author | Tom Schuster <evilpies@gmail.com> |
Thu, 23 Feb 2017 15:26:49 +0100 | |
changeset 344591 | d439fa74bf059fec9e32547d80b726a711d6f4ee |
parent 344590 | 7d15bc99dbf1f1c06e38379ca6bcd4289c9ea021 |
child 344592 | c20304c7dd0bc18f307d578969e8722900604541 |
push id | 31414 |
push user | cbook@mozilla.com |
push date | Fri, 24 Feb 2017 10:47:41 +0000 |
treeherder | mozilla-central@be661bae6cb9 [default view] [failures only] |
perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
reviewers | jandem |
bugs | 1319087 |
milestone | 54.0a1 |
first release with | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
js/src/jit-test/tests/cacheir/nukedCCW.js | file | annotate | diff | comparison | revisions | |
js/src/shell/js.cpp | file | annotate | diff | comparison | revisions |
new file mode 100644 --- /dev/null +++ b/js/src/jit-test/tests/cacheir/nukedCCW.js @@ -0,0 +1,23 @@ +var wrapper = evaluate("({a: 15, b: {c: 42}})", {global: newGlobal({sameZoneAs: this})}); + +function test() { + var i, error; + try { + for (i = 0; i < 150; i++) { + assertEq(wrapper.b.c, 42); + assertEq(wrapper.a, 15); + + if (i == 142) { + // Next access to wrapper.b should throw. + nukeCCW(wrapper); + } + } + } catch (e) { + error = e; + } + + assertEq(error.message.includes("dead object"), true); + assertEq(i, 143); +} + +test();
--- a/js/src/shell/js.cpp +++ b/js/src/shell/js.cpp @@ -5033,16 +5033,34 @@ NewGlobal(JSContext* cx, unsigned argc, if (!JS_WrapObject(cx, &global)) return false; args.rval().setObject(*global); return true; } static bool +NukeCCW(JSContext* cx, unsigned argc, Value* vp) +{ + CallArgs args = CallArgsFromVp(argc, vp); + + if (args.length() != 1 || !args[0].isObject() || + !IsCrossCompartmentWrapper(&args[0].toObject())) + { + JS_ReportErrorNumberASCII(cx, my_GetErrorMessage, nullptr, JSSMSG_INVALID_ARGS, + "nukeCCW"); + return false; + } + + NukeCrossCompartmentWrapper(cx, &args[0].toObject()); + args.rval().setUndefined(); + return true; +} + +static bool GetMaxArgs(JSContext* cx, unsigned argc, Value* vp) { CallArgs args = CallArgsFromVp(argc, vp); args.rval().setInt32(ARGS_LENGTH_MAX); return true; } static bool @@ -6361,16 +6379,20 @@ static const JSFunctionSpecWithHelp shel " integer that fits in 32 bits; use that as the new compartment's\n" " principal. Shell principals are toys, meant only for testing; one\n" " shell principal subsumes another if its set bits are a superset of\n" " the other's. Thus, a principal of 0 subsumes nothing, while a\n" " principals of ~0 subsumes all other principals. The absence of a\n" " principal is treated as if its bits were 0xffff, for subsumption\n" " purposes. If this property is omitted, supply no principal."), + JS_FN_HELP("nukeCCW", NukeCCW, 1, 0, +"nukeCCW(wrapper)", +" Nuke a CrossCompartmentWrapper, which turns it into a DeadProxyObject."), + JS_FN_HELP("createMappedArrayBuffer", CreateMappedArrayBuffer, 1, 0, "createMappedArrayBuffer(filename, [offset, [size]])", " Create an array buffer that mmaps the given file."), JS_FN_HELP("addPromiseReactions", AddPromiseReactions, 3, 0, "addPromiseReactions(promise, onResolve, onReject)", " Calls the JS::AddPromiseReactions JSAPI function with the given arguments."),