Commit 52c9ccd8 authored by Steve Fink's avatar Steve Fink
Browse files

Bug 1675755c - Enter correct compartment before we might allocate BaseShape r=jandem 

Differential Revision: https://phabricator.services.mozilla.com/D97386
parent ffdb6a4d

js/src/debugger/Object.cpp

+5 −0
Original line number Diff line number Diff line
@@ -2378,6 +2378,11 @@ bool DebuggerObject::forceLexicalInitializationByName( 


  Rooted<GlobalObject*> referent(cx, &object->referent()->as<GlobalObject>());



  // Shape::search can end up allocating a new BaseShape in Shape::cachify so

  // we need to be in the right compartment here.

  Maybe<AutoRealm> ar;

  EnterDebuggeeObjectRealm(cx, ar, referent);



  RootedObject globalLexical(cx, &referent->lexicalEnvironment());

  RootedObject pobj(cx);

  Rooted<PropertyResult> prop(cx);

js/src/vm/NativeObject-inl.h

+2 −0
Original line number Diff line number Diff line
@@ -698,6 +698,8 @@ static MOZ_ALWAYS_INLINE bool LookupOwnPropertyInline( 
    }

  }



  MOZ_ASSERT(cx->compartment() == obj->compartment());



  // Check for a native property. Call Shape::search directly (instead of

  // NativeObject::lookup) because it's inlined.

  if (Shape* shape = obj->lastProperty()->search(cx, id)) {