Bug 1526318: Assert the JSPropertySpec in XrayResolveAttribute has a native accessor function. r=bz
authorAndré Bargull <andre.bargull@gmail.com>
Fri, 08 Feb 2019 07:06:42 -0800
changeset 516491 6995ea68c9085ac3eebe19c1c9a2f15de6194ca7
parent 516490 3f871b09d7c1e91740b907dd815315d769bf86cd
child 516492 c16e260f73e654f2061e3b69dbcfa9fa647c5696
push id10862
push userffxbld-merge
push dateMon, 11 Mar 2019 13:01:11 +0000
treeherdermozilla-beta@a2e7f5c935da [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs1526318
milestone67.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1526318: Assert the JSPropertySpec in XrayResolveAttribute has a native accessor function. r=bz
dom/bindings/BindingUtils.cpp
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -1398,16 +1398,22 @@ static bool XrayResolveAttribute(JSConte
                                  const Prefable<const JSPropertySpec>& pref,
                                  const JSPropertySpec& attrSpec,
                                  JS::MutableHandle<JS::PropertyDescriptor> desc,
                                  bool& cacheOnHolder) {
   if (!pref.isEnabled(cx, obj)) {
     return true;
   }
 
+  MOZ_ASSERT(attrSpec.isAccessor(),
+             "Bad JSPropertySpec declaration: not an accessor property");
+  MOZ_ASSERT(
+      !attrSpec.isSelfHosted(),
+      "Bad JSPropertySpec declaration: unsupported self-hosted accessor");
+
   cacheOnHolder = true;
 
   // Because of centralization, we need to make sure we fault in the JitInfos as
   // well. At present, until the JSAPI changes, the easiest way to do this is
   // wrap them up as functions ourselves.
   desc.setAttributes(attrSpec.flags);
   // They all have getters, so we can just make it.
   JS::Rooted<JSObject*> funobj(