700295 - Crash at its_getter

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase asserts on jaegermonkey branch revision 1210706b4576 (run with -m -n -a), tested on 64 bit:


this.__proto__ = null;
Object.prototype.__proto__ = this;
function exploreProperties(obj) {
  var props = [];
  for (var o = obj; o; o = Object.getPrototypeOf(o)) {
    props = props.concat(Object.getOwnPropertyNames(o));
  }
  for (var i = 0; i < props.length; ++i) {
    var p = props[i];
    var v = obj[p];
  }
}
var c = [{}];
exploreProperties(c);

Comment 1

[Brian Hackett [Laid off!]]

This testcase crashes on m-i cset e05e46646dc3.

its_getter and its_setter (PropertyOp hooks only defined in the shell) do not have checks that they are being called on the right object, and will go straight to the object's private data.  The accessed object is an array; this crashes on JM because on JM arrays do not have private data, and crashes on trunk because the array private data is an integer (array length) rather than a pointer (as expected by the hook).

Comment 2

[Brian Hackett [Laid off!]]

Attachment: patch (95d98e8ab9f3)

I guess this is the right fix, though I don't know how the PropertyOp API works so well.

Comment 3

[Jeff Walden [:Waldo]]

Comment on attachment 573207 [details] [diff] [review]
patch (95d98e8ab9f3)

Review of attachment 573207 [details] [diff] [review]:
-----------------------------------------------------------------

I wonder how many of the bugs related to the its class are bugs due to its buggy implementation, versus bugs that reveal actual problems.

Comment 4

[Jeff Walden [:Waldo]]

I feel like at some point I wrote comment 1 in another bug, then nobody acted on it because it wasn't an actual bug, and it got rediscovered here in a somewhat different manner.  But I might be wrong about that.  :-\

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/c2ed79d6fea9

Comment 7

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/c2ed79d6fea9

Comment 9

[Christian Holler (:decoder)]

Automatically extracted testcase for this bug was committed:

https://hg.mozilla.org/mozilla-central/rev/2e891e0db397