tor-browser

commit feab854a48140a2489368bc0c7770f30292dd030
parent e22a5afe554f89a422d008031db5b50d6dd9d709
Author: Daniel Minor <dminor@mozilla.com>
Date:   Thu, 18 Dec 2025 14:59:26 +0000

Bug 2006750 - Fix accidental exposure of Promise.allKeyed and allSettledKey; r=arai

This also reverts the changes to test_xrayToJS.xhtml, we shouldn't
change that test until we're ready to ship the feature.

Differential Revision: https://phabricator.services.mozilla.com/D276922

Diffstat:
M
js/src/vm/JSObject.cpp
 | 
11
+++++------
M
js/xpconnect/tests/chrome/test_xrayToJS.xhtml
 | 
8
+-------

2 files changed, 6 insertions(+), 13 deletions(-)
diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp
@@ -2229,6 +2229,11 @@ JS_PUBLIC_API bool js::ShouldIgnorePropertyDefinition(JSContext* cx,
         (id == NameToId(cx->names().range))) {
       return true;
     }
+    if (!JS::Prefs::experimental_promise_allkeyed() &&
+        (id == NameToId(cx->names().allKeyed) ||
+         id == NameToId(cx->names().allSettledKeyed))) {
+      return true;
+    }
   }
   if (key == JSProto_Map || key == JSProto_WeakMap) {
     if (!JS::Prefs::experimental_upsert() &&
@@ -2256,12 +2261,6 @@ JS_PUBLIC_API bool js::ShouldIgnorePropertyDefinition(JSContext* cx,
       return true;
     }
   }
-  if (key == JSProto_Promise && !JS::Prefs::experimental_promise_allkeyed()) {
-    if (id == NameToId(cx->names().allKeyed) ||
-        id == NameToId(cx->names().allSettledKeyed)) {
-      return true;
-    }
-  }
 #endif
 
   if (key == JSProto_Function &&
diff --git a/js/xpconnect/tests/chrome/test_xrayToJS.xhtml b/js/xpconnect/tests/chrome/test_xrayToJS.xhtml
@@ -300,15 +300,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=933681
   gPrototypeProperties.Promise =
     ["constructor", "catch", "then", "finally", Symbol.toStringTag];
 
-  if ("allKeyed" in Promise) {
-    gConstructorProperties.Promise =
-      constructorProps(["resolve", "reject", "all", "allSettled", "allKeyed", "allSettledKeyed", "any", "race", "try",
-                        "withResolvers", Symbol.species]);
-  } else {
-    gConstructorProperties.Promise =
+  gConstructorProperties.Promise =
       constructorProps(["resolve", "reject", "all", "allSettled", "any", "race", "try",
                         "withResolvers", Symbol.species]);
-  }
 
   gPrototypeProperties.ArrayBuffer =
     ["constructor", "byteLength", "detached", "slice", Symbol.toStringTag, "transfer", "transferToFixedLength", "maxByteLength", "resizable", "resize"];