| Commit message (Collapse) | Author | Age | Lines |
| |
|
|
|
|
| |
This is a follow-up to ca7ecd37c94e268972697a37eec4e46771c6e6f2 further improving the DiD resolution for CVE-2018-12386.
|
|\ |
|
| |
| |
| |
| | |
RegExpBuiltinExec per ES2017
|
| |
| |
| |
| |
| |
| | |
iterator close trynote
Issue #74
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Bug 1342553 - Part 0.1: Use try-catch for IteratorClose in for-of
Bug 1343072 - Update HasLiveStackValueAtDepth to follow the change in
JSTRY_FOR_OF
Bug 1344753 - Update for-of stack depth in
ControlFlowGenerator::processWhileOrForInLoop
Issue #74
|
| |
| |
| |
| | |
Issue #74
|
| |
| |
| |
| | |
Issue #74
|
| |
| |
| |
| | |
Issue #74
|
| |
| |
| |
| | |
Issue #74
|
|/
|
|
|
|
| |
due to exceptions
Issue #74
|
|\
| |
| |
| |
| |
| | |
This resolves #78.
Merged remote-tracking branch 'janek/js_function_name_1'
|
| |
| |
| |
| | |
Issue #87
|
|/
|
|
|
| |
Issue #77
[Depends on] Bug 1192038: RegExp.prototype should be an ordinary object
|
|\
| |
| |
| |
| |
| | |
This resolves #75.
Merged remote-tracking branch 'janek/js_function_new_1'
|
| | |
|
|/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
CallTypedArrayMethodIfWrapped (and the CallNonGeneric machinery throughout the
engine) unwraps the `this` argument, but the other arguments are only rewrapped
for the target compartment.
The pattern being used before this patch to get the length of a TypedArray or
possible TypedArray wrapper is:
`callFunction(CallTypedArrayMethodIfWrapped, O, O, "TypedArrayLength")`
The first `O` is the `this` value and the second is an argument. If `O` is a
cross-compartment wrapper, this works fine. The first `O` is unwrapped, revealing
the actual TypedArray object; the second `O` is rewrapped for that TypedArray's
compartment, producing the same TypedArray.
However, if `O` is a same-compartment wrapper, this doesn't work. The first `O` is
unwrapped, revealing the actual TypedArray object in the same compartment;
rewrapping the other `O` does nothing to it, since it is already an object in the
target compartment. Thus TypedArrayLength receives a `this` value that's an
unwrapped TypedArray, but an argument that is still a wrapper.
The fix is to have CallTypedArrayMethodIfWrapped targets only expect `this`
to be an unwrapped TypedArray.
|
|
|
|
| |
rematerialization succeeds.
|
| |
|
|
|