wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1021258 - Restore the __proto__ mutation warning for __proto__ sets. r=luke

Browse Source
This commit is contained in:
Bobby Holley 2014-06-06 12:21:36 +01:00
parent 8408dfe163
commit ceedb2c411
3 changed files with 61 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
js/src/builtin/Object.cpp
View File

@ -1063,6 +1063,14 @@ static bool
ProtoSetter(JSContext *cx, unsigned argc, Value *vp)
{
CallArgs args = CallArgsFromVp(argc, vp);
// Do this here, rather than after the this-check so even likely-buggy
// use of the __proto__ setter on unacceptable values, where no subsequent
// use occurs on an acceptable value, will trigger a warning.
RootedObject callee(cx, &args.callee());
if (!GlobalObject::warnOnceAboutPrototypeMutation(cx, callee))
return false;
HandleValue thisv = args.thisv();
if (thisv.isNullOrUndefined()) {
ReportIncompatible(cx, args);

1
js/xpconnect/tests/mochitest/mochitest.ini
View File

@ -91,6 +91,7 @@ support-files =
[test_bug986542.html]
[test_bug993423.html]
[test_bug1005806.html]
[test_bug1021258.html]
[test_crosscompartment_weakmap.html]
[test_frameWrapping.html]
# The JS test component we use below is only available in debug builds.

52
js/xpconnect/tests/mochitest/test_bug1021258.html Normal file
View File

@ -0,0 +1,52 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=1021258
-->
<head>
<meta charset="utf-8">
<title>Test for Bug 1021258</title>
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
<script type="application/javascript">
/** Test for proto mutation warnings. **/
SimpleTest.waitForExplicitFinish();
var gLoads = 0;
function loaded() {
switch (++gLoads) {
case 1:
info("First load");
SimpleTest.monitorConsole(function() { window[0].location.reload(true); },
[ { message: /mutating/ } ], /* forbidUnexpectedMessages = */ true);
window[0].eval('var foo = {}; Object.setPrototypeOf(foo, {});' +
'var bar = {}; Object.getPrototypeOf(bar, {});');
SimpleTest.endMonitorConsole();
break;
case 2:
info("Second load");
SimpleTest.monitorConsole(SimpleTest.finish.bind(SimpleTest),
[ { message: /mutating/ } ], /* forbidUnexpectedMessages = */ true);
window[0].eval('var foo = {}; foo.__proto__ = {};' +
'var bar = {}; bar.__proto__ = {};');
SimpleTest.endMonitorConsole();
break;
case 3:
ok(false, "Shouldn't have 3 loads!");
}
}
</script>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1021258">Mozilla Bug 1021258</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
</pre>
<iframe id="ifr" src="file_empty.html" onload="loaded();"></iframe>
</body>
</html>