SERVER-117317 Upgrade MozJS to esr 140.7 (#46920)

GitOrigin-RevId: b8bd7497d93089eaf1efbc9ec342354a84416155
This commit is contained in:
Aditya Deshpande 2026-01-27 14:35:56 -08:00 committed by MongoDB Bot
parent 7ee3050a1b
commit 28d4e3cc1c
41 changed files with 310 additions and 198 deletions

View File

@ -50,7 +50,7 @@ a notice will be included in
| [libunwind] | MIT | 1.8.1 | | ✗ |
| [linenoise] | BSD-2-Clause | 6cdc775807e57b2c3fd64bd207814f8ee1fe35f3 | | ✗ |
| [MongoDB C Driver] | Apache-2.0 | 1.28.1 | ✗ | ✗ |
| [Mozilla Firefox ESR] | MPL-2.0 | 140.3.0esr | | ✗ |
| [Mozilla Firefox ESR] | MPL-2.0 | 140.7.0esr | | ✗ |
| [MurmurHash3] | Public Domain | a6bd3ce7be8ad147ea820a7cf6229a975c0c96bb | | ✗ |
| [nlohmann/json] | MIT | 3.11.3 | ✗ | |
| [node] | ISC | 22.1.0 | | |

View File

@ -71,7 +71,7 @@
"components": [
{
"type": "library",
"bom-ref": "pkg:deb/debian/firefox-esr@140.3.0esr-1?arch=source",
"bom-ref": "pkg:deb/debian/firefox-esr@140.7.0esr-1?arch=source",
"supplier": {
"name": "Mozilla Corporation",
"url": [
@ -81,7 +81,7 @@
"author": "Mozilla Corporation",
"group": "mozilla",
"name": "Mozilla Firefox ESR",
"version": "140.3.0esr",
"version": "140.7.0esr",
"description": "The C++-only SpiderMonkey component of FireFox ESR used by MongoDB.",
"licenses": [
{
@ -91,8 +91,8 @@
}
],
"copyright": "Mozilla Corporation",
"cpe": "cpe:2.3:a:mozilla:firefox:140.3.0:*:*:*:esr:*:*:*",
"purl": "pkg:deb/debian/firefox-esr@140.3.0esr-1?arch=source",
"cpe": "cpe:2.3:a:mozilla:firefox:140.7.0:*:*:*:esr:*:*:*",
"purl": "pkg:deb/debian/firefox-esr@140.7.0esr-1?arch=source",
"externalReferences": [
{
"url": "https://github.com/mozilla-firefox/firefox.git",
@ -2485,7 +2485,7 @@
"pkg:github/libunwind/libunwind@v1.8.1",
"pkg:github/antirez/linenoise@6cdc775807e57b2c3fd64bd207814f8ee1fe35f3",
"pkg:github/mongodb/mongo-c-driver@1.28.1",
"pkg:deb/debian/firefox-esr@140.3.0esr-1?arch=source",
"pkg:deb/debian/firefox-esr@140.7.0esr-1?arch=source",
"pkg:github/nodejs/node@22.1.0?download_url=https%3A%2F%2Fgithub.com%2Fnodejs%2Fnode%2Fblob%2F8b45c5d26a829bcd3280401dbc1874bcd1302289%2Fsrc%2Fnode_i18n.cc%23L825%23src%2Fnode_i18n.cc%3AGetStringWidth#src/node_i18n.cc",
"pkg:pypi/ocspbuilder@0.10.2",
"pkg:pypi/ocspresponder@0.5.0",
@ -2509,7 +2509,7 @@
]
},
{
"ref": "pkg:deb/debian/firefox-esr@140.3.0esr-1?arch=source",
"ref": "pkg:deb/debian/firefox-esr@140.7.0esr-1?arch=source",
"dependsOn": []
},
{

View File

@ -210,7 +210,7 @@ class MOZ_STACK_CLASS MOZ_NON_PARAM CallArgsBase {
/* Returns the i-th zero-indexed argument. */
MutableHandleValue operator[](unsigned i) const {
MOZ_ASSERT(i < argc_);
MOZ_RELEASE_ASSERT(i < argc_);
return MutableHandleValue::fromMarkedLocation(&this->argv_[i]);
}

View File

@ -453,7 +453,10 @@ Breakpoint::Breakpoint(Debugger* debugger, HandleObject wrappedDebugger,
}
void Breakpoint::trace(JSTracer* trc) {
MOZ_ASSERT_IF(trc->kind() != JS::TracerKind::Moving,
!IsDeadProxyObject(wrappedDebugger));
TraceEdge(trc, &wrappedDebugger, "breakpoint owner");
TraceEdge(trc, &handler, "breakpoint handler");
}

View File

@ -1210,6 +1210,13 @@ void BufferAllocator::abortMajorSweeping(const AutoLock& lock) {
clearAllocatedDuringCollectionState(lock);
if (minorState == State::Sweeping) {
// If we are minor sweeping then chunks with allocatedDuringCollection set
// may be present in |mixedChunksToSweep|. Set a flag so these are cleared
// when they are merged later.
majorFinishedWhileMinorSweeping = true;
}
for (BufferChunk* chunk : mediumTenuredChunksToSweep.ref()) {
chunk->markBits.ref().clear();
}

View File

@ -5554,12 +5554,13 @@ bool SetPropIRGenerator::canAttachAddSlotStub(HandleObject obj, HandleId id) {
return false;
}
} else {
// Normal Case: If property exists this isn't an "add"
// Normal Case: If property exists or is an OOB typed array index, this
// isn't an "add".
PropertyResult prop;
if (!LookupOwnPropertyPure(cx_, nobj, id, &prop)) {
return false;
}
if (prop.isFound()) {
if (prop.isFound() || prop.isTypedArrayOutOfRange()) {
return false;
}
}
@ -5663,6 +5664,10 @@ AttachDecision SetPropIRGenerator::tryAttachAddSlotStub(
}
JSObject* obj = &lhsVal_.toObject();
if (!obj->is<NativeObject>()) {
return AttachDecision::NoAction;
}
NativeObject* nobj = &obj->as<NativeObject>();
PropertyResult prop;
if (!LookupOwnPropertyPure(cx_, obj, id, &prop)) {
@ -5672,11 +5677,7 @@ AttachDecision SetPropIRGenerator::tryAttachAddSlotStub(
return AttachDecision::NoAction;
}
if (!obj->is<NativeObject>()) {
return AttachDecision::NoAction;
}
auto* nobj = &obj->as<NativeObject>();
MOZ_RELEASE_ASSERT(prop.isNativeProperty());
PropertyInfo propInfo = prop.propertyInfo();
NativeObject* holder = nobj;
@ -5688,6 +5689,7 @@ AttachDecision SetPropIRGenerator::tryAttachAddSlotStub(
// The property must be the last added property of the object.
SharedShape* newShape = holder->sharedShape();
MOZ_RELEASE_ASSERT(oldShape != newShape);
MOZ_RELEASE_ASSERT(newShape->lastProperty() == propInfo);
#ifdef DEBUG

View File

@ -791,10 +791,10 @@ class MacroAssemblerRiscv64Compat : public MacroAssemblerRiscv64 {
void unboxGCThingForGCBarrier(const Address& src, Register dest) {
loadPtr(src, dest);
ExtractBits(dest, dest, 0, JSVAL_TAG_SHIFT - 1);
ExtractBits(dest, dest, 0, JSVAL_TAG_SHIFT);
}
void unboxGCThingForGCBarrier(const ValueOperand& src, Register dest) {
ExtractBits(dest, src.valueReg(), 0, JSVAL_TAG_SHIFT - 1);
ExtractBits(dest, src.valueReg(), 0, JSVAL_TAG_SHIFT);
}
void unboxWasmAnyRefGCThingForGCBarrier(const Address& src, Register dest) {

View File

@ -746,8 +746,10 @@ struct AssemblerBufferWithConstantPools
// secondary range veneers assuming the worst case deadlines.
// Total pending secondary range veneer size.
size_t secondaryVeneers = guardSize_ * (branchDeadlines_.size() -
branchDeadlines_.maxRangeSize());
size_t secondaryVeneers =
guardSize_ *
(branchDeadlines_.size() - branchDeadlines_.maxRangeSize()) *
InstSize;
if (deadline < poolEnd + secondaryVeneers) {
return false;

View File

@ -1838,24 +1838,24 @@ class BaseAssembler : public GenericAssembler {
void cmpb_rr(RegisterID rhs, RegisterID lhs) {
spew("cmpb %s, %s", GPReg8Name(rhs), GPReg8Name(lhs));
m_formatter.oneByteOp(OP_CMP_GbEb, rhs, lhs);
m_formatter.oneByteOp8(OP_CMP_GbEb, rhs, lhs);
}
void cmpb_rm(RegisterID rhs, int32_t offset, RegisterID base) {
spew("cmpb %s, " MEM_ob, GPReg8Name(rhs), ADDR_ob(offset, base));
m_formatter.oneByteOp(OP_CMP_EbGb, offset, base, rhs);
m_formatter.oneByteOp8(OP_CMP_EbGb, offset, base, rhs);
}
void cmpb_rm(RegisterID rhs, int32_t offset, RegisterID base,
RegisterID index, int scale) {
spew("cmpb %s, " MEM_obs, GPReg8Name(rhs),
ADDR_obs(offset, base, index, scale));
m_formatter.oneByteOp(OP_CMP_EbGb, offset, base, index, scale, rhs);
m_formatter.oneByteOp8(OP_CMP_EbGb, offset, base, index, scale, rhs);
}
void cmpb_rm(RegisterID rhs, const void* addr) {
spew("cmpb %s, %p", GPReg8Name(rhs), addr);
m_formatter.oneByteOp(OP_CMP_EbGb, addr, rhs);
m_formatter.oneByteOp8(OP_CMP_EbGb, addr, rhs);
}
void cmpb_ir(int32_t rhs, RegisterID lhs) {
@ -1866,9 +1866,9 @@ class BaseAssembler : public GenericAssembler {
spew("cmpb $0x%x, %s", uint32_t(rhs), GPReg8Name(lhs));
if (lhs == rax) {
m_formatter.oneByteOp(OP_CMP_EAXIb);
m_formatter.oneByteOp8(OP_CMP_EAXIb);
} else {
m_formatter.oneByteOp(OP_GROUP1_EbIb, lhs, GROUP1_OP_CMP);
m_formatter.oneByteOp8(OP_GROUP1_EbIb, lhs, GROUP1_OP_CMP);
}
m_formatter.immediate8(rhs);
}
@ -2054,7 +2054,7 @@ class BaseAssembler : public GenericAssembler {
void testb_rr(RegisterID rhs, RegisterID lhs) {
spew("testb %s, %s", GPReg8Name(rhs), GPReg8Name(lhs));
m_formatter.oneByteOp(OP_TEST_EbGb, lhs, rhs);
m_formatter.oneByteOp8(OP_TEST_EbGb, lhs, rhs);
}
void testl_ir(int32_t rhs, RegisterID lhs) {
@ -6095,6 +6095,13 @@ class BaseAssembler : public GenericAssembler {
m_buffer.putByteUnchecked(opcode + (r & 7));
}
void oneByteOp8(OneByteOpcodeID opcode, RegisterID rm, RegisterID reg) {
m_buffer.ensureSpace(MaxInstructionSize);
emitRexIf(byteRegRequiresRex(reg) || byteRegRequiresRex(rm), reg, 0, rm);
m_buffer.putByteUnchecked(opcode);
registerModRM(rm, reg);
}
void oneByteOp8(OneByteOpcodeID opcode, RegisterID rm,
GroupOpcodeID groupOp) {
m_buffer.ensureSpace(MaxInstructionSize);

View File

@ -5,6 +5,11 @@
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "builtin/FinalizationRegistryObject.h"
#include "debugger/Debugger.h"
#include "debugger/Environment.h"
#include "debugger/Frame.h"
#include "debugger/Script.h"
#include "debugger/Source.h"
#include "gc/GC.h"
#include "gc/PublicIterators.h"
#include "js/friend/WindowProxy.h" // js::IsWindow, js::IsWindowProxy
@ -449,6 +454,12 @@ JS_PUBLIC_API bool js::NukeCrossCompartmentWrappers(
continue;
}
// Don't nuke wrappers for debugger objects. These are used in Breakpoints
// and nuking them breaks debugger invariants.
if (MOZ_UNLIKELY(wrapped->is<DebuggerInstanceObject>())) {
continue;
}
// We only skip nuking window references that point to a target
// compartment, not the ones that belong to it.
if (nukeReferencesToWindow == DontNukeWindowReferences &&
@ -471,6 +482,12 @@ JS_PUBLIC_API bool js::AllowNewWrapper(JS::Compartment* target, JSObject* obj) {
MOZ_ASSERT(obj->compartment() != target);
// Wrappers for debugger objects are not nuked and we must continue to allow
// them to be created or we will break the invariants in Compartment::wrap.
if (MOZ_UNLIKELY(obj->is<DebuggerInstanceObject>())) {
return true;
}
if (target->nukedOutgoingWrappers ||
obj->nonCCWRealm()->nukedIncomingWrappers) {
return false;
@ -501,6 +518,9 @@ void js::RemapWrapper(JSContext* cx, JSObject* wobjArg,
AutoDisableProxyCheck adpc;
// This can't GC (and RemapDeadWrapper suppresses it).
JS::AutoAssertNoGC nogc(cx);
// If we're mapping to a different target (as opposed to just recomputing
// for the same target), we must not have an existing wrapper for the new
// target, otherwise this will break.
@ -542,6 +562,10 @@ void js::RemapDeadWrapper(JSContext* cx, HandleObject wobj,
AutoDisableProxyCheck adpc;
// Suppress GC while we manipulate the wrapper map so that it can't observe
// intervening state.
gc::AutoSuppressGC nogc(cx);
// wobj is not a cross-compartment wrapper, so we can use nonCCWRealm.
Realm* wrealm = wobj->nonCCWRealm();

View File

@ -3684,42 +3684,6 @@ JS::Result<bool> BigInt::equal(JSContext* cx, Handle<BigInt*> lhs,
return equal(lhs, rhsBigInt);
}
// BigInt proposal section 3.2.5
JS::Result<bool> BigInt::looselyEqual(JSContext* cx, HandleBigInt lhs,
HandleValue rhs) {
// Step 1.
if (rhs.isBigInt()) {
return equal(lhs, rhs.toBigInt());
}
// Steps 2-5 (not applicable).
// Steps 6-7.
if (rhs.isString()) {
RootedString rhsString(cx, rhs.toString());
return equal(cx, lhs, rhsString);
}
// Steps 8-9 (not applicable).
// Steps 10-11.
if (rhs.isObject()) {
RootedValue rhsPrimitive(cx, rhs);
if (!ToPrimitive(cx, &rhsPrimitive)) {
return cx->alreadyReportedError();
}
return looselyEqual(cx, lhs, rhsPrimitive);
}
// Step 12.
if (rhs.isNumber()) {
return equal(lhs, rhs.toNumber());
}
// Step 13.
return false;
}
// BigInt proposal section 1.1.12. BigInt::lessThan ( x, y )
bool BigInt::lessThan(const BigInt* x, const BigInt* y) {
return compare(x, y) < 0;

View File

@ -255,8 +255,6 @@ class BigInt final : public js::gc::CellWithLengthAndFlags {
static bool equal(const BigInt* lhs, double rhs);
static JS::Result<bool> equal(JSContext* cx, Handle<BigInt*> lhs,
HandleString rhs);
static JS::Result<bool> looselyEqual(JSContext* cx, Handle<BigInt*> lhs,
HandleValue rhs);
static bool lessThan(const BigInt* x, const BigInt* y);
// These methods return Nothing when the non-BigInt operand is NaN

View File

@ -78,37 +78,47 @@ static bool LooselyEqualBooleanAndOther(JSContext* cx,
return js::LooselyEqual(cx, lvalue, rval, result);
}
// ES6 draft rev32 7.2.12 Abstract Equality Comparison
// ES2026 Draft rev e936549f1c05ac1b206ad4c5817e77ee3ecbc787
//
// IsLooselyEqual ( x, y )
// https://tc39.es/ecma262/#sec-islooselyequal
bool js::LooselyEqual(JSContext* cx, JS::Handle<JS::Value> lval,
JS::Handle<JS::Value> rval, bool* result) {
// Step 3.
// Step 1. If SameType(x, y) is true, then
if (JS::SameType(lval, rval)) {
// Step 1.a. Return IsStrictlyEqual(x, y).
return EqualGivenSameType(cx, lval, rval, result);
}
// Handle int32 x double.
// NOTE: JS::SameType distinguishes between Int32 vs Double,
// but the spec's SameType doesn't.
if (lval.isNumber() && rval.isNumber()) {
*result = (lval.toNumber() == rval.toNumber());
return true;
}
// Step 4. This a bit more complex, because of the undefined emulating object.
// Step 2. If x is null and y is undefined, return true.
// Step 3. If x is undefined and y is null, return true.
// Step 4. Normative Optional
// If the host is a web browser or otherwise supports The
// [[IsHTMLDDA]] Internal Slot, then
// Step 4.a. If x is an Object, x has an [[IsHTMLDDA]] internal slot, and y
// is either undefined or null, return true.
// Step 4.b. If x is either undefined or null, y is an Object, and y has an
// [[IsHTMLDDA]] internal slot, return true.
if (lval.isNullOrUndefined()) {
// We can return early here, because null | undefined is only equal to the
// same set.
*result = rval.isNullOrUndefined() ||
(rval.isObject() && EmulatesUndefined(&rval.toObject()));
return true;
}
// Step 5.
if (rval.isNullOrUndefined()) {
MOZ_ASSERT(!lval.isNullOrUndefined());
*result = lval.isObject() && EmulatesUndefined(&lval.toObject());
return true;
}
// Step 6.
// Step 5. If x is a Number and y is a String, return ! IsLooselyEqual(x, !
// ToNumber(y)).
if (lval.isNumber() && rval.isString()) {
double num;
if (!StringToNumber(cx, rval.toString(), &num)) {
@ -118,7 +128,8 @@ bool js::LooselyEqual(JSContext* cx, JS::Handle<JS::Value> lval,
return true;
}
// Step 7.
// Step 6. If x is a String and y is a Number, return ! IsLooselyEqual(!
// ToNumber(x), y).
if (lval.isString() && rval.isNumber()) {
double num;
if (!StringToNumber(cx, lval.toString(), &num)) {
@ -128,18 +139,50 @@ bool js::LooselyEqual(JSContext* cx, JS::Handle<JS::Value> lval,
return true;
}
// Step 8.
// Step 7. If x is a BigInt and y is a String, then
if (lval.isBigInt() && rval.isString()) {
// Step 7.a. Let n be StringToBigInt(y).
BigInt* n;
JS::Rooted<JSString*> str(cx, rval.toString());
JS_TRY_VAR_OR_RETURN_FALSE(cx, n, StringToBigInt(cx, str));
if (!n) {
// Step 7.b. If n is undefined, return false.
*result = false;
return true;
}
// Step 7.c. Return ! IsLooselyEqual(x, n).
*result = JS::BigInt::equal(lval.toBigInt(), n);
return true;
}
// Step 8. If x is a String and y is a BigInt, return ! IsLooselyEqual(y,
// x).
if (lval.isString() && rval.isBigInt()) {
BigInt* n;
JS::Rooted<JSString*> str(cx, lval.toString());
JS_TRY_VAR_OR_RETURN_FALSE(cx, n, StringToBigInt(cx, str));
if (!n) {
*result = false;
return true;
}
*result = JS::BigInt::equal(rval.toBigInt(), n);
return true;
}
// Step 9. If x is a Boolean, return ! IsLooselyEqual(! ToNumber(x), y).
if (lval.isBoolean()) {
return LooselyEqualBooleanAndOther(cx, lval, rval, result);
}
// Step 9.
// Step 10. If y is a Boolean, return ! IsLooselyEqual(x, ! ToNumber(y)).
if (rval.isBoolean()) {
return LooselyEqualBooleanAndOther(cx, rval, lval, result);
}
// Step 10.
if ((lval.isString() || lval.isNumber() || lval.isSymbol()) &&
// Step 11. If x is either a String, a Number, a BigInt, or a Symbol and y
// is an Object, return ! IsLooselyEqual(x, ? ToPrimitive(y)).
if ((lval.isString() || lval.isNumber() || lval.isBigInt() ||
lval.isSymbol()) &&
rval.isObject()) {
JS::Rooted<JS::Value> rvalue(cx, rval);
if (!ToPrimitive(cx, &rvalue)) {
@ -148,9 +191,10 @@ bool js::LooselyEqual(JSContext* cx, JS::Handle<JS::Value> lval,
return js::LooselyEqual(cx, lval, rvalue, result);
}
// Step 11.
if (lval.isObject() &&
(rval.isString() || rval.isNumber() || rval.isSymbol())) {
// Step 12. If x is an Object and y is either a String, a Number, a BigInt,
// or a Symbol, return ! IsLooselyEqual(? ToPrimitive(x), y).
if (lval.isObject() && (rval.isString() || rval.isNumber() ||
rval.isBigInt() || rval.isSymbol())) {
JS::Rooted<JS::Value> lvalue(cx, lval);
if (!ToPrimitive(cx, &lvalue)) {
return false;
@ -158,25 +202,20 @@ bool js::LooselyEqual(JSContext* cx, JS::Handle<JS::Value> lval,
return js::LooselyEqual(cx, lvalue, rval, result);
}
if (lval.isBigInt()) {
JS::Rooted<JS::BigInt*> lbi(cx, lval.toBigInt());
bool tmpResult;
JS_TRY_VAR_OR_RETURN_FALSE(cx, tmpResult,
JS::BigInt::looselyEqual(cx, lbi, rval));
*result = tmpResult;
// Step 13. If x is a BigInt and y is a Number, or if x is a Number and y
// is a BigInt, then
if (lval.isBigInt() && rval.isNumber()) {
// Step 13.a. If x is not finite or y is not finite, return false.
// Step 13.b. If (x) = (y), return true; otherwise return false.
*result = BigInt::equal(lval.toBigInt(), rval.toNumber());
return true;
}
if (lval.isNumber() && rval.isBigInt()) {
*result = BigInt::equal(rval.toBigInt(), lval.toNumber());
return true;
}
if (rval.isBigInt()) {
JS::Rooted<JS::BigInt*> rbi(cx, rval.toBigInt());
bool tmpResult;
JS_TRY_VAR_OR_RETURN_FALSE(cx, tmpResult,
JS::BigInt::looselyEqual(cx, rbi, lval));
*result = tmpResult;
return true;
}
// Step 12.
// Step 14. Return false.
*result = false;
return true;
}

View File

@ -39,6 +39,7 @@
#include "vm/Shape.h"
#include "vm/StringType.h"
#include "vm/TypedArrayObject.h"
#include "vm/Watchtower.h"
#include "vm/NativeObject-inl.h"
#include "vm/PlainObject-inl.h" // js::PlainObject::createWithTemplate
@ -278,6 +279,10 @@ template <bool CheckForDuplicates>
bool PropertyEnumerator::enumerateNativeProperties(JSContext* cx) {
Handle<NativeObject*> pobj = obj_.as<NativeObject>();
if (Watchtower::watchesPropertyValueChange(pobj)) {
markIndicesUnsupported();
}
// We don't need to iterate over the shape's properties if we're only
// interested in enumerable properties and the object is known to have no
// enumerable properties.
@ -394,7 +399,7 @@ bool PropertyEnumerator::enumerateNativeProperties(JSContext* cx) {
continue;
}
PropertyIndex index = iter->isDataProperty()
PropertyIndex index = iter->isDataProperty() && iter->writable()
? PropertyIndex::ForSlot(pobj, iter->slot())
: PropertyIndex::Invalid();
if (!enumerate<CheckForDuplicates>(cx, id, iter->enumerable(), index)) {

View File

@ -176,6 +176,13 @@ class WasmArrayObject : public WasmGcObject,
return offsetToPointer<uint8_t>(offsetOfInlineStorage());
}
// Actual array data that follows DataHeader. The array data is a part of the
// `inlineStorage`.
template <typename T>
T* inlineArrayElements() {
return offsetToPointer<T>(offsetOfInlineArrayData());
}
// This tells us how big the object is if we know the number of inline bytes
// it was created with.
static inline constexpr size_t sizeOfIncludingInlineStorage(
@ -537,9 +544,8 @@ class MOZ_RAII StableWasmArrayObjectElements {
// elements.
MOZ_CRASH();
}
std::copy(array->inlineStorage(),
array->inlineStorage() + array->numElements_ * sizeof(T),
ownElements_->begin());
const T* src = array->inlineArrayElements<T>();
std::copy(src, src + array->numElements_, ownElements_->begin());
elements_ = ownElements_->begin();
} else {
elements_ = reinterpret_cast<T*>(array->data_);

View File

@ -1561,8 +1561,23 @@ WasmModuleObject* WasmModuleObject::create(JSContext* cx, const Module& module,
return obj;
}
static bool GetBufferSource(JSContext* cx, JSObject* obj, unsigned errorNumber,
BytecodeSource* bytecode) {
struct MOZ_STACK_CLASS AutoPinBufferSourceLength {
explicit AutoPinBufferSourceLength(JSContext* cx, JSObject* bufferSource)
: bufferSource_(cx, bufferSource),
wasPinned_(!JS::PinArrayBufferOrViewLength(bufferSource_, true)) {}
~AutoPinBufferSourceLength() {
if (!wasPinned_) {
JS::PinArrayBufferOrViewLength(bufferSource_, false);
}
}
private:
Rooted<JSObject*> bufferSource_;
bool wasPinned_;
};
static bool GetBytecodeSource(JSContext* cx, Handle<JSObject*> obj,
unsigned errorNumber, BytecodeSource* bytecode) {
JSObject* unwrapped = CheckedUnwrapStatic(obj);
SharedMem<uint8_t*> dataPointer;
@ -1578,6 +1593,20 @@ static bool GetBufferSource(JSContext* cx, JSObject* obj, unsigned errorNumber,
return true;
}
static bool GetBytecodeBuffer(JSContext* cx, Handle<JSObject*> obj,
unsigned errorNumber, BytecodeBuffer* bytecode) {
BytecodeSource source;
if (!GetBytecodeSource(cx, obj, errorNumber, &source)) {
return false;
}
AutoPinBufferSourceLength pin(cx, obj);
if (!BytecodeBuffer::fromSource(source, bytecode)) {
ReportOutOfMemory(cx);
return false;
}
return true;
}
static bool ReportCompileWarnings(JSContext* cx,
const UniqueCharsVector& warnings) {
// Avoid spamming the console.
@ -1634,12 +1663,6 @@ bool WasmModuleObject::construct(JSContext* cx, unsigned argc, Value* vp) {
return false;
}
BytecodeSource source;
if (!GetBufferSource(cx, &callArgs[0].toObject(), JSMSG_WASM_BAD_BUF_ARG,
&source)) {
return false;
}
FeatureOptions options;
if (!options.init(cx, callArgs.get(1))) {
return false;
@ -1651,10 +1674,20 @@ bool WasmModuleObject::construct(JSContext* cx, unsigned argc, Value* vp) {
return false;
}
BytecodeSource source;
Rooted<JSObject*> sourceObj(cx, &callArgs[0].toObject());
if (!GetBytecodeSource(cx, sourceObj, JSMSG_WASM_BAD_BUF_ARG, &source)) {
return false;
}
UniqueChars error;
UniqueCharsVector warnings;
SharedModule module = CompileBuffer(
*compileArgs, BytecodeBufferOrSource(source), &error, &warnings, nullptr);
SharedModule module;
{
AutoPinBufferSourceLength pin(cx, sourceObj.get());
module = CompileBuffer(*compileArgs, BytecodeBufferOrSource(source), &error,
&warnings, nullptr);
}
if (!ReportCompileWarnings(cx, warnings)) {
return false;
@ -4504,22 +4537,6 @@ static bool EnsurePromiseSupport(JSContext* cx) {
return true;
}
static bool GetBufferSource(JSContext* cx, const CallArgs& callArgs,
const char* name, BytecodeSource* bytecode) {
if (!callArgs.requireAtLeast(cx, name, 1)) {
return false;
}
if (!callArgs[0].isObject()) {
JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr,
JSMSG_WASM_BAD_BUF_ARG);
return false;
}
return GetBufferSource(cx, &callArgs[0].toObject(), JSMSG_WASM_BAD_BUF_ARG,
bytecode);
}
static bool WebAssembly_compile(JSContext* cx, unsigned argc, Value* vp) {
if (!EnsurePromiseSupport(cx)) {
return false;
@ -4554,18 +4571,25 @@ static bool WebAssembly_compile(JSContext* cx, unsigned argc, Value* vp) {
return false;
}
BytecodeSource source;
if (!GetBufferSource(cx, callArgs, "WebAssembly.compile", &source)) {
if (!callArgs.requireAtLeast(cx, "WebAssembly.compile", 1)) {
return RejectWithPendingException(cx, promise, callArgs);
}
if (!BytecodeBuffer::fromSource(source, &task->bytecode)) {
ReportOutOfMemory(cx);
return false;
}
FeatureOptions options;
if (!options.init(cx, callArgs.get(1))) {
return false;
return RejectWithPendingException(cx, promise, callArgs);
}
if (!callArgs[0].isObject()) {
JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr,
JSMSG_WASM_BAD_BUF_ARG);
return RejectWithPendingException(cx, promise, callArgs);
}
Rooted<JSObject*> sourceObj(cx, &callArgs[0].toObject());
if (!GetBytecodeBuffer(cx, sourceObj, JSMSG_WASM_BAD_BUF_ARG,
&task->bytecode)) {
return RejectWithPendingException(cx, promise, callArgs);
}
if (!task->init(cx, options, "WebAssembly.compile")) {
@ -4658,14 +4682,10 @@ static bool WebAssembly_instantiate(JSContext* cx, unsigned argc, Value* vp) {
return false;
}
BytecodeSource source;
if (!GetBufferSource(cx, firstArg, JSMSG_WASM_BAD_BUF_MOD_ARG, &source)) {
if (!GetBytecodeBuffer(cx, firstArg, JSMSG_WASM_BAD_BUF_MOD_ARG,
&task->bytecode)) {
return RejectWithPendingException(cx, promise, callArgs);
}
if (!BytecodeBuffer::fromSource(source, &task->bytecode)) {
ReportOutOfMemory(cx);
return false;
}
if (!StartOffThreadPromiseHelperTask(cx, std::move(task))) {
return false;
@ -4679,8 +4699,7 @@ static bool WebAssembly_instantiate(JSContext* cx, unsigned argc, Value* vp) {
static bool WebAssembly_validate(JSContext* cx, unsigned argc, Value* vp) {
CallArgs callArgs = CallArgsFromVp(argc, vp);
BytecodeSource source;
if (!GetBufferSource(cx, callArgs, "WebAssembly.validate", &source)) {
if (!callArgs.requireAtLeast(cx, "WebAssembly.validate", 1)) {
return false;
}
@ -4689,8 +4708,24 @@ static bool WebAssembly_validate(JSContext* cx, unsigned argc, Value* vp) {
return false;
}
if (!callArgs[0].isObject()) {
JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr,
JSMSG_WASM_BAD_BUF_ARG);
return false;
}
BytecodeSource source;
Rooted<JSObject*> sourceObj(cx, &callArgs[0].toObject());
if (!GetBytecodeSource(cx, sourceObj, JSMSG_WASM_BAD_BUF_ARG, &source)) {
return false;
}
UniqueChars error;
bool validated = Validate(cx, source, options, &error);
bool validated;
{
AutoPinBufferSourceLength pin(cx, sourceObj.get());
validated = Validate(cx, source, options, &error);
}
// If the reason for validation failure was OOM (signalled by null error
// message), report out-of-memory so that validate's return is always

View File

@ -343,8 +343,8 @@ class MOZ_NON_PARAM MOZ_GSL_OWNER Vector final : private AllocPolicy {
/* utilities */
static constexpr bool kElemIsPod =
std::is_trivial_v<T> && std::is_standard_layout_v<T>;
typedef detail::VectorImpl<T, MinInlineCapacity, AllocPolicy, kElemIsPod>
Impl;
using Impl =
detail::VectorImpl<T, MinInlineCapacity, AllocPolicy, kElemIsPod>;
friend struct detail::VectorImpl<T, MinInlineCapacity, AllocPolicy,
kElemIsPod>;
@ -537,7 +537,7 @@ class MOZ_NON_PARAM MOZ_GSL_OWNER Vector final : private AllocPolicy {
public:
static const size_t sMaxInlineStorage = MinInlineCapacity;
typedef T ElementType;
using ElementType = T;
explicit Vector(AllocPolicy);
Vector() : Vector(AllocPolicy()) {}
@ -582,25 +582,33 @@ class MOZ_NON_PARAM MOZ_GSL_OWNER Vector final : private AllocPolicy {
T& operator[](size_t aIndex) {
MOZ_ASSERT(!mEntered);
MOZ_ASSERT(aIndex < mLength);
if (MOZ_UNLIKELY(aIndex >= mLength)) {
mozilla::detail::InvalidArrayIndex_CRASH(aIndex, mLength);
}
return begin()[aIndex];
}
const T& operator[](size_t aIndex) const {
MOZ_ASSERT(!mEntered);
MOZ_ASSERT(aIndex < mLength);
if (MOZ_UNLIKELY(aIndex >= mLength)) {
mozilla::detail::InvalidArrayIndex_CRASH(aIndex, mLength);
}
return begin()[aIndex];
}
T& back() {
MOZ_ASSERT(!mEntered);
MOZ_ASSERT(!empty());
if (MOZ_UNLIKELY(empty())) {
mozilla::detail::InvalidArrayIndex_CRASH(0, 0);
}
return *(end() - 1);
}
const T& back() const {
MOZ_ASSERT(!mEntered);
MOZ_ASSERT(!empty());
if (MOZ_UNLIKELY(empty())) {
mozilla::detail::InvalidArrayIndex_CRASH(0, 0);
}
return *(end() - 1);
}
@ -1519,7 +1527,9 @@ MOZ_ALWAYS_INLINE bool Vector<T, N, AP>::append(const U* aInsBegin,
template <typename T, size_t N, class AP>
MOZ_ALWAYS_INLINE void Vector<T, N, AP>::popBack() {
MOZ_REENTRANCY_GUARD_ET_AL;
MOZ_ASSERT(!empty());
if (MOZ_UNLIKELY(empty())) {
mozilla::detail::InvalidArrayIndex_CRASH(0, 0);
}
--mLength;
endNoCheck()->~T();
}

View File

@ -8,9 +8,9 @@ set -vx
NAME=spidermonkey
VERSION="140.3.0esr"
LIB_GIT_BRANCH=spidermonkey-esr140.3-cpp-only
LIB_GIT_REVISION=54ce5c4f64002c110069eba7861399fbf4b24ecc
VERSION="140.7.0esr"
LIB_GIT_BRANCH=spidermonkey-esr140.7-cpp-only
LIB_GIT_REVISION=c822e4d076b36d878d95ad26d0f5ee7942dc39c4
LIB_GIT_REPO=git@github.com:mongodb-forks/spidermonkey.git
# If a local spidermonkey repo exists, this is much faster than fetching from git:
# LIB_GIT_REPO=/home/ubuntu/spidermonkey/.git

View File

@ -210,7 +210,7 @@ class MOZ_STACK_CLASS MOZ_NON_PARAM CallArgsBase {
/* Returns the i-th zero-indexed argument. */
MutableHandleValue operator[](unsigned i) const {
MOZ_ASSERT(i < argc_);
MOZ_RELEASE_ASSERT(i < argc_);
return MutableHandleValue::fromMarkedLocation(&this->argv_[i]);
}

View File

@ -343,8 +343,8 @@ class MOZ_NON_PARAM MOZ_GSL_OWNER Vector final : private AllocPolicy {
/* utilities */
static constexpr bool kElemIsPod =
std::is_trivial_v<T> && std::is_standard_layout_v<T>;
typedef detail::VectorImpl<T, MinInlineCapacity, AllocPolicy, kElemIsPod>
Impl;
using Impl =
detail::VectorImpl<T, MinInlineCapacity, AllocPolicy, kElemIsPod>;
friend struct detail::VectorImpl<T, MinInlineCapacity, AllocPolicy,
kElemIsPod>;
@ -537,7 +537,7 @@ class MOZ_NON_PARAM MOZ_GSL_OWNER Vector final : private AllocPolicy {
public:
static const size_t sMaxInlineStorage = MinInlineCapacity;
typedef T ElementType;
using ElementType = T;
explicit Vector(AllocPolicy);
Vector() : Vector(AllocPolicy()) {}
@ -582,25 +582,33 @@ class MOZ_NON_PARAM MOZ_GSL_OWNER Vector final : private AllocPolicy {
T& operator[](size_t aIndex) {
MOZ_ASSERT(!mEntered);
MOZ_ASSERT(aIndex < mLength);
if (MOZ_UNLIKELY(aIndex >= mLength)) {
mozilla::detail::InvalidArrayIndex_CRASH(aIndex, mLength);
}
return begin()[aIndex];
}
const T& operator[](size_t aIndex) const {
MOZ_ASSERT(!mEntered);
MOZ_ASSERT(aIndex < mLength);
if (MOZ_UNLIKELY(aIndex >= mLength)) {
mozilla::detail::InvalidArrayIndex_CRASH(aIndex, mLength);
}
return begin()[aIndex];
}
T& back() {
MOZ_ASSERT(!mEntered);
MOZ_ASSERT(!empty());
if (MOZ_UNLIKELY(empty())) {
mozilla::detail::InvalidArrayIndex_CRASH(0, 0);
}
return *(end() - 1);
}
const T& back() const {
MOZ_ASSERT(!mEntered);
MOZ_ASSERT(!empty());
if (MOZ_UNLIKELY(empty())) {
mozilla::detail::InvalidArrayIndex_CRASH(0, 0);
}
return *(end() - 1);
}
@ -1519,7 +1527,9 @@ MOZ_ALWAYS_INLINE bool Vector<T, N, AP>::append(const U* aInsBegin,
template <typename T, size_t N, class AP>
MOZ_ALWAYS_INLINE void Vector<T, N, AP>::popBack() {
MOZ_REENTRANCY_GUARD_ET_AL;
MOZ_ASSERT(!empty());
if (MOZ_UNLIKELY(empty())) {
mozilla::detail::InvalidArrayIndex_CRASH(0, 0);
}
--mLength;
endNoCheck()->~T();
}

View File

@ -71,9 +71,9 @@
#define MALLOC_H <malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".so"

View File

@ -71,9 +71,9 @@
#define MALLOC_H <malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".so"

View File

@ -66,7 +66,7 @@
/* MOZILLA JSAPI version number components */
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
/* MONGODB MODIFICATION: Define based on platform */
/* #undef XP_WIN */

View File

@ -61,9 +61,9 @@
#define MALLOC_H <malloc/malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR const
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".dylib"

View File

@ -61,9 +61,9 @@
#define MALLOC_H <malloc/malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR const
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".dylib"

View File

@ -66,7 +66,7 @@
/* MOZILLA JSAPI version number components */
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
/* MONGODB MODIFICATION: Define based on platform */
/* #undef XP_WIN */

View File

@ -73,9 +73,9 @@
#define MALLOC_H <malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".so"

View File

@ -73,9 +73,9 @@
#define MALLOC_H <malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".so"

View File

@ -66,7 +66,7 @@
/* MOZILLA JSAPI version number components */
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
/* MONGODB MODIFICATION: Define based on platform */
/* #undef XP_WIN */

View File

@ -73,9 +73,9 @@
#define MALLOC_H <malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".so"

View File

@ -73,9 +73,9 @@
#define MALLOC_H <malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".so"

View File

@ -66,7 +66,7 @@
/* MOZILLA JSAPI version number components */
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
/* MONGODB MODIFICATION: Define based on platform */
/* #undef XP_WIN */

View File

@ -74,9 +74,9 @@
#define MALLOC_H <malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".so"

View File

@ -74,9 +74,9 @@
#define MALLOC_H <malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".so"

View File

@ -66,7 +66,7 @@
/* MOZILLA JSAPI version number components */
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
/* MONGODB MODIFICATION: Define based on platform */
/* #undef XP_WIN */

View File

@ -61,9 +61,9 @@
#define MALLOC_H <malloc/malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR const
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".dylib"

View File

@ -61,9 +61,9 @@
#define MALLOC_H <malloc/malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR const
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX "lib"
#define MOZ_DLL_SUFFIX ".dylib"

View File

@ -66,7 +66,7 @@
/* MOZILLA JSAPI version number components */
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
/* MONGODB MODIFICATION: Define based on platform */
/* #undef XP_WIN */

View File

@ -36,9 +36,9 @@
#define MALLOC_H <malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX ""
#define MOZ_DLL_SUFFIX ".dll"

View File

@ -36,9 +36,9 @@
#define MALLOC_H <malloc.h>
#define MALLOC_USABLE_SIZE_CONST_PTR
#define MOZILLA_UAVERSION "140.0"
#define MOZILLA_VERSION "140.3.0"
#define MOZILLA_VERSION "140.7.0"
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
#define MOZ_BUILD_APP js
#define MOZ_DLL_PREFIX ""
#define MOZ_DLL_SUFFIX ".dll"

View File

@ -66,7 +66,7 @@
/* MOZILLA JSAPI version number components */
#define MOZJS_MAJOR_VERSION 140
#define MOZJS_MINOR_VERSION 3
#define MOZJS_MINOR_VERSION 7
/* MONGODB MODIFICATION: Define based on platform */
#define XP_WIN 1