fix: check that setTimeout/setInterval handler is an object before casting to an object

Jake Champion · JakeChampion · commit 62476f532442 · 2023-01-06T15:19:39.000Z
diff --git a/c-dependencies/js-compute-runtime/js-compute-builtins.cpp b/c-dependencies/js-compute-runtime/js-compute-builtins.cpp
@@ -4889,12 +4889,12 @@ template <bool repeat> bool setTimeout_or_interval(JSContext *cx, unsigned argc,
     return false;
   }
 
-  RootedObject handler(cx, &args[0].toObject());
   if (!(args[0].isObject() && JS::IsCallable(&args[0].toObject()))) {
     JS_ReportErrorASCII(cx, "First argument to %s must be a function",
                         repeat ? "setInterval" : "setTimeout");
     return false;
   }
+  RootedObject handler(cx, &args[0].toObject());
 
   int32_t delay = 0;
   if (args.length() > 1 && !JS::ToInt32(cx, args.get(1), &delay)) {

Original file line number	Diff line number	Diff line change
`@@ -4889,12 +4889,12 @@ template <bool repeat> bool setTimeout_or_interval(JSContext *cx, unsigned argc,`
`4889`	`4889`	`return false;`
`4890`	`4890`	`}`
`4891`	`4891`
`4892`		`- RootedObject handler(cx, &args[0].toObject());`
`4893`	`4892`	`if (!(args[0].isObject() && JS::IsCallable(&args[0].toObject()))) {`
`4894`	`4893`	`JS_ReportErrorASCII(cx, "First argument to %s must be a function",`
`4895`	`4894`	`repeat ? "setInterval" : "setTimeout");`
`4896`	`4895`	`return false;`
`4897`	`4896`	`}`
	`4897`	`+ RootedObject handler(cx, &args[0].toObject());`
`4898`	`4898`
`4899`	`4899`	`int32_t delay = 0;`
`4900`	`4900`	`if (args.length() > 1 && !JS::ToInt32(cx, args.get(1), &delay)) {`