Bug 1496892 - Check script compartment instead of realm in TypeScript::SetArgument. r=luke
We can call this for a cross-realm script when defining a property on an arguments object.
Differential Revision:
https://phabricator.services.mozilla.com/D9226
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/realms/bug1496892.js
@@ -0,0 +1,4 @@
+(function(a) {
+ var g = newGlobal({sameCompartmentAs: this});
+ g.Object.defineProperty(arguments, "0", {value: g});
+})(0);
--- a/js/src/vm/TypeInference-inl.h
+++ b/js/src/vm/TypeInference-inl.h
@@ -854,17 +854,17 @@ TypeScript::SetThis(JSContext* cx, JSScr
TypeScript::SetThis(JSContext* cx, JSScript* script, const js::Value& value)
{
SetThis(cx, script, TypeSet::GetValueType(value));
}
/* static */ inline void
TypeScript::SetArgument(JSContext* cx, JSScript* script, unsigned arg, TypeSet::Type type)
{
- cx->check(script, type);
+ cx->check(script->compartment(), type);
AutoSweepTypeScript sweep(script);
StackTypeSet* types = ArgTypes(script, arg);
if (!types) {
return;
}
if (!types->hasType(type)) {