script: Properly throw when "this" is not an object in a generic call.

servo · bors-servo · Sep 17, 2017 · Sep 17, 2017 · Sep 17, 2017 · Sep 17, 2017
commit 91f238f3263f8a0080b9f63b808990094f61cd51
diff --git a/components/script/dom/bindings/utils.rs b/components/script/dom/bindings/utils.rs
@@ -414,18 +414,22 @@ unsafe fn generic_call(cx: *mut JSContext,
                                               -> bool)
                        -> bool {
     let args = CallArgs::from_vp(vp, argc);
+
+    let info = RUST_FUNCTION_VALUE_TO_JITINFO(JS_CALLEE(cx, vp));
+    let proto_id = (*info).protoID;
+
     let thisobj = args.thisv();
     if !thisobj.get().is_null_or_undefined() && !thisobj.get().is_object() {
+        throw_invalid_this(cx, proto_id);
         return false;
     }
+
     let obj = if thisobj.get().is_object() {
         thisobj.get().to_object()
     } else {
         GetGlobalForObjectCrossCompartment(JS_CALLEE(cx, vp).to_object_or_null())
     };
     rooted!(in(cx) let obj = obj);
-    let info = RUST_FUNCTION_VALUE_TO_JITINFO(JS_CALLEE(cx, vp));
-    let proto_id = (*info).protoID;
     let depth = (*info).depth;
     let proto_check = |class: &'static DOMClass| {
         class.interface_chain[depth as usize] as u16 == proto_id

diff --git a/tests/wpt/mozilla/meta/MANIFEST.json b/tests/wpt/mozilla/meta/MANIFEST.json
@@ -14739,6 +14739,12 @@
      {}
     ]
    ],
+   "mozilla/invalid-this.html": [
+    [
+     "/_mozilla/mozilla/invalid-this.html",
+     {}
+    ]
+   ],
    "mozilla/iterable.html": [
     [
      "/_mozilla/mozilla/iterable.html",

    "c9dcc4f24540914b3be1ef18f13b721773eb76be",
    "testharness"
   ],
+  "mozilla/invalid-this.html": [
+   "4ed18511e6399b356fe196b92f72dd16a9019f55",
+   "testharness"
+  ],
   "mozilla/iterable.html": [
    "66f05b1f12b8be392705f5ba4a96c70b9226721d",
    "testharness"
diff --git a/tests/wpt/mozilla/tests/mozilla/invalid-this.html b/tests/wpt/mozilla/tests/mozilla/invalid-this.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>Test for #18535: Wrong type arguments to some JS functions abort the execution of the script.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+test(function() {
+  assert_throws(new TypeError(), function() { window.atob.call("", localStorage); })
+  assert_throws(new TypeError(), function() { window.removeEventListener.call("", ""); })
+  assert_throws(new TypeError(), function() { window.alert.call(""); })
+  assert_throws(new TypeError(), function() { window.moveTo.call(128); })
+})
+</script>