751139 - Assertion failure: fun->isBoundFunction(), at jsfun.cpp:807 or Crash [@ js::CallOrConstructBoundFunction]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following test crashes on mozilla-central revision 281574985410 (no options required):


function C(a, b) {}
var f = C.bind(null, 2);
g = clone(f, this);
a_squared = g(2);


The test uses the shell-only function "clone", however, in the browser, functions are cloned the same way for event handlers I believe. The crash does not look security-sensitive (probably null-deref).

Comment 1

[Tom S [:evilpie]]

So I would like to work on this, but I am not sure what we want here. Do we want to allow cloning of bound-functions at all? If yes what about the bound arguments and the this parameter, do we need to clone/wrap them in some way, too?

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

This bug has been around since (and probably even before) March 2011 on rev http://hg.mozilla.org/mozilla-central/rev/d796fb18f555

Comment 3

[Jeff Walden [:Waldo]]

I could be wrong about this, but the event-handler cloning is for XBL, and for event handlers declared in XBL code.  Those are not bound functions of the sort at issue here (which I believe can only be created by Function.prototype.bind).

If we set that aside, I think this may just be a matter of requiring clone() to not clone bound functions, and it wouldn't be anything more than a shell bug.  But maybe I'm missing something.

Comment 4

[Tom S [:evilpie]]

Attachment: disallow cloning of bound functions

Thank you very much for this analysis Jeff.
This makes this bug indeed very easy, I am just checking for bound functions in JS_CloneFunctionObject. I like this more then doing it in "clone", because it makes the API safer to use.

Comment 5

[Tom S [:evilpie]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/49ce375916e8

Comment 6

[Matt Brubeck (:mbrubeck)]

https://hg.mozilla.org/mozilla-central/rev/49ce375916e8

Comment 7

[Christian Holler (:decoder)]

A testcase for this bug was automatically identified at js/src/jit-test/tests/basic/bug751139.js.