Bug 930974 - Check IsObject() and not just ObjectIsHandle() r=till
authorNicholas D. Matsakis <nmatsakis@mozilla.com>
Tue, 19 Nov 2013 11:03:26 -0500
changeset 156398 28ed31db6d984ca2414edf40b4931613b3f150fa
parent 156397 fe616b87fefe1c6c6247a731d634279407954ffe
child 156399 2ea9176d5e7e800f84275d37999f29267b2197ed
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewerstill
bugs930974
milestone28.0a1
Bug 930974 - Check IsObject() and not just ObjectIsHandle() r=till
js/src/builtin/TypedObject.js
--- a/js/src/builtin/TypedObject.js
+++ b/js/src/builtin/TypedObject.js
@@ -488,38 +488,38 @@ function TypedArrayRedimension(newArrayT
 // Note: these methods are directly invokable by users and so must be
 // defensive.
 
 // This is the `handle([obj, [...path]])` method on type objects.
 // User exposed!
 //
 // FIXME bug 929656 -- label algorithms with steps from the spec
 function HandleCreate(obj, ...path) {
-  if (!ObjectIsTypeObject(this))
+  if (!IsObject(this) || !ObjectIsTypeObject(this))
     ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Type", "handle", "value");
 
   var handle = NewTypedHandle(this);
 
   if (obj !== undefined)
     HandleMoveInternal(handle, obj, path)
 
   return handle;
 }
 
 // Handle.move: user exposed!
 // FIXME bug 929656 -- label algorithms with steps from the spec
 function HandleMove(handle, obj, ...path) {
-  if (!ObjectIsTypedHandle(handle))
+  if (!IsObject(handle) || !ObjectIsTypedHandle(handle))
     ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Handle", "set", typeof value);
 
   HandleMoveInternal(handle, obj, path);
 }
 
 function HandleMoveInternal(handle, obj, path) {
-  assert(ObjectIsTypedHandle(handle),
+  assert(IsObject(handle) && ObjectIsTypedHandle(handle),
          "HandleMoveInternal: not typed handle");
 
   if (!IsObject(obj) || !ObjectIsTypedDatum(obj))
     ThrowError(JSMSG_INCOMPATIBLE_PROTO, "Handle", "set", "value");
 
   var ptr = TypedObjectPointer.fromTypedDatum(obj);
   for (var i = 0; i < path.length; i++)
     ptr.moveTo(path[i]);
@@ -562,16 +562,18 @@ function HandleSet(handle, value) {
 function HandleTest(obj) {
   return IsObject(obj) && ObjectIsTypedHandle(obj);
 }
 
 ///////////////////////////////////////////////////////////////////////////
 // Miscellaneous
 
 function ObjectIsTypedDatum(obj) {
+  assert(IsObject(obj), "ObjectIsTypedDatum invoked with non-object")
   return ObjectIsTypedObject(obj) || ObjectIsTypedHandle(obj);
 }
 
 function ObjectIsAttached(obj) {
+  assert(IsObject(obj), "ObjectIsAttached invoked with non-object")
   assert(ObjectIsTypedDatum(obj),
          "ObjectIsAttached() invoked on invalid obj");
   return DATUM_OWNER(obj) != null;
 }