SERVER-9878 Add type checks to V8 C++ bindings

The main focus of this ticket is tightening up input validation in
our V8 bindings. Doing this required normalizing the way we create
custom types in JS that have special C++-driven behavior. All special
types now use FunctionTemplates that are attached to the V8Scope object.
This allows us to test if an object is of the correct type before using
it.

Other related tickets partially addressed:
SERVER-8961 Differences in argument validation of custom types between v8 and Spidermonkey
SERVER-9803 Handle regular expression parse errors without seg faulting

1 files changed, 13 insertions, 0 deletions

diff --git a/src/mongo/dbtests/jstests.cpp b/src/mongo/dbtests/jstests.cpp
index 75d03816e04..1542ecf0b20 100644
--- a/src/mongo/dbtests/jstests.cpp
+++ b/src/mongo/dbtests/jstests.cpp
@@ -439,6 +439,19 @@ namespace JSTests {
                 ASSERT_EQUALS( (string)"^a" , out["a"].regex() );
                 ASSERT_EQUALS( (string)"i" , out["a"].regexFlags() );
 
+                // This regex used to cause a segfault because x isn't a valid flag for a js RegExp.
+                // Now it throws a JS exception.
+                BSONObj invalidRegex = BSON_ARRAY(BSON("regex" << BSONRegEx("asdf", "x")));
+                const char* code = "function (obj) {"
+                                   "    var threw = false;"
+                                   "    try {"
+                                   "        obj.regex;" // should throw
+                                   "    } catch(e) {"
+                                   "         threw = true;"
+                                   "    }"
+                                   "    assert(threw);"
+                                   "}";
+                ASSERT_EQUALS(s->invoke(code, &invalidRegex, NULL), 0);
             }
 
             // array