From 50813a86e5d2599560a1f37c9b760154471e83c2 Mon Sep 17 00:00:00 2001 From: win7-7 Date: Thu, 13 Oct 2022 23:52:00 +0300 Subject: [PATCH] Security fixes toward 105 version. Security fixes toward 105 version. --- js/src/jit/IonBuilder.cpp | 2 ++ js/src/jit/MIR.h | 5 +++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp index 20787f3431..a5adda4379 100644 --- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -3717,6 +3717,8 @@ IonBuilder::replaceTypeSet(MDefinition* subject, TemporaryTypeSet* type, MTest* if (type->unknown()) return true; + MOZ_ASSERT(!type->hasType(TypeSet::MagicArgType())); + // Don't emit MFilterTypeSet if it doesn't improve the typeset. if (subject->resultTypeSet()) { if (subject->resultTypeSet()->equals(type)) diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h index 699842abf3..f432ae37f2 100644 --- a/js/src/jit/MIR.h +++ b/js/src/jit/MIR.h @@ -3756,9 +3756,10 @@ class MCreateThisWithTemplate return initialHeap_; } - // Although creation of |this| modifies global state, it is safely repeatable. + // Performs a property read from |newTarget| if |newTarget| is a JSFunction + // with an own |.prototype| property. AliasSet getAliasSet() const override { - return AliasSet::None(); + return AliasSet::Load(AliasSet::Any); } MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override;