Bug 1415591: Consider the result of HasProperty as a cx failure in wasm::GetLimits; r?luke draft
authorBenjamin Bouvier <benj@benj.me>
Wed, 08 Nov 2017 19:57:35 +0100
changeset 695093 7c5282d46f60a495d9aa3ae5d87ab7d46783690a
parent 694280 0d5c2d176a454b25ee8aa893165d9e95f1d63f92
child 739521 ed9e3652ceb8cc86b4dbcfe70388855b9f2323c8
push id88339
push userbbouvier@mozilla.com
push dateWed, 08 Nov 2017 18:58:02 +0000
reviewersluke
bugs1415591
milestone58.0a1
Bug 1415591: Consider the result of HasProperty as a cx failure in wasm::GetLimits; r?luke MozReview-Commit-ID: 67pAAdM50xH
js/src/jit-test/tests/wasm/regress/proxy-has-trap-table.js
js/src/wasm/WasmJS.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/proxy-has-trap-table.js
@@ -0,0 +1,10 @@
+assertErrorMessage(() => {
+    var desc = {
+        element: "anyfunc",
+    };
+    var proxy = new Proxy({}, {
+        has: true
+    });
+    Object.setPrototypeOf(desc, proxy);
+    let table = new WebAssembly.Table(desc);
+}, TypeError, /proxy handler's has trap/);
--- a/js/src/wasm/WasmJS.cpp
+++ b/js/src/wasm/WasmJS.cpp
@@ -449,17 +449,20 @@ GetLimits(JSContext* cx, HandleObject ob
         return false;
 
     JSAtom* maximumAtom = Atomize(cx, "maximum", strlen("maximum"));
     if (!maximumAtom)
         return false;
     RootedId maximumId(cx, AtomToId(maximumAtom));
 
     bool found;
-    if (HasProperty(cx, obj, maximumId, &found) && found) {
+    if (!HasProperty(cx, obj, maximumId, &found))
+        return false;
+
+    if (found) {
         RootedValue maxVal(cx);
         if (!GetProperty(cx, obj, obj, maximumId, &maxVal))
             return false;
 
         limits->maximum.emplace();
         if (!ToNonWrappingUint32(cx, maxVal, maxMaximum, kind, "maximum size", limits->maximum.ptr()))
             return false;