Bug 1415591: Consider the result of HasProperty as a cx failure in wasm::GetLimits; r=luke
authorBenjamin Bouvier <benj@benj.me>
Wed, 08 Nov 2017 19:57:35 +0100
changeset 390901 6b85d55a5c1857577bc501a1e870f4cdbb3aeac0
parent 390900 0f4264c818570755b5b2f9d4005315f2a7fc01be
child 390902 47fcf4a498b83104af19a8a930b7590f05156ecc
push id55050
push userbbouvier@mozilla.com
push dateThu, 09 Nov 2017 09:21:37 +0000
treeherderautoland@6b85d55a5c18 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersluke
bugs1415591
milestone58.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1415591: Consider the result of HasProperty as a cx failure in wasm::GetLimits; r=luke MozReview-Commit-ID: 67pAAdM50xH
js/src/jit-test/tests/wasm/regress/proxy-has-trap-table.js
js/src/wasm/WasmJS.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/proxy-has-trap-table.js
@@ -0,0 +1,10 @@
+assertErrorMessage(() => {
+    var desc = {
+        element: "anyfunc",
+    };
+    var proxy = new Proxy({}, {
+        has: true
+    });
+    Object.setPrototypeOf(desc, proxy);
+    let table = new WebAssembly.Table(desc);
+}, TypeError, /proxy handler's has trap/);
--- a/js/src/wasm/WasmJS.cpp
+++ b/js/src/wasm/WasmJS.cpp
@@ -449,17 +449,20 @@ GetLimits(JSContext* cx, HandleObject ob
         return false;
 
     JSAtom* maximumAtom = Atomize(cx, "maximum", strlen("maximum"));
     if (!maximumAtom)
         return false;
     RootedId maximumId(cx, AtomToId(maximumAtom));
 
     bool found;
-    if (HasProperty(cx, obj, maximumId, &found) && found) {
+    if (!HasProperty(cx, obj, maximumId, &found))
+        return false;
+
+    if (found) {
         RootedValue maxVal(cx);
         if (!GetProperty(cx, obj, obj, maximumId, &maxVal))
             return false;
 
         limits->maximum.emplace();
         if (!ToNonWrappingUint32(cx, maxVal, maxMaximum, kind, "maximum size", limits->maximum.ptr()))
             return false;