diff --git a/js/src/tests/non262/taint/switch-case.js b/js/src/tests/non262/taint/switch-case.js new file mode 100644 index 0000000000000..e292d4810a343 --- /dev/null +++ b/js/src/tests/non262/taint/switch-case.js @@ -0,0 +1,28 @@ +function taintSwitchCaseTest() { + + let tableSwitchOptimized = 1; + let tableSwitchOptimizedTainted = Number.tainted(tableSwitchOptimized); + + switch (tableSwitchOptimizedTainted) { + case tableSwitchOptimized: + break; + default: + throw new Error("Taints should not be propagated in optimized switch cases"); + } + + let tableSwitchUnoptimized = 123456789; + let tableSwitchUnoptimizedTainted = Number.tainted(tableSwitchUnoptimized); + + switch (tableSwitchUnoptimizedTainted) { + case tableSwitchUnoptimized: + break; + default: + throw new Error("Taints should not be propagated in optimized switch cases"); + } +} + +runTaintTest(taintSwitchCaseTest); + +if (typeof reportCompare === 'function') + reportCompare(true, true); + diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp index a2d58b5590b04..d1bfdf1786dfb 100644 --- a/js/src/vm/Interpreter.cpp +++ b/js/src/vm/Interpreter.cpp @@ -3330,6 +3330,9 @@ bool MOZ_NEVER_INLINE JS_HAZ_JSNATIVE_CALLER js::Interpret(JSContext* cx, int32_t i; if (rref.isInt32()) { i = rref.toInt32(); + } + else if (isTaintedNumber(rref)) { + i = rref.toObject().as().unbox(); } else { /* Use mozilla::NumberEqualsInt32 to treat -0 (double) as 0. */ if (!rref.isDouble() || !NumberEqualsInt32(rref.toDouble(), &i)) {