Bug 588251 - fun.caller should throw if that value corresponds to a strict mode function. r=sayrer

js/src/js.msg

@@ -335,3 +335,4 @@ MSG_DEF(JSMSG_THROW_TYPE_ERROR,       252, 0, JSEXN_TYPEERR, "'caller', 'callee'
 MSG_DEF(JSMSG_BAD_TOISOSTRING_PROP,   253, 0, JSEXN_TYPEERR, "toISOString property is not callable")
 MSG_DEF(JSMSG_BAD_PARSE_NODE,         254, 0, JSEXN_INTERNALERR, "bad parse node")
 MSG_DEF(JSMSG_NOT_EXPECTED_TYPE,      255, 3, JSEXN_TYPEERR, "{0}: expected {1}, got {2}")
+MSG_DEF(JSMSG_CALLER_IS_STRICT,       256, 0, JSEXN_TYPEERR, "access to strict mode caller function is censored")

js/src/jsfun.cpp

@@ -1671,9 +1671,16 @@ fun_getProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp)
             return false;
 
         if (vp->isObject()) {
+            JSObject &caller = vp->toObject();
+
             /* Censor the caller if it is from another compartment. */
-            if (vp->toObject().getCompartment(cx) != cx->compartment)
+            if (caller.getCompartment(cx) != cx->compartment) {
                 vp->setNull();
+            } else if (caller.isFunction() && caller.getFunctionPrivate()->inStrictMode()) {
+                JS_ReportErrorFlagsAndNumber(cx, JSREPORT_ERROR, js_GetErrorMessage, NULL,
+                                             JSMSG_CALLER_IS_STRICT);
+                return false;
+            }
         }
         break;
 

js/src/tests/js1_8_5/extensions/censor-strict-caller.js

@@ -0,0 +1,34 @@
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 588251;
+var summary =
+  "fun.caller should throw if that value corresponds to a strict mode " +
+  "function";
+
+print(BUGNUMBER + ": " + summary);
+
+/**************
+ * BEGIN TEST *
+ **************/
+
+function nonstrict() { return nonstrict.caller; }
+function strict() { "use strict"; return nonstrict(); }
+try
+{
+  strict();
+  throw 17;
+}
+catch (e)
+{
+  assertEq(e instanceof TypeError, true,
+           "expected TypeError accessing strict mode caller, got: " + e);
+}
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("All tests passed!");

js/src/tests/js1_8_5/extensions/jstests.list

@@ -14,3 +14,4 @@ script parseInt-octal.js
 script proxy-enumerateOwn-duplicates.js
 skip-if(!xulRuntime.shell) script reflect-parse.js
 script destructure-accessor.js
+script censor-strict-caller.js