Bug 846: {get,set}Property check JS_InstanceOf without asserting.

The getProperty and setProperty functions of a JSClass must not assume
that the obj parameter points to an instance of that class.  It might
instead point to another object that merely has an instance of the
class in its prototype chain.  Thus, do not assert that JS_InstanceOf
returns true there.  Instead, run the check even with CONFIG_FASTMEM,
and just return JS_FALSE if it fails.

(Adapted from aa410301f1b8fda4b4249283ecefdd9698bb1b5a in ELinks 0.12.GIT.)

src/ecmascript/spidermonkey/document.c

@@ -80,8 +80,11 @@ document_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	struct document *document;
 	struct session *ses;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &document_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &document_class, NULL))
+		return JS_FALSE;
 	parent_win = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
 	if_assert_failed return JS_FALSE;
@@ -174,8 +177,11 @@ document_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	struct document_view *doc_view;
 	struct document *document;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &document_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &document_class, NULL))
+		return JS_FALSE;
 	parent_win = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
 	if_assert_failed return JS_FALSE;

src/ecmascript/spidermonkey/form.c

@@ -136,8 +136,11 @@ input_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	int linknum;
 	struct link *link = NULL;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &input_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &input_class, NULL))
+		return JS_FALSE;
 	parent_form = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_form, (JSClass *) &form_class, NULL));
 	if_assert_failed return JS_FALSE;
@@ -267,8 +270,11 @@ input_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	int linknum;
 	struct link *link = NULL;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &input_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &input_class, NULL))
+		return JS_FALSE;
 	parent_form = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_form, (JSClass *) &form_class, NULL));
 	if_assert_failed return JS_FALSE;
@@ -552,8 +558,11 @@ form_elements_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	struct form_view *form_view;
 	struct form *form;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &form_elements_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &form_elements_class, NULL))
+		return JS_FALSE;
 	parent_form = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_form, (JSClass *) &form_class, NULL));
 	if_assert_failed return JS_FALSE;
@@ -759,8 +768,11 @@ form_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	struct form_view *fv;
 	struct form *form;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &form_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &form_class, NULL))
+		return JS_FALSE;
 	parent_doc = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_doc, (JSClass *) &document_class, NULL));
 	if_assert_failed return JS_FALSE;
@@ -881,8 +893,11 @@ form_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	struct form *form;
 	unsigned char *string;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &form_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &form_class, NULL))
+		return JS_FALSE;
 	parent_doc = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_doc, (JSClass *) &document_class, NULL));
 	if_assert_failed return JS_FALSE;
@@ -1064,8 +1079,11 @@ forms_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	struct document_view *doc_view;
 	struct document *document;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &forms_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &forms_class, NULL))
+		return JS_FALSE;
 	parent_doc = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_doc, (JSClass *) &document_class, NULL));
 	if_assert_failed return JS_FALSE;

src/ecmascript/spidermonkey/location.c

@@ -149,8 +149,11 @@ location_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	JSObject *parent_win;	/* instance of @window_class */
 	struct view_state *vs;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &location_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &location_class, NULL))
+		return JS_FALSE;
 	parent_win = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
 	if_assert_failed return JS_FALSE;
@@ -182,8 +185,11 @@ location_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	struct view_state *vs;
 	struct document_view *doc_view;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &location_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &location_class, NULL))
+		return JS_FALSE;
 	parent_win = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
 	if_assert_failed return JS_FALSE;

src/ecmascript/spidermonkey/unibar.c

@@ -82,9 +82,12 @@ unibar_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	struct session_status *status;
 	unsigned char *bar;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &menubar_class, NULL)
-	    || JS_InstanceOf(ctx, obj, (JSClass *) &statusbar_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of either
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &menubar_class, NULL)
+	 && !JS_InstanceOf(ctx, obj, (JSClass *) &statusbar_class, NULL))
+		return JS_FALSE;
 	parent_win = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
 	if_assert_failed return JS_FALSE;
@@ -134,9 +137,12 @@ unibar_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	struct session_status *status;
 	unsigned char *bar;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &menubar_class, NULL)
-	    || JS_InstanceOf(ctx, obj, (JSClass *) &statusbar_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of either
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &menubar_class, NULL)
+	 && !JS_InstanceOf(ctx, obj, (JSClass *) &statusbar_class, NULL))
+		return JS_FALSE;
 	parent_win = JS_GetParent(ctx, obj);
 	assert(JS_InstanceOf(ctx, parent_win, (JSClass *) &window_class, NULL));
 	if_assert_failed return JS_FALSE;

src/ecmascript/spidermonkey/window.c

@@ -120,8 +120,11 @@ window_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 {
 	struct view_state *vs;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &window_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &window_class, NULL))
+		return JS_FALSE;
 
 	vs = JS_GetPrivate(ctx, obj); /* from @window_class */
 
@@ -242,8 +245,11 @@ window_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 {
 	struct view_state *vs;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &window_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &window_class, NULL))
+		return JS_FALSE;
 
 	vs = JS_GetPrivate(ctx, obj); /* from @window_class */
 

src/scripting/smjs/bookmarks.c

@@ -80,8 +80,11 @@ bookmark_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 {
 	struct bookmark *bookmark;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_class, NULL))
+		return JS_FALSE;
 
 	bookmark = JS_GetPrivate(ctx, obj); /* from @bookmark_class */
 
@@ -121,8 +124,11 @@ bookmark_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 {
 	struct bookmark *bookmark;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_class, NULL))
+		return JS_FALSE;
 
 	bookmark = JS_GetPrivate(ctx, obj); /* from @bookmark_class */
 
@@ -191,8 +197,11 @@ bookmark_folder_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	struct bookmark *folder;
 	unsigned char *title;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_folder_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &bookmark_folder_class, NULL))
+		return JS_FALSE;
 
 	folder = JS_GetPrivate(ctx, obj); /* from @bookmark_folder_class */
 

src/scripting/smjs/cache_object.c

@@ -39,8 +39,11 @@ cache_entry_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 {
 	struct cache_entry *cached;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &cache_entry_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &cache_entry_class, NULL))
+		return JS_FALSE;
 
 	cached = JS_GetPrivate(ctx, obj); /* from @cache_entry_class */
 
@@ -96,8 +99,11 @@ cache_entry_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 {
 	struct cache_entry *cached;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &cache_entry_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &cache_entry_class, NULL))
+		return JS_FALSE;
 
 	cached = JS_GetPrivate(ctx, obj); /* from @cache_entry_class */
 

src/scripting/smjs/keybinding.c

@@ -23,8 +23,11 @@ keymap_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	unsigned char *keystroke_str;
 	int *data;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &keymap_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &keymap_class, NULL))
+		return JS_FALSE;
 
 	data = JS_GetPrivate(ctx, obj); /* from @keymap_class */
 
@@ -74,8 +77,11 @@ keymap_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 	unsigned char *keymap_str;
 	unsigned char *keystroke_str;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &keymap_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &keymap_class, NULL))
+		return JS_FALSE;
 
 	data = JS_GetPrivate(ctx, obj); /* from @keymap_class */
 

src/scripting/smjs/view_state_object.c

@@ -35,8 +35,11 @@ view_state_get_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 {
 	struct view_state *vs;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &view_state_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &view_state_class, NULL))
+		return JS_FALSE;
 
 	vs = JS_GetPrivate(ctx, obj); /* from @view_state_class */
 
@@ -69,8 +72,11 @@ view_state_set_property(JSContext *ctx, JSObject *obj, jsval id, jsval *vp)
 {
 	struct view_state *vs;
 
-	assert(JS_InstanceOf(ctx, obj, (JSClass *) &view_state_class, NULL));
-	if_assert_failed return JS_FALSE;
+	/* This can be called if @obj if not itself an instance of the
+	 * appropriate class but has one in its prototype chain.  Fail
+	 * such calls.  */
+	if (!JS_InstanceOf(ctx, obj, (JSClass *) &view_state_class, NULL))
+		return JS_FALSE;
 
 	vs = JS_GetPrivate(ctx, obj); /* from @view_state_class */