Merging upstream version 127.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

5 files changed, 54 insertions, 0 deletions

diff --git a/js/src/debugger/DebugAPI-inl.h b/js/src/debugger/DebugAPI-inl.h
index 77f81b800f..63d80e3d90 100644
--- a/js/src/debugger/DebugAPI-inl.h
+++ b/js/src/debugger/DebugAPI-inl.h
@@ -142,6 +142,15 @@ NativeResumeMode DebugAPI::onNativeCall(JSContext* cx, const CallArgs& args,
 }
 
 /* static */
+bool DebugAPI::shouldAvoidSideEffects(JSContext* cx) {
+  if (MOZ_UNLIKELY(cx->realm()->isDebuggee())) {
+    return slowPathShouldAvoidSideEffects(cx);
+  }
+
+  return false;
+}
+
+/* static */
 bool DebugAPI::onDebuggerStatement(JSContext* cx, AbstractFramePtr frame) {
   if (MOZ_UNLIKELY(cx->realm()->isDebuggee())) {
     return slowPathOnDebuggerStatement(cx, frame);
diff --git a/js/src/debugger/DebugAPI.h b/js/src/debugger/DebugAPI.h
index df082ab5ba..67f3b62883 100644
--- a/js/src/debugger/DebugAPI.h
+++ b/js/src/debugger/DebugAPI.h
@@ -7,6 +7,7 @@
 #ifndef debugger_DebugAPI_h
 #define debugger_DebugAPI_h
 
+#include "js/Debug.h"
 #include "vm/GlobalObject.h"
 #include "vm/Interpreter.h"
 #include "vm/JSContext.h"
@@ -228,6 +229,8 @@ class DebugAPI {
                                               const CallArgs& args,
                                               CallReason reason);
 
+  static inline bool shouldAvoidSideEffects(JSContext* cx);
+
   /*
    * Announce to the debugger a |debugger;| statement on has been
    * encountered on the youngest JS frame on |cx|. Call whatever hooks have
@@ -385,6 +388,7 @@ class DebugAPI {
   static NativeResumeMode slowPathOnNativeCall(JSContext* cx,
                                                const CallArgs& args,
                                                CallReason reason);
+  static bool slowPathShouldAvoidSideEffects(JSContext* cx);
   [[nodiscard]] static bool slowPathOnDebuggerStatement(JSContext* cx,
                                                         AbstractFramePtr frame);
   [[nodiscard]] static bool slowPathOnExceptionUnwind(JSContext* cx,
diff --git a/js/src/debugger/Debugger.cpp b/js/src/debugger/Debugger.cpp
index 37c1e79a9d..44bd1a8eaa 100644
--- a/js/src/debugger/Debugger.cpp
+++ b/js/src/debugger/Debugger.cpp
@@ -536,6 +536,7 @@ Debugger::Debugger(JSContext* cx, NativeObject* dbg)
       exclusiveDebuggerOnEval(false),
       inspectNativeCallArguments(false),
       collectCoverageInfo(false),
+      shouldAvoidSideEffects(false),
       observedGCs(cx->zone()),
       allocationsLog(cx),
       trackingAllocationSites(false),
@@ -1049,6 +1050,12 @@ NativeResumeMode DebugAPI::slowPathOnNativeCall(JSContext* cx,
   return NativeResumeMode::Continue;
 }
 
+/* static */
+bool DebugAPI::slowPathShouldAvoidSideEffects(JSContext* cx) {
+  return DebuggerExists(
+      cx->global(), [=](Debugger* dbg) { return dbg->shouldAvoidSideEffects; });
+}
+
 /*
  * RAII class to mark a generator as "running" temporarily while running
  * debugger code.
@@ -4187,6 +4194,8 @@ struct MOZ_STACK_CLASS Debugger::CallData {
   bool setOnEnterFrame();
   bool getOnNativeCall();
   bool setOnNativeCall();
+  bool getShouldAvoidSideEffects();
+  bool setShouldAvoidSideEffects();
   bool getOnNewGlobalObject();
   bool setOnNewGlobalObject();
   bool getOnNewPromise();
@@ -4405,6 +4414,22 @@ bool Debugger::CallData::setOnNativeCall() {
   return true;
 }
 
+bool Debugger::CallData::getShouldAvoidSideEffects() {
+  args.rval().setBoolean(dbg->shouldAvoidSideEffects);
+  return true;
+}
+
+bool Debugger::CallData::setShouldAvoidSideEffects() {
+  if (!args.requireAtLeast(cx, "Debugger.set shouldAvoidSideEffects", 1)) {
+    return false;
+  }
+
+  dbg->shouldAvoidSideEffects = ToBoolean(args[0]);
+
+  args.rval().setUndefined();
+  return true;
+}
+
 bool Debugger::CallData::getOnNewGlobalObject() {
   return getHookImpl(cx, args, *dbg, OnNewGlobalObject);
 }
@@ -4608,6 +4633,11 @@ GlobalObject* Debugger::unwrapDebuggeeArgument(JSContext* cx, const Value& v) {
     return nullptr;
   }
 
+  if (JS_IsDeadWrapper(obj)) {
+    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_DEAD_OBJECT);
+    return nullptr;
+  }
+
   // If that didn't produce a global object, it's an error.
   if (!obj->is<GlobalObject>()) {
     JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
@@ -6518,6 +6548,8 @@ const JSPropertySpec Debugger::properties[] = {
     JS_DEBUG_PSGS("onPromiseSettled", getOnPromiseSettled, setOnPromiseSettled),
     JS_DEBUG_PSGS("onEnterFrame", getOnEnterFrame, setOnEnterFrame),
     JS_DEBUG_PSGS("onNativeCall", getOnNativeCall, setOnNativeCall),
+    JS_DEBUG_PSGS("shouldAvoidSideEffects", getShouldAvoidSideEffects,
+                  setShouldAvoidSideEffects),
     JS_DEBUG_PSGS("onNewGlobalObject", getOnNewGlobalObject,
                   setOnNewGlobalObject),
     JS_DEBUG_PSGS("uncaughtExceptionHook", getUncaughtExceptionHook,
@@ -7259,5 +7291,9 @@ JS_PUBLIC_API bool FireOnGarbageCollectionHook(
   return true;
 }
 
+bool ShouldAvoidSideEffects(JSContext* cx) {
+  return DebugAPI::shouldAvoidSideEffects(cx);
+}
+
 }  // namespace dbg
 }  // namespace JS
diff --git a/js/src/debugger/Debugger.h b/js/src/debugger/Debugger.h
index 5155927419..537e47b913 100644
--- a/js/src/debugger/Debugger.h
+++ b/js/src/debugger/Debugger.h
@@ -652,6 +652,10 @@ class Debugger : private mozilla::LinkedListElement<Debugger> {
   // Whether to enable code coverage on the Debuggee.
   bool collectCoverageInfo;
 
+  // Whether to ask avoid side-effects in the native code.
+  // See JS::dbg::ShouldAvoidSideEffects.
+  bool shouldAvoidSideEffects;
+
   template <typename T>
   struct DebuggerLinkAccess {
     static mozilla::DoublyLinkedListElement<T>& Get(T* aThis) {
diff --git a/js/src/debugger/Script.cpp b/js/src/debugger/Script.cpp
index 29ea9f1ea1..933dd6d362 100644
--- a/js/src/debugger/Script.cpp
+++ b/js/src/debugger/Script.cpp
@@ -1620,6 +1620,7 @@ static bool BytecodeIsEffectful(JSScript* script, size_t offset) {
     case JSOp::Object:
     case JSOp::Typeof:
     case JSOp::TypeofExpr:
+    case JSOp::TypeofEq:
     case JSOp::ToAsyncIter:
     case JSOp::ToPropertyKey:
     case JSOp::Lambda: