Bug 1252912 - Ensure that we wrap the results of the shortestPaths JS shell testing function. r=jimb
authorNick Fitzgerald <fitzgen@gmail.com>
Wed, 02 Mar 2016 13:16:00 -0500
changeset 323015 d03e7f7a6f85f718c70253c5c9d2879756e2ab09
parent 323014 dc9c310332818b6cfc82efd39eb642637c5a1a61
child 323016 185b5f9f98f5bf27e06d79d99c0e26225ba8791b
push id5913
push userjlund@mozilla.com
push dateMon, 25 Apr 2016 16:57:49 +0000
treeherdermozilla-beta@dcaf0a6fa115 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjimb
bugs1252912
milestone47.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1252912 - Ensure that we wrap the results of the shortestPaths JS shell testing function. r=jimb
js/src/builtin/TestingFunctions.cpp
js/src/jit-test/tests/heap-analysis/bug-1252912.js
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -2771,18 +2771,21 @@ ShortestPaths(JSContext* cx, unsigned ar
             path->ensureDenseInitializedLength(cx, 0, pathLength);
 
             for (size_t k = 0; k < pathLength; k++) {
                 RootedPlainObject part(cx, NewBuiltinClassInstance<PlainObject>(cx));
                 if (!part)
                     return false;
 
                 RootedValue predecessor(cx, values[i][j][k]);
-                if (!JS_DefineProperty(cx, part, "predecessor", predecessor, JSPROP_ENUMERATE))
+                if (!cx->compartment()->wrap(cx, &predecessor) ||
+                    !JS_DefineProperty(cx, part, "predecessor", predecessor, JSPROP_ENUMERATE))
+                {
                     return false;
+                }
 
                 if (names[i][j][k]) {
                     RootedString edge(cx, NewStringCopyZ<CanGC>(cx, names[i][j][k].get()));
                     if (!edge || !JS_DefineProperty(cx, part, "edge", edge, JSPROP_ENUMERATE))
                         return false;
                 }
 
                 path->setDenseElement(k, ObjectValue(*part));
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/heap-analysis/bug-1252912.js
@@ -0,0 +1,6 @@
+try {
+  x = evalcx('')
+  toSource = (function() {
+  })
+} catch (foo) {}
+shortestPaths(this, ["$4"], 5)