tor-browser

commit 3b0b55dd92ef54f67d937ef546afcd27aad57c04
parent 4e173130d6e5eb57277ea254825c15111f9410d3
Author: alexical <dothayer@mozilla.com>
Date:   Thu, 16 Oct 2025 14:03:55 +0000

Bug 1992249 - Fix getter/setter magic value mismatch r=ochameau,devtools-reviewers

Differential Revision: https://phabricator.services.mozilla.com/D268004

Diffstat:
M
devtools/client/shared/components/reps/reps/value-summary-reader.mjs
 | 
2
+-
M
js/public/Debug.h
 | 
2
+-
M
js/src/debugger/ExecutionTracer.cpp
 | 
1
+
M
js/src/jit-test/tests/debug/ExecutionTracer-traced-values.js
 | 
21
++++++++++++++++++++-

4 files changed, 23 insertions(+), 3 deletions(-)
diff --git a/devtools/client/shared/components/reps/reps/value-summary-reader.mjs b/devtools/client/shared/components/reps/reps/value-summary-reader.mjs
@@ -17,7 +17,7 @@ const JSVAL_TYPE_SYMBOL = 0x07;
 const JSVAL_TYPE_BIGINT = 0x09;
 const JSVAL_TYPE_OBJECT = 0x0c;
 
-const GETTER_SETTER_MAGIC = 0xf0;
+const GETTER_SETTER_MAGIC = 0x0f;
 
 const GENERIC_OBJECT_HAS_DENSE_ELEMENTS = 1;
 
diff --git a/js/public/Debug.h b/js/public/Debug.h
@@ -280,7 +280,7 @@ struct ValueSummary {
 struct ObjectSummary {
   // This is a special value for ValueSummary::typeAndFlags. It should be noted
   // that this only works as long as 0xf is not a valid JS::ValueType.
-  static const uint8_t GETTER_SETTER_MAGIC = 0xf0;
+  static const uint8_t GETTER_SETTER_MAGIC = 0x0f;
 
   enum class Kind : uint8_t {
     NotImplemented,
diff --git a/js/src/debugger/ExecutionTracer.cpp b/js/src/debugger/ExecutionTracer.cpp
@@ -668,6 +668,7 @@ void ValueSummaries::writeHeader(JS::ValueType type, uint8_t flags) {
   JS::ValueSummary header;
   header.type = type;
   header.flags = flags;
+  MOZ_ASSERT(*reinterpret_cast<uint8_t*>(&header) != JS::ObjectSummary::GETTER_SETTER_MAGIC);
   valueData_->writeBytes(reinterpret_cast<const uint8_t*>(&header),
                          sizeof(header));
 }
diff --git a/js/src/jit-test/tests/debug/ExecutionTracer-traced-values.js b/js/src/jit-test/tests/debug/ExecutionTracer-traced-values.js
@@ -14,7 +14,7 @@ const JSVAL_TYPE_SYMBOL = 0x07;
 const JSVAL_TYPE_BIGINT = 0x09;
 const JSVAL_TYPE_OBJECT = 0x0c;
 
-const GETTER_SETTER_MAGIC = 0xf0;
+const GETTER_SETTER_MAGIC = 0x0f;
 
 const GENERIC_OBJECT_HAS_DENSE_ELEMENTS = 1;
 
@@ -159,6 +159,7 @@ wrappedNumber.foo = 0;
   function foobaz(a, a) {},
   function barbaz(a, ...rest) {},
   ccw.wrappedObject,
+  {get testGetter() {return 42}},
 ].map(function f1(x) { return x; });`);
 
 const trace = g.getExecutionTrace();
@@ -610,5 +611,23 @@ testSingleArgument(events.shift(), reader => {
   assertEq(reader.readUint8(), JSVAL_TYPE_INT32 | inlinedInt32Flags(0));
 });
 
+testSingleArgument(events.shift(), reader => {
+  assertEq(reader.readUint8(), JSVAL_TYPE_OBJECT);
+  assertEq(reader.readUint8(), OBJECT_KIND_GENERIC_OBJECT);
+
+  let shape = trace[0].shapeSummaries[reader.readUint32()];
+  assertEq(shape.length, 2);
+  assertEq(shape[0], "Object");
+  assertEq(shape[1], "testGetter");
+
+  assertEq(reader.readUint32(), 1);
+  assertEq(reader.readUint8(), GETTER_SETTER_MAGIC);
+  assertEq(reader.readUint8(), JSVAL_TYPE_OBJECT);
+  assertEq(reader.readUint8(), OBJECT_KIND_FUNCTION);
+  assertEq(reader.readString(), "get testGetter");
+  assertEq(reader.readUint32(), 0);
+  assertEq(reader.readUint8(), JSVAL_TYPE_UNDEFINED);
+});
+
 assertEq(events.length, 0);