From 8c4ece641e87fb2956d461ec4dd0ffab3eb2017c Mon Sep 17 00:00:00 2001 From: Basilisk-Dev Date: Fri, 8 May 2026 20:57:19 -0400 Subject: [PATCH] Tighten stream helper interface realms --- js/src/builtin/Stream.cpp | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/js/src/builtin/Stream.cpp b/js/src/builtin/Stream.cpp index 39b516bc7e..144d222dd6 100644 --- a/js/src/builtin/Stream.cpp +++ b/js/src/builtin/Stream.cpp @@ -5157,7 +5157,8 @@ DequeueValue(JSContext* cx, HandleNativeObject container, MutableHandleValue chu // Step 2: Assert: queue is not empty. RootedValue val(cx, container->getFixedSlot(QueueContainerSlot_Queue)); - RootedNativeObject queue(cx, &val.toObject().as()); + RootedNativeObject queue(cx); + queue = UnwrapInternalSlotObject(&val.toObject()); MOZ_ASSERT(queue->getDenseInitializedLength() > 0); // Step 3. Let pair be the first element of queue. @@ -5179,7 +5180,10 @@ DequeueValue(JSContext* cx, HandleNativeObject container, MutableHandleValue chu container->setFixedSlot(QueueContainerSlot_TotalSize, NumberValue(totalSize)); // Step 7: Return pair.[[value]]. - chunk.set(pair->value()); + RootedValue chunkVal(cx, pair->value()); + if (!JS_WrapValue(cx, &chunkVal)) + return false; + chunk.set(chunkVal); return true; } @@ -5208,19 +5212,27 @@ EnqueueValueWithSize(JSContext* cx, HandleNativeObject container, HandleValue va // Step 4: Append Record {[[value]]: value, [[size]]: size} as the last element // of container.[[queue]]. RootedValue val(cx, container->getFixedSlot(QueueContainerSlot_Queue)); - RootedNativeObject queue(cx, &val.toObject().as()); + RootedNativeObject queue(cx); + queue = UnwrapInternalSlotObject(&val.toObject()); - QueueEntry* entry = QueueEntry::create(cx, value, size); - if (!entry) - return false; - val = ObjectValue(*entry); - if (!AppendToList(cx, queue, val)) - return false; + { + JSAutoCompartment ac(cx, queue); + RootedValue wrappedValue(cx, value); + if (!JS_WrapValue(cx, &wrappedValue)) + return false; - // Step 5: Set container.[[queueTotalSize]] to - // container.[[queueTotalSize]] + size. - double totalSize = container->getFixedSlot(QueueContainerSlot_TotalSize).toNumber(); - container->setFixedSlot(QueueContainerSlot_TotalSize, NumberValue(totalSize + size)); + QueueEntry* entry = QueueEntry::create(cx, wrappedValue, size); + if (!entry) + return false; + val = ObjectValue(*entry); + if (!AppendToList(cx, queue, val)) + return false; + + // Step 5: Set container.[[queueTotalSize]] to + // container.[[queueTotalSize]] + size. + double totalSize = container->getFixedSlot(QueueContainerSlot_TotalSize).toNumber(); + container->setFixedSlot(QueueContainerSlot_TotalSize, NumberValue(totalSize + size)); + } return true; }