Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-07-24 15:50:21 +01:00
Code Issues Projects Releases Packages Wiki Activity

script: Properly throw when "this" is not an object in a generic call.

Browse source
This commit is contained in:
Emilio Cobos Álvarez 2017-09-17 08:01:35 +02:00
parent 5281fc1a44
commit 91f238f326
No known key found for this signature in database
GPG key ID: 056B727BB9C1027C
3 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
components/script/dom/bindings/utils.rs
View file

@ -414,18 +414,22 @@ unsafe fn generic_call(cx: *mut JSContext,
-> bool)
-> bool {
let args = CallArgs::from_vp(vp, argc);
let info = RUST_FUNCTION_VALUE_TO_JITINFO(JS_CALLEE(cx, vp));
let proto_id = (*info).protoID;
let thisobj = args.thisv();
if !thisobj.get().is_null_or_undefined() && !thisobj.get().is_object() {
throw_invalid_this(cx, proto_id);
return false;
}
let obj = if thisobj.get().is_object() {
thisobj.get().to_object()
} else {
GetGlobalForObjectCrossCompartment(JS_CALLEE(cx, vp).to_object_or_null())
};
rooted!(in(cx) let obj = obj);
let info = RUST_FUNCTION_VALUE_TO_JITINFO(JS_CALLEE(cx, vp));
let proto_id = (*info).protoID;
let depth = (*info).depth;
let proto_check = |class: &'static DOMClass| {
class.interface_chain[depth as usize] as u16 == proto_id

10
tests/wpt/mozilla/meta/MANIFEST.json
View file

@ -14739,6 +14739,12 @@
{}
]
],
"mozilla/invalid-this.html": [
[
"/_mozilla/mozilla/invalid-this.html",
{}
]
],
"mozilla/iterable.html": [
[
"/_mozilla/mozilla/iterable.html",
@ -28074,6 +28080,10 @@
"c9dcc4f24540914b3be1ef18f13b721773eb76be",
"testharness"
],
"mozilla/invalid-this.html": [
"4ed18511e6399b356fe196b92f72dd16a9019f55",
"testharness"
],
"mozilla/iterable.html": [
"66f05b1f12b8be392705f5ba4a96c70b9226721d",
"testharness"

13
tests/wpt/mozilla/tests/mozilla/invalid-this.html Normal file
View file

@ -0,0 +1,13 @@
<!doctype html>
<meta charset="utf-8">
<title>Test for #18535: Wrong type arguments to some JS functions abort the execution of the script.</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script>
test(function() {
assert_throws(new TypeError(), function() { window.atob.call("", localStorage); })
assert_throws(new TypeError(), function() { window.removeEventListener.call("", ""); })
assert_throws(new TypeError(), function() { window.alert.call(""); })
assert_throws(new TypeError(), function() { window.moveTo.call(128); })
})
</script>