From dc42d67bcc8b08f1169187456dc108d85e54d13f Mon Sep 17 00:00:00 2001
From: Tooru Fujisawa <arai_a@mac.com>
Date: Mon, 22 Jan 2024 17:17:16 +0000
Subject: [PATCH] Bug 1875114 - Fix argument validation in stencil testing
 functions. r=bthrall

Differential Revision: https://phabricator.services.mozilla.com/D198908
---
 js/src/builtin/TestingFunctions.cpp      |  9 +++++----
 js/src/jit-test/tests/xdr/stencil-arg.js | 21 +++++++++++++++++++++
 js/src/shell/js.cpp                      |  5 +++--
 3 files changed, 29 insertions(+), 6 deletions(-)
 create mode 100644 js/src/jit-test/tests/xdr/stencil-arg.js

diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 309a30d4e215e..6f9a642dab649 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -7218,13 +7218,13 @@ static bool EvalStencil(JSContext* cx, uint32_t argc, Value* vp) {
 
   /* Prepare the input byte array. */
   if (!args[0].isObject()) {
-    JS_ReportErrorASCII(cx, "evalStencil: Object expected");
+    JS_ReportErrorASCII(cx, "evalStencil: Stencil object expected");
     return false;
   }
   Rooted<js::StencilObject*> stencilObj(
       cx, args[0].toObject().maybeUnwrapIf<js::StencilObject>());
   if (!stencilObj) {
-    JS_ReportErrorASCII(cx, "evalStencil: Stencil expected");
+    JS_ReportErrorASCII(cx, "evalStencil: Stencil object expected");
     return false;
   }
 
@@ -7395,12 +7395,13 @@ static bool EvalStencilXDR(JSContext* cx, uint32_t argc, Value* vp) {
 
   /* Prepare the input byte array. */
   if (!args[0].isObject()) {
-    JS_ReportErrorASCII(cx, "evalStencilXDR: stencil XDR object expected");
+    JS_ReportErrorASCII(cx, "evalStencilXDR: Stencil XDR object expected");
+    return false;
   }
   Rooted<StencilXDRBufferObject*> xdrObj(
       cx, args[0].toObject().maybeUnwrapIf<StencilXDRBufferObject>());
   if (!xdrObj) {
-    JS_ReportErrorASCII(cx, "evalStencilXDR: stencil XDR object expected");
+    JS_ReportErrorASCII(cx, "evalStencilXDR: Stencil XDR object expected");
     return false;
   }
   MOZ_ASSERT(xdrObj->hasBuffer());
diff --git a/js/src/jit-test/tests/xdr/stencil-arg.js b/js/src/jit-test/tests/xdr/stencil-arg.js
new file mode 100644
index 0000000000000..606cf3255a1ab
--- /dev/null
+++ b/js/src/jit-test/tests/xdr/stencil-arg.js
@@ -0,0 +1,21 @@
+const tests = [
+  () => evalStencil(1),
+  () => evalStencil({}),
+  () => evalStencilXDR(1),
+  () => evalStencilXDR({}),
+  () => instantiateModuleStencil(1),
+  () => instantiateModuleStencil({}),
+  () => instantiateModuleStencilXDR(1),
+  () => instantiateModuleStencilXDR({}),
+];
+
+for (const test of tests) {
+  let caught = false;
+  try {
+    test();
+  } catch (e) {
+    assertEq(/Stencil( XDR)? object expected/.test(e.message), true);
+    caught = true;
+  }
+  assertEq(caught, true);
+}
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 93051cd0bd216..3561ed4ca85d3 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -5256,6 +5256,7 @@ static bool InstantiateModuleStencil(JSContext* cx, uint32_t argc, Value* vp) {
   if (!args[0].isObject()) {
     JS_ReportErrorASCII(cx,
                         "instantiateModuleStencil: Stencil object expected");
+    return false;
   }
   Rooted<js::StencilObject*> stencilObj(
       cx, args[0].toObject().maybeUnwrapIf<js::StencilObject>());
@@ -5326,14 +5327,14 @@ static bool InstantiateModuleStencilXDR(JSContext* cx, uint32_t argc,
   /* Prepare the input byte array. */
   if (!args[0].isObject()) {
     JS_ReportErrorASCII(
-        cx, "instantiateModuleStencilXDR: stencil XDR object expected");
+        cx, "instantiateModuleStencilXDR: Stencil XDR object expected");
     return false;
   }
   Rooted<StencilXDRBufferObject*> xdrObj(
       cx, args[0].toObject().maybeUnwrapIf<StencilXDRBufferObject>());
   if (!xdrObj) {
     JS_ReportErrorASCII(
-        cx, "instantiateModuleStencilXDR: stencil XDR object expected");
+        cx, "instantiateModuleStencilXDR: Stencil XDR object expected");
     return false;
   }
   MOZ_ASSERT(xdrObj->hasBuffer());