JSContext *cx, unsigned argc, Value *vp)
if (IsAnyTypedArray(arrobj.get()) || arrobj->is<TypedObject>()) { if (IsAnyTypedArray(arrobj.get()) || arrobj->is<TypedObject>()) {
MOZ_ASSERT_IF(IsAnyTypedArray(arrobj.get()), idx < AnyTypedArrayLength(arrobj.get())); MOZ_ASSERT_IF(IsAnyTypedArray(arrobj.get()), idx < AnyTypedArrayLength(arrobj.get()));
MOZ_ASSERT_IF(arrobj->is<TypedObject>(), idx < uint32_t(arrobj->as<TypedObject>().length())); MOZ_ASSERT_IF(arrobj->is<TypedObject>(), idx < uint32_t(arrobj->as<TypedObject>().length()));
RootedValue tmp(cx, args[elemi]);
// XXX: Always non-strict. // XXX: Always non-strict.
ObjectOpResult ignored; ObjectOpResult ignored;
RootedValue receiver(cx, ObjectValue(*arrobj)); if (!SetElement(cx, arrobj, arrobj, idx, &tmp, ignored))
if (!SetElement(cx, arrobj, idx, args[elemi], receiver, ignored))
return false; return false;
} else { } else {
MOZ_ASSERT(idx < arrobj->as<ArrayObject>().getDenseInitializedLength()); MOZ_ASSERT(idx < arrobj->as<ArrayObject>().getDenseInitializedLength());

24
js/src/vm/Shape-inl.h
View file

@ -39,6 +39,30 @@ Shape::search(ExclusiveContext *cx, jsid id)
return search(cx, this, id, &_); return search(cx, this, id, &_);
} }
inline bool
Shape::set(JSContext* cx, HandleNativeObject obj, HandleObject receiver, MutableHandleValue vp,
ObjectOpResult &result)
{
MOZ_ASSERT_IF(hasDefaultSetter(), hasGetterValue());
MOZ_ASSERT(!obj->is<DynamicWithObject>()); // See bug 1128681.
if (attrs & JSPROP_SETTER) {
Value fval = setterValue();
if (!InvokeGetterOrSetter(cx, receiver, fval, 1, vp.address(), vp))
return false;
return result.succeed();
}
if (attrs & JSPROP_GETTER)
return result.fail(JSMSG_GETTER_ONLY);
if (!setterOp())
return result.succeed();
RootedId id(cx, propid());
return CallJSSetterOp(cx, setterOp(), obj, id, vp, result);
}
/* static */ inline Shape * /* static */ inline Shape *
Shape::search(ExclusiveContext *cx, Shape *start, jsid id, ShapeTable::Entry **pentry, bool adding) Shape::search(ExclusiveContext *cx, Shape *start, jsid id, ShapeTable::Entry **pentry, bool adding)
{ {

11
js/src/vm/Shape.h
View file

@ -1019,7 +1019,16 @@ class Shape : public gc::TenuredCell
return (attrs & (JSPROP_SETTER | JSPROP_GETTER)) != 0; return (attrs & (JSPROP_SETTER | JSPROP_GETTER)) != 0;
} }
bool hasShadowable() const { return attrs & JSPROP_SHADOWABLE; } /*
* For ES5 compatibility, we allow properties with SetterOp-flavored
* setters to be shadowed when set. The "own" property thereby created in
* the directly referenced object will have the same getter and setter as
* the prototype property. See bug 552432.
*/
bool shadowable() const {
MOZ_ASSERT_IF(isDataDescriptor(), writable());
return hasSlot() || (attrs & JSPROP_SHADOWABLE);
}
uint32_t entryCount() { uint32_t entryCount() {
if (hasTable()) if (hasTable())

37
js/src/vm/UnboxedObject.cpp
View file

@ -679,16 +679,16 @@ UnboxedPlainObject::obj_lookupProperty(JSContext *cx, HandleObject obj,
} }
/* static */ bool /* static */ bool
UnboxedPlainObject::obj_defineProperty(JSContext *cx, HandleObject obj, HandleId id, UnboxedPlainObject::obj_defineProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v,
Handle<JSPropertyDescriptor> desc, GetterOp getter, SetterOp setter, unsigned attrs,
ObjectOpResult &result) ObjectOpResult &result)
{ {
const UnboxedLayout &layout = obj->as<UnboxedPlainObject>().layout(); const UnboxedLayout &layout = obj->as<UnboxedPlainObject>().layout();
if (const UnboxedLayout::Property *property = layout.lookup(id)) { if (const UnboxedLayout::Property *property = layout.lookup(id)) {
if (!desc.getter() && !desc.setter() && desc.attributes() == JSPROP_ENUMERATE) { if (!getter && !setter && attrs == JSPROP_ENUMERATE) {
// This define is equivalent to setting an existing property. // This define is equivalent to setting an existing property.
if (obj->as<UnboxedPlainObject>().setValue(cx, *property, desc.value())) if (obj->as<UnboxedPlainObject>().setValue(cx, *property, v))
return true; return true;
} }
@ -697,8 +697,7 @@ UnboxedPlainObject::obj_defineProperty(JSContext *cx, HandleObject obj, HandleId
if (!convertToNative(cx, obj)) if (!convertToNative(cx, obj))
return false; return false;
return DefineProperty(cx, obj, id, desc, result) && return DefineProperty(cx, obj, id, v, getter, setter, attrs);
result.checkStrict(cx, obj, id);
} }
// Define the property on the expando object. // Define the property on the expando object.
@ -707,9 +706,9 @@ UnboxedPlainObject::obj_defineProperty(JSContext *cx, HandleObject obj, HandleId
return false; return false;
// Update property types on the unboxed object as well. // Update property types on the unboxed object as well.
AddTypePropertyId(cx, obj, id, desc.value()); AddTypePropertyId(cx, obj, id, v);
return DefineProperty(cx, expando, id, desc, result); return DefineProperty(cx, expando, id, v, getter, setter, attrs, result);
} }
/* static */ bool /* static */ bool
@ -758,38 +757,36 @@ UnboxedPlainObject::obj_getProperty(JSContext *cx, HandleObject obj, HandleObjec
} }
/* static */ bool /* static */ bool
UnboxedPlainObject::obj_setProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, UnboxedPlainObject::obj_setProperty(JSContext *cx, HandleObject obj, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result) HandleId id, MutableHandleValue vp, ObjectOpResult &result)
{ {
const UnboxedLayout &layout = obj->as<UnboxedPlainObject>().layout(); const UnboxedLayout &layout = obj->as<UnboxedPlainObject>().layout();
if (const UnboxedLayout::Property *property = layout.lookup(id)) { if (const UnboxedLayout::Property *property = layout.lookup(id)) {
if (receiver.isObject() && obj == &receiver.toObject()) { if (obj == receiver) {
if (obj->as<UnboxedPlainObject>().setValue(cx, *property, v)) if (obj->as<UnboxedPlainObject>().setValue(cx, *property, vp))
return result.succeed(); return result.succeed();
if (!convertToNative(cx, obj)) if (!convertToNative(cx, obj))
return false; return false;
return SetProperty(cx, obj, id, v, receiver, result); return SetProperty(cx, obj, receiver, id, vp, result);
} }
return SetPropertyByDefining(cx, obj, id, v, receiver, false, result); return SetPropertyByDefining(cx, obj, receiver, id, vp, false, result);
} }
if (UnboxedExpandoObject *expando = obj->as<UnboxedPlainObject>().maybeExpando()) { if (UnboxedExpandoObject *expando = obj->as<UnboxedPlainObject>().maybeExpando()) {
if (expando->containsShapeOrElement(cx, id)) { if (expando->containsShapeOrElement(cx, id)) {
// Update property types on the unboxed object as well. // Update property types on the unboxed object as well.
AddTypePropertyId(cx, obj, id, v); AddTypePropertyId(cx, obj, id, vp);
RootedObject nexpando(cx, expando); RootedObject nexpando(cx, expando);
RootedValue nreceiver(cx, (receiver.isObject() && obj == &receiver.toObject()) RootedObject nreceiver(cx, (obj == receiver) ? expando : receiver.get());
? ObjectValue(*expando) return SetProperty(cx, nexpando, nreceiver, id, vp, result);
: receiver);
return SetProperty(cx, nexpando, id, v, nreceiver, result);
} }
} }
return SetPropertyOnProto(cx, obj, id, v, receiver, result); return SetPropertyOnProto(cx, obj, receiver, id, vp, result);
} }
/* static */ bool /* static */ bool

8
js/src/vm/UnboxedObject.h
View file

@ -192,8 +192,8 @@ class UnboxedPlainObject : public JSObject
HandleId id, MutableHandleObject objp, HandleId id, MutableHandleObject objp,
MutableHandleShape propp); MutableHandleShape propp);
static bool obj_defineProperty(JSContext *cx, HandleObject obj, HandleId id, static bool obj_defineProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v,
Handle<JSPropertyDescriptor> desc, GetterOp getter, SetterOp setter, unsigned attrs,
ObjectOpResult &result); ObjectOpResult &result);
static bool obj_hasProperty(JSContext *cx, HandleObject obj, HandleId id, bool *foundp); static bool obj_hasProperty(JSContext *cx, HandleObject obj, HandleId id, bool *foundp);
@ -201,8 +201,8 @@ class UnboxedPlainObject : public JSObject
static bool obj_getProperty(JSContext *cx, HandleObject obj, HandleObject receiver, static bool obj_getProperty(JSContext *cx, HandleObject obj, HandleObject receiver,
HandleId id, MutableHandleValue vp); HandleId id, MutableHandleValue vp);
static bool obj_setProperty(JSContext *cx, HandleObject obj, HandleId id, HandleValue v, static bool obj_setProperty(JSContext *cx, HandleObject obj, HandleObject receiver,
HandleValue receiver, ObjectOpResult &result); HandleId id, MutableHandleValue vp, ObjectOpResult &result);
static bool obj_getOwnPropertyDescriptor(JSContext *cx, HandleObject obj, HandleId id, static bool obj_getOwnPropertyDescriptor(JSContext *cx, HandleObject obj, HandleId id,
MutableHandle<JSPropertyDescriptor> desc); MutableHandle<JSPropertyDescriptor> desc);

2
js/src/vm/Xdr.h
View file

@ -33,7 +33,7 @@ static const uint32_t XDR_BYTECODE_VERSION_SUBTRAHEND = 265;
static const uint32_t XDR_BYTECODE_VERSION = static const uint32_t XDR_BYTECODE_VERSION =
uint32_t(0xb973c0de - XDR_BYTECODE_VERSION_SUBTRAHEND); uint32_t(0xb973c0de - XDR_BYTECODE_VERSION_SUBTRAHEND);
static_assert(JSErr_Limit == 389, static_assert(JSErr_Limit == 388,
"GREETINGS, POTENTIAL SUBTRAHEND INCREMENTER! If you added or " "GREETINGS, POTENTIAL SUBTRAHEND INCREMENTER! If you added or "
"removed MSG_DEFs from js.msg, you should increment " "removed MSG_DEFs from js.msg, you should increment "
"XDR_BYTECODE_VERSION_SUBTRAHEND and update this assertion's " "XDR_BYTECODE_VERSION_SUBTRAHEND and update this assertion's "

6
js/xpconnect/src/Sandbox.cpp
View file

@ -733,12 +733,12 @@ xpc::SandboxProxyHandler::get(JSContext *cx, JS::Handle<JSObject*> proxy,
bool bool
xpc::SandboxProxyHandler::set(JSContext *cx, JS::Handle<JSObject*> proxy, xpc::SandboxProxyHandler::set(JSContext *cx, JS::Handle<JSObject*> proxy,
JS::Handle<JSObject*> receiver,
JS::Handle<jsid> id, JS::Handle<jsid> id,
JS::Handle<Value> v, JS::MutableHandle<Value> vp,
JS::Handle<Value> receiver,
JS::ObjectOpResult &result) const JS::ObjectOpResult &result) const
{ {
return BaseProxyHandler::set(cx, proxy, id, v, receiver, result); return BaseProxyHandler::set(cx, proxy, receiver, id, vp, result);
} }
bool bool

24
js/xpconnect/src/XPCWrappedNativeJSOps.cpp
View file

@ -426,6 +426,14 @@ XPC_WN_OnlyIWrite_AddPropertyStub(JSContext *cx, HandleObject obj, HandleId id,
return Throw(NS_ERROR_XPC_CANT_MODIFY_PROP_ON_WN, cx); return Throw(NS_ERROR_XPC_CANT_MODIFY_PROP_ON_WN, cx);
} }
static bool
XPC_WN_OnlyIWrite_SetPropertyStub(JSContext *cx, HandleObject obj, HandleId id,
MutableHandleValue vp, ObjectOpResult &result)
{
result.succeed();
return XPC_WN_OnlyIWrite_AddPropertyStub(cx, obj, id, vp);
}
static bool static bool
XPC_WN_CannotModifyPropertyStub(JSContext *cx, HandleObject obj, HandleId id, XPC_WN_CannotModifyPropertyStub(JSContext *cx, HandleObject obj, HandleId id,
MutableHandleValue vp) MutableHandleValue vp)
@ -644,7 +652,7 @@ const XPCWrappedNativeJSClass XPC_WN_NoHelper_JSClass = {
XPC_WN_OnlyIWrite_AddPropertyStub, // addProperty XPC_WN_OnlyIWrite_AddPropertyStub, // addProperty
XPC_WN_CantDeletePropertyStub, // delProperty XPC_WN_CantDeletePropertyStub, // delProperty
nullptr, // getProperty nullptr, // getProperty
nullptr, // setProperty XPC_WN_OnlyIWrite_SetPropertyStub, // setProperty
XPC_WN_Shared_Enumerate, // enumerate XPC_WN_Shared_Enumerate, // enumerate
XPC_WN_NoHelper_Resolve, // resolve XPC_WN_NoHelper_Resolve, // resolve
@ -1353,6 +1361,14 @@ XPC_WN_OnlyIWrite_Proto_AddPropertyStub(JSContext *cx, HandleObject obj, HandleI
return Throw(NS_ERROR_XPC_BAD_OP_ON_WN_PROTO, cx); return Throw(NS_ERROR_XPC_BAD_OP_ON_WN_PROTO, cx);
} }
static bool
XPC_WN_OnlyIWrite_Proto_SetPropertyStub(JSContext *cx, HandleObject obj, HandleId id,
MutableHandleValue vp, ObjectOpResult &result)
{
result.succeed();
return XPC_WN_OnlyIWrite_Proto_AddPropertyStub(cx, obj, id, vp);
}
static bool static bool
XPC_WN_NoMods_Proto_Resolve(JSContext *cx, HandleObject obj, HandleId id, bool *resolvedp) XPC_WN_NoMods_Proto_Resolve(JSContext *cx, HandleObject obj, HandleId id, bool *resolvedp)
{ {
@ -1388,7 +1404,7 @@ const js::Class XPC_WN_NoMods_WithCall_Proto_JSClass = {
XPC_WN_OnlyIWrite_Proto_AddPropertyStub, // addProperty; XPC_WN_OnlyIWrite_Proto_AddPropertyStub, // addProperty;
XPC_WN_CantDeletePropertyStub, // delProperty; XPC_WN_CantDeletePropertyStub, // delProperty;
nullptr, // getProperty; nullptr, // getProperty;
nullptr, // setProperty; XPC_WN_OnlyIWrite_Proto_SetPropertyStub, // setProperty;
XPC_WN_Shared_Proto_Enumerate, // enumerate; XPC_WN_Shared_Proto_Enumerate, // enumerate;
XPC_WN_NoMods_Proto_Resolve, // resolve; XPC_WN_NoMods_Proto_Resolve, // resolve;
nullptr, // convert; nullptr, // convert;
@ -1413,7 +1429,7 @@ const js::Class XPC_WN_NoMods_NoCall_Proto_JSClass = {
XPC_WN_OnlyIWrite_Proto_AddPropertyStub, // addProperty; XPC_WN_OnlyIWrite_Proto_AddPropertyStub, // addProperty;
XPC_WN_CantDeletePropertyStub, // delProperty; XPC_WN_CantDeletePropertyStub, // delProperty;
nullptr, // getProperty; nullptr, // getProperty;
nullptr, // setProperty; XPC_WN_OnlyIWrite_Proto_SetPropertyStub, // setProperty;
XPC_WN_Shared_Proto_Enumerate, // enumerate; XPC_WN_Shared_Proto_Enumerate, // enumerate;
XPC_WN_NoMods_Proto_Resolve, // resolve; XPC_WN_NoMods_Proto_Resolve, // resolve;
nullptr, // convert; nullptr, // convert;
@ -1508,7 +1524,7 @@ const js::Class XPC_WN_Tearoff_JSClass = {
XPC_WN_OnlyIWrite_AddPropertyStub, // addProperty; XPC_WN_OnlyIWrite_AddPropertyStub, // addProperty;
XPC_WN_CantDeletePropertyStub, // delProperty; XPC_WN_CantDeletePropertyStub, // delProperty;
nullptr, // getProperty; nullptr, // getProperty;
nullptr, // setProperty; XPC_WN_OnlyIWrite_SetPropertyStub, // setProperty;
XPC_WN_TearOff_Enumerate, // enumerate; XPC_WN_TearOff_Enumerate, // enumerate;
XPC_WN_TearOff_Resolve, // resolve; XPC_WN_TearOff_Resolve, // resolve;
XPC_WN_Shared_Convert, // convert; XPC_WN_Shared_Convert, // convert;

175
js/xpconnect/tests/unit/test_xpcwn_tamperproof.js
View file

@ -1,175 +0,0 @@
// Test that it's not possible to create expando properties on XPCWNs.
// See <https://bugzilla.mozilla.org/show_bug.cgi?id=1143810#c5>.
const Cc = Components.classes;
const Ci = Components.interfaces;
function check_throws(f) {
try {
f();
} catch (exc) {
return;
}
throw new TypeError("Expected exception, no exception thrown");
}
/*
* Test that XPCWrappedNative objects do not permit expando properties to be created.
*
* This function is called twice. The first time, realObj is an nsITimer XPCWN
* and accessObj === realObj.
*
* The second time, accessObj is a scripted proxy with realObj as its target.
* So the second time we are testing that scripted proxies don't magically
* bypass whatever mechanism enforces the expando policy on XPCWNs.
*/
function test_tamperproof(realObj, accessObj, {method, constant, attribute}) {
// Assignment can't create an expando property.
check_throws(function () { accessObj.expando = 14; });
do_check_false("expando" in realObj);
// Strict assignment throws.
check_throws(function () { "use strict"; accessObj.expando = 14; });
do_check_false("expando" in realObj);
// Assignment to an inherited method name doesn't work either.
check_throws(function () { accessObj.hasOwnProperty = () => "lies"; });
check_throws(function () { "use strict"; accessObj.hasOwnProperty = () => "lies"; });
do_check_false(realObj.hasOwnProperty("hasOwnProperty"));
// Assignment to a method name doesn't work either.
let originalMethod;
if (method) {
originalMethod = accessObj[method];
accessObj[method] = "nope"; // non-writable data property, no exception in non-strict code
check_throws(function () { "use strict"; accessObj[method] = "nope"; });
do_check_true(realObj[method] === originalMethod);
}
// A constant is the same thing.
let originalConstantValue;
if (constant) {
originalConstantValue = accessObj[constant];
accessObj[constant] = "nope";
do_check_eq(realObj[constant], originalConstantValue);
check_throws(function () { "use strict"; accessObj[constant] = "nope"; });
do_check_eq(realObj[constant], originalConstantValue);
}
// Assignment to a readonly accessor property with no setter doesn't work either.
let originalAttributeDesc;
if (attribute) {
originalAttributeDesc = Object.getOwnPropertyDescriptor(realObj, attribute);
do_check_true("set" in originalAttributeDesc);
do_check_true(originalAttributeDesc.set === undefined);
accessObj[attribute] = "nope"; // accessor property with no setter: no exception in non-strict code
check_throws(function () { "use strict"; accessObj[attribute] = "nope"; });
let desc = Object.getOwnPropertyDescriptor(realObj, attribute);
do_check_true("set" in desc);
do_check_eq(originalAttributeDesc.get, desc.get);
do_check_eq(undefined, desc.set);
}
// Reflect.set doesn't work either.
if (this.Reflect && this.Reflect.set)
throw new Error("Congratulations on implementing Reflect.set! Here are some tests to uncomment.");
/*
if (method) {
do_check_false(Reflect.set({}, method, "bad", accessObj));
do_check_eq(realObj[method], originalMethod);
}
if (attribute) {
do_check_false(Reflect.set({}, attribute, "bad", accessObj));
do_check_eq(originalAttributeDesc.get, Object.getOwnPropertyDescriptor(realObj, attribute).get);
}
*/
// Object.defineProperty can't do anything either.
let names = ["expando"];
if (method) names.push(method);
if (constant) names.push(constant);
if (attribute) names.push(attribute);
for (let name of names) {
let originalDesc = Object.getOwnPropertyDescriptor(realObj, name);
check_throws(function () {
Object.defineProperty(accessObj, name, {configurable: true});
});
check_throws(function () {
Object.defineProperty(accessObj, name, {writable: true});
});
check_throws(function () {
Object.defineProperty(accessObj, name, {get: function () { return "lies"; }});
});
check_throws(function () {
Object.defineProperty(accessObj, name, {value: "bad"});
});
let desc = Object.getOwnPropertyDescriptor(realObj, name);
if (originalDesc === undefined) {
do_check_eq(undefined, desc);
} else {
do_check_eq(originalDesc.configurable, desc.configurable);
do_check_eq(originalDesc.enumerable, desc.enumerable);
do_check_eq(originalDesc.writable, desc.writable);
do_check_eq(originalDesc.value, desc.value);
do_check_eq(originalDesc.get, desc.get);
do_check_eq(originalDesc.set, desc.set);
}
}
// Existing properties can't be deleted.
if (method) {
do_check_false(delete accessObj[method]);
check_throws(function () { "use strict"; delete accessObj[method]; });
do_check_eq(realObj[method], originalMethod);
}
if (constant) {
do_check_false(delete accessObj[constant]);
check_throws(function () { "use strict"; delete accessObj[constant]; });
do_check_eq(realObj[constant], originalConstantValue);
}
if (attribute) {
do_check_false(delete accessObj[attribute]);
check_throws(function () { "use strict"; delete accessObj[attribute]; });
desc = Object.getOwnPropertyDescriptor(realObj, attribute);
do_check_eq(originalAttributeDesc.get, desc.get);
}
}
function test_twice(obj, options) {
test_tamperproof(obj, obj, options);
let handler = {
getPrototypeOf(t) {
return new Proxy(Object.getPrototypeOf(t), handler);
}
};
test_tamperproof(obj, new Proxy(obj, handler), options);
}
function run_test() {
let timer = Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer);
test_twice(timer, {
method: "init",
constant: "TYPE_ONE_SHOT",
attribute: "callback"
});
let principal = Cc["@mozilla.org/nullprincipal;1"].createInstance(Ci.nsIPrincipal);
test_twice(principal, {});
test_twice(Object.getPrototypeOf(principal), {
method: "subsumes",
constant: "APP_STATUS_INSTALLED",
attribute: "origin"
});
// Test a tearoff object.
Components.manager.autoRegister(do_get_file('../components/js/xpctest.manifest'));
let b = Cc["@mozilla.org/js/xpc/test/js/TestInterfaceAll;1"].createInstance(Ci.nsIXPCTestInterfaceB);
let tearoff = b.nsIXPCTestInterfaceA;
test_twice(tearoff, {
method: "QueryInterface"
});
}

1
js/xpconnect/tests/unit/xpcshell.ini
View file

@ -109,6 +109,5 @@ head = head_watchdog.js
[test_watchdog_hibernate.js] [test_watchdog_hibernate.js]
head = head_watchdog.js head = head_watchdog.js
[test_writeToGlobalPrototype.js] [test_writeToGlobalPrototype.js]
[test_xpcwn_tamperproof.js]
[test_xrayed_iterator.js] [test_xrayed_iterator.js]
[test_xray_SavedFrame.js] [test_xray_SavedFrame.js]

16
js/xpconnect/wrappers/AddonWrapper.cpp
View file

@ -119,24 +119,24 @@ AddonWrapper<Base>::get(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle
template<typename Base> template<typename Base>
bool bool
AddonWrapper<Base>::set(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id, JS::HandleValue v, AddonWrapper<Base>::set(JSContext *cx, JS::HandleObject wrapper, JS::HandleObject receiver,
JS::HandleValue receiver, JS::ObjectOpResult &result) const JS::HandleId id, JS::MutableHandleValue vp,
JS::ObjectOpResult &result) const
{ {
Rooted<JSPropertyDescriptor> desc(cx); Rooted<JSPropertyDescriptor> desc(cx);
if (!Interpose(cx, wrapper, nullptr, id, &desc)) if (!Interpose(cx, wrapper, nullptr, id, &desc))
return false; return false;
if (!desc.object()) if (!desc.object())
return Base::set(cx, wrapper, id, v, receiver, result); return Base::set(cx, wrapper, receiver, id, vp, result);
if (desc.setter()) { if (desc.setter()) {
MOZ_ASSERT(desc.hasSetterObject()); MOZ_ASSERT(desc.hasSetterObject());
JS::AutoValueVector args(cx); JS::AutoValueVector args(cx);
if (!args.append(v)) if (!args.append(vp))
return false; return false;
RootedValue fval(cx, ObjectValue(*desc.setterObject())); RootedValue fval(cx, ObjectValue(*desc.setterObject()));
RootedValue ignored(cx); if (!JS_CallFunctionValue(cx, receiver, fval, args, vp))
if (!JS::Call(cx, receiver, fval, args, &ignored))
return false; return false;
return result.succeed(); return result.succeed();
} }
@ -147,8 +147,8 @@ AddonWrapper<Base>::set(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id
template<typename Base> template<typename Base>
bool bool
AddonWrapper<Base>::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id, AddonWrapper<Base>::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const JS::ObjectOpResult &result) const
{ {
Rooted<JSPropertyDescriptor> interpDesc(cx); Rooted<JSPropertyDescriptor> interpDesc(cx);
if (!Interpose(cx, wrapper, nullptr, id, &interpDesc)) if (!Interpose(cx, wrapper, nullptr, id, &interpDesc))

7
js/xpconnect/wrappers/AddonWrapper.h
View file

@ -28,14 +28,15 @@ class AddonWrapper : public Base {
JS::Handle<jsid> id, JS::Handle<jsid> id,
JS::MutableHandle<JSPropertyDescriptor> desc) const override; JS::MutableHandle<JSPropertyDescriptor> desc) const override;
virtual bool defineProperty(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, virtual bool defineProperty(JSContext *cx, JS::HandleObject proxy, JS::HandleId id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
virtual bool delete_(JSContext *cx, JS::HandleObject proxy, JS::HandleId id, virtual bool delete_(JSContext *cx, JS::HandleObject proxy, JS::HandleId id,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
virtual bool get(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<JSObject*> receiver, virtual bool get(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<JSObject*> receiver,
JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp) const override; JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp) const override;
virtual bool set(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id, JS::HandleValue v, virtual bool set(JSContext *cx, JS::HandleObject wrapper, JS::HandleObject receiver,
JS::HandleValue receiver, JS::ObjectOpResult &result) const override; JS::HandleId id, JS::MutableHandleValue vp,
JS::ObjectOpResult &result) const override;
virtual bool getPropertyDescriptor(JSContext *cx, JS::Handle<JSObject*> wrapper, virtual bool getPropertyDescriptor(JSContext *cx, JS::Handle<JSObject*> wrapper,
JS::Handle<jsid> id, JS::Handle<jsid> id,

11
js/xpconnect/wrappers/ChromeObjectWrapper.cpp
View file

@ -21,7 +21,7 @@ const ChromeObjectWrapper ChromeObjectWrapper::singleton;
bool bool
ChromeObjectWrapper::defineProperty(JSContext *cx, HandleObject wrapper, ChromeObjectWrapper::defineProperty(JSContext *cx, HandleObject wrapper,
HandleId id, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result) const JS::ObjectOpResult &result) const
{ {
if (!AccessCheck::checkPassToPrivilegedCode(cx, wrapper, desc.value())) if (!AccessCheck::checkPassToPrivilegedCode(cx, wrapper, desc.value()))
@ -30,12 +30,13 @@ ChromeObjectWrapper::defineProperty(JSContext *cx, HandleObject wrapper,
} }
bool bool
ChromeObjectWrapper::set(JSContext *cx, HandleObject wrapper, HandleId id, HandleValue v, ChromeObjectWrapper::set(JSContext *cx, HandleObject wrapper,
HandleValue receiver, ObjectOpResult &result) const HandleObject receiver, HandleId id,
MutableHandleValue vp, ObjectOpResult &result) const
{ {
if (!AccessCheck::checkPassToPrivilegedCode(cx, wrapper, v)) if (!AccessCheck::checkPassToPrivilegedCode(cx, wrapper, vp))
return false; return false;
return ChromeObjectWrapperBase::set(cx, wrapper, id, v, receiver, result); return ChromeObjectWrapperBase::set(cx, wrapper, receiver, id, vp, result);
} }
} }

7
js/xpconnect/wrappers/ChromeObjectWrapper.h
View file

@ -29,10 +29,11 @@ class ChromeObjectWrapper : public ChromeObjectWrapperBase
virtual bool defineProperty(JSContext *cx, JS::Handle<JSObject*> wrapper, virtual bool defineProperty(JSContext *cx, JS::Handle<JSObject*> wrapper,
JS::Handle<jsid> id, JS::Handle<jsid> id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
virtual bool set(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id, virtual bool set(JSContext *cx, JS::Handle<JSObject*> wrapper,
JS::HandleValue v, JS::HandleValue receiver, JS::Handle<JSObject*> receiver, JS::Handle<jsid> id,
JS::MutableHandle<JS::Value> vp,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
static const ChromeObjectWrapper singleton; static const ChromeObjectWrapper singleton;

2
js/xpconnect/wrappers/FilteringWrapper.cpp
View file

@ -234,7 +234,7 @@ CrossOriginXrayWrapper::ownPropertyKeys(JSContext *cx, JS::Handle<JSObject*> wra
bool bool
CrossOriginXrayWrapper::defineProperty(JSContext *cx, JS::Handle<JSObject*> wrapper, CrossOriginXrayWrapper::defineProperty(JSContext *cx, JS::Handle<JSObject*> wrapper,
JS::Handle<jsid> id, JS::Handle<jsid> id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result) const JS::ObjectOpResult &result) const
{ {
JS_ReportError(cx, "Permission denied to define property on cross-origin object"); JS_ReportError(cx, "Permission denied to define property on cross-origin object");

2
js/xpconnect/wrappers/FilteringWrapper.h
View file

@ -73,7 +73,7 @@ class CrossOriginXrayWrapper : public SecurityXrayDOM {
JS::MutableHandle<JSPropertyDescriptor> desc) const override; JS::MutableHandle<JSPropertyDescriptor> desc) const override;
virtual bool defineProperty(JSContext *cx, JS::Handle<JSObject*> wrapper, virtual bool defineProperty(JSContext *cx, JS::Handle<JSObject*> wrapper,
JS::Handle<jsid> id, JS::Handle<jsid> id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
virtual bool ownPropertyKeys(JSContext *cx, JS::Handle<JSObject*> wrapper, virtual bool ownPropertyKeys(JSContext *cx, JS::Handle<JSObject*> wrapper,
JS::AutoIdVector &props) const override; JS::AutoIdVector &props) const override;

23
js/xpconnect/wrappers/XrayWrapper.cpp
View file

@ -593,7 +593,7 @@ JSXrayTraits::delete_(JSContext *cx, HandleObject wrapper, HandleId id, ObjectOp
bool bool
JSXrayTraits::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id, JSXrayTraits::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
Handle<JSPropertyDescriptor> existingDesc, Handle<JSPropertyDescriptor> existingDesc,
ObjectOpResult &result, ObjectOpResult &result,
bool *defined) bool *defined)
@ -637,10 +637,9 @@ JSXrayTraits::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
return false; return false;
} }
Rooted<JSPropertyDescriptor> wrappedDesc(cx, desc);
JSAutoCompartment ac(cx, target); JSAutoCompartment ac(cx, target);
if (!JS_WrapPropertyDescriptor(cx, &wrappedDesc) || if (!JS_WrapPropertyDescriptor(cx, desc) ||
!JS_DefinePropertyById(cx, target, id, wrappedDesc, result)) !JS_DefinePropertyById(cx, target, id, desc, result))
{ {
return false; return false;
} }
@ -1416,7 +1415,7 @@ XPCWrappedNativeXrayTraits::resolveOwnProperty(JSContext *cx, const Wrapper &jsW
bool bool
XPCWrappedNativeXrayTraits::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id, XPCWrappedNativeXrayTraits::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
Handle<JSPropertyDescriptor> existingDesc, Handle<JSPropertyDescriptor> existingDesc,
JS::ObjectOpResult &result, bool *defined) JS::ObjectOpResult &result, bool *defined)
{ {
@ -1577,7 +1576,7 @@ DOMXrayTraits::resolveOwnProperty(JSContext *cx, const Wrapper &jsWrapper, Handl
bool bool
DOMXrayTraits::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id, DOMXrayTraits::defineProperty(JSContext *cx, HandleObject wrapper, HandleId id,
Handle<JSPropertyDescriptor> desc, MutableHandle<JSPropertyDescriptor> desc,
Handle<JSPropertyDescriptor> existingDesc, Handle<JSPropertyDescriptor> existingDesc,
JS::ObjectOpResult &result, bool *defined) JS::ObjectOpResult &result, bool *defined)
{ {
@ -1931,7 +1930,7 @@ XrayWrapper<Base, Traits>::getOwnPropertyDescriptor(JSContext *cx, HandleObject
// to the content object. This is ok, because the the expando object is only // to the content object. This is ok, because the the expando object is only
// ever accessed by code across the compartment boundary. // ever accessed by code across the compartment boundary.
static bool static bool
RecreateLostWaivers(JSContext *cx, const JSPropertyDescriptor *orig, RecreateLostWaivers(JSContext *cx, JSPropertyDescriptor *orig,
MutableHandle<JSPropertyDescriptor> wrapped) MutableHandle<JSPropertyDescriptor> wrapped)
{ {
// Compute whether the original objects were waived, and implicitly, whether // Compute whether the original objects were waived, and implicitly, whether
@ -1976,7 +1975,7 @@ RecreateLostWaivers(JSContext *cx, const JSPropertyDescriptor *orig,
template <typename Base, typename Traits> template <typename Base, typename Traits>
bool bool
XrayWrapper<Base, Traits>::defineProperty(JSContext *cx, HandleObject wrapper, XrayWrapper<Base, Traits>::defineProperty(JSContext *cx, HandleObject wrapper,
HandleId id, Handle<JSPropertyDescriptor> desc, HandleId id, MutableHandle<JSPropertyDescriptor> desc,
ObjectOpResult &result) const ObjectOpResult &result) const
{ {
assertEnteredPolicy(cx, wrapper, id, BaseProxyHandler::SET); assertEnteredPolicy(cx, wrapper, id, BaseProxyHandler::SET);
@ -2081,15 +2080,15 @@ XrayWrapper<Base, Traits>::get(JSContext *cx, HandleObject wrapper,
template <typename Base, typename Traits> template <typename Base, typename Traits>
bool bool
XrayWrapper<Base, Traits>::set(JSContext *cx, HandleObject wrapper, HandleId id, HandleValue v, XrayWrapper<Base, Traits>::set(JSContext *cx, HandleObject wrapper,
HandleValue receiver, ObjectOpResult &result) const HandleObject receiver, HandleId id,
MutableHandleValue vp, ObjectOpResult &result) const
{ {
MOZ_ASSERT(!Traits::HasPrototype); MOZ_ASSERT(!Traits::HasPrototype);
// Skip our Base if it isn't already BaseProxyHandler. // Skip our Base if it isn't already BaseProxyHandler.
// NB: None of the functions we call are prepared for the receiver not // NB: None of the functions we call are prepared for the receiver not
// being the wrapper, so ignore the receiver here. // being the wrapper, so ignore the receiver here.
RootedValue wrapperValue(cx, ObjectValue(*wrapper)); return js::BaseProxyHandler::set(cx, wrapper, wrapper, id, vp, result);
return js::BaseProxyHandler::set(cx, wrapper, id, v, wrapperValue, result);
} }
template <typename Base, typename Traits> template <typename Base, typename Traits>

18
js/xpconnect/wrappers/XrayWrapper.h
View file

@ -133,7 +133,7 @@ public:
JS::HandleObject holder, JS::HandleId id, JS::HandleObject holder, JS::HandleId id,
JS::MutableHandle<JSPropertyDescriptor> desc) override; JS::MutableHandle<JSPropertyDescriptor> desc) override;
bool defineProperty(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id, bool defineProperty(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::Handle<JSPropertyDescriptor> existingDesc, JS::Handle<JSPropertyDescriptor> existingDesc,
JS::ObjectOpResult &result, bool *defined); JS::ObjectOpResult &result, bool *defined);
virtual bool enumerateNames(JSContext *cx, JS::HandleObject wrapper, unsigned flags, virtual bool enumerateNames(JSContext *cx, JS::HandleObject wrapper, unsigned flags,
@ -185,7 +185,7 @@ public:
JS::HandleObject holder, JS::HandleId id, JS::HandleObject holder, JS::HandleId id,
JS::MutableHandle<JSPropertyDescriptor> desc) override; JS::MutableHandle<JSPropertyDescriptor> desc) override;
bool defineProperty(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id, bool defineProperty(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::Handle<JSPropertyDescriptor> existingDesc, JS::Handle<JSPropertyDescriptor> existingDesc,
JS::ObjectOpResult &result, bool *defined); JS::ObjectOpResult &result, bool *defined);
virtual bool enumerateNames(JSContext *cx, JS::HandleObject wrapper, unsigned flags, virtual bool enumerateNames(JSContext *cx, JS::HandleObject wrapper, unsigned flags,
@ -228,7 +228,7 @@ public:
bool delete_(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id, JS::ObjectOpResult &result); bool delete_(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id, JS::ObjectOpResult &result);
bool defineProperty(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id, bool defineProperty(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::Handle<JSPropertyDescriptor> existingDesc, JS::Handle<JSPropertyDescriptor> existingDesc,
JS::ObjectOpResult &result, bool *defined); JS::ObjectOpResult &result, bool *defined);
@ -346,7 +346,7 @@ public:
JS::MutableHandle<JSPropertyDescriptor> desc) override; JS::MutableHandle<JSPropertyDescriptor> desc) override;
bool defineProperty(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id, bool defineProperty(JSContext *cx, JS::HandleObject wrapper, JS::HandleId id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::Handle<JSPropertyDescriptor> existingDesc, JS::Handle<JSPropertyDescriptor> existingDesc,
JS::ObjectOpResult &result, bool *defined) JS::ObjectOpResult &result, bool *defined)
{ {
@ -420,7 +420,7 @@ class XrayWrapper : public Base {
virtual bool getOwnPropertyDescriptor(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<jsid> id, virtual bool getOwnPropertyDescriptor(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<jsid> id,
JS::MutableHandle<JSPropertyDescriptor> desc) const override; JS::MutableHandle<JSPropertyDescriptor> desc) const override;
virtual bool defineProperty(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<jsid> id, virtual bool defineProperty(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<jsid> id,
JS::Handle<JSPropertyDescriptor> desc, JS::MutableHandle<JSPropertyDescriptor> desc,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
virtual bool ownPropertyKeys(JSContext *cx, JS::Handle<JSObject*> wrapper, virtual bool ownPropertyKeys(JSContext *cx, JS::Handle<JSObject*> wrapper,
JS::AutoIdVector &props) const override; JS::AutoIdVector &props) const override;
@ -441,8 +441,8 @@ class XrayWrapper : public Base {
bool *bp) const override; bool *bp) const override;
virtual bool get(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<JSObject*> receiver, virtual bool get(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<JSObject*> receiver,
JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp) const override; JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp) const override;
virtual bool set(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<jsid> id, virtual bool set(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<JSObject*> receiver,
JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
virtual bool call(JSContext *cx, JS::Handle<JSObject*> wrapper, virtual bool call(JSContext *cx, JS::Handle<JSObject*> wrapper,
const JS::CallArgs &args) const override; const JS::CallArgs &args) const override;
@ -515,8 +515,8 @@ public:
bool *bp) const override; bool *bp) const override;
virtual bool get(JSContext *cx, JS::Handle<JSObject*> proxy, JS::Handle<JSObject*> receiver, virtual bool get(JSContext *cx, JS::Handle<JSObject*> proxy, JS::Handle<JSObject*> receiver,
JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp) const override; JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp) const override;
virtual bool set(JSContext *cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id, virtual bool set(JSContext *cx, JS::Handle<JSObject*> proxy, JS::Handle<JSObject*> receiver,
JS::Handle<JS::Value> v, JS::Handle<JS::Value> receiver, JS::Handle<jsid> id, JS::MutableHandle<JS::Value> vp,
JS::ObjectOpResult &result) const override; JS::ObjectOpResult &result) const override;
virtual bool getPropertyDescriptor(JSContext *cx, JS::Handle<JSObject*> proxy, virtual bool getPropertyDescriptor(JSContext *cx, JS::Handle<JSObject*> proxy,