From d8510baa29ebff55040ac684c357c65ba0748d64 Mon Sep 17 00:00:00 2001 From: Connor Brewster Date: Thu, 8 Jun 2017 23:37:56 -0600 Subject: [PATCH] Unwrap function before calling IsConstructor IsConstructor returns true for all wrappers that are callable. Wrapped arrow functions are callable and thus IsConstructor will return true if given one; however, if we unwrap the arrow function, IsConstructor will return false. The latter is the correct behavior here. --- components/script/dom/customelementregistry.rs | 11 ++++++++++- .../custom-element-registry/define.html.ini | 5 ----- 2 files changed, 10 insertions(+), 6 deletions(-) delete mode 100644 tests/wpt/metadata/custom-elements/custom-element-registry/define.html.ini diff --git a/components/script/dom/customelementregistry.rs b/components/script/dom/customelementregistry.rs index 89296884080..0ae311b29b3 100644 --- a/components/script/dom/customelementregistry.rs +++ b/components/script/dom/customelementregistry.rs @@ -26,6 +26,7 @@ use dom::window::Window; use dom_struct::dom_struct; use html5ever::{LocalName, Namespace, Prefix}; use js::conversions::ToJSValConvertible; +use js::glue::UnwrapObject; use js::jsapi::{Construct1, IsCallable, IsConstructor, HandleValueArray, HandleObject, MutableHandleValue}; use js::jsapi::{Heap, JS_GetProperty, JSAutoCompartment, JSContext}; use js::jsval::{JSVal, NullValue, ObjectValue, UndefinedValue}; @@ -193,7 +194,15 @@ impl CustomElementRegistryMethods for CustomElementRegistry { let name = LocalName::from(&*name); // Step 1 - if unsafe { !IsConstructor(constructor.get()) } { + // We must unwrap the constructor as all wrappers are constructable if they are callable. + rooted!(in(cx) let unwrapped_constructor = unsafe { UnwrapObject(constructor.get(), 1) }); + + if unwrapped_constructor.is_null() { + // We do not have permission to access the unwrapped constructor. + return Err(Error::Security); + } + + if unsafe { !IsConstructor(unwrapped_constructor.get()) } { return Err(Error::Type("Second argument of CustomElementRegistry.define is not a constructor".to_owned())); } diff --git a/tests/wpt/metadata/custom-elements/custom-element-registry/define.html.ini b/tests/wpt/metadata/custom-elements/custom-element-registry/define.html.ini deleted file mode 100644 index 14558fa24b2..00000000000 --- a/tests/wpt/metadata/custom-elements/custom-element-registry/define.html.ini +++ /dev/null @@ -1,5 +0,0 @@ -[define.html] - type: testharness - [If constructor is arrow function, should throw a TypeError] - expected: FAIL -