1362262 - "getSelfHostedValue" function shoud check the arguments

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Iris]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2486.0 Safari/537.36 Edge/13.10586

Steps to reproduce:

The following testcase crashes on mozilla-central latest revision  b043233ec04f.

testcase.js 
getSelfHostedValue('for (let x in x) {break;}return eval("x");');


Actual results:

Program received signal SIGSEGV, Segmentation fault.
0x0000000001383684 in maybeSlot (this=0x0) at mozilla-latest/js/src/vm/Shape.h:912
912	        return slotInfo & SLOT_MASK;

backtrace:
#0  0x0000000001383684 in maybeSlot (this=0x0) at /home/qy/Downloads/mozilla-latest/js/src/vm/Shape.h:912
#1  slot (this=0x0) at /home/qy/Downloads/mozilla-latest/js/src/vm/Shape.h:910
#2  GetUnclonedValue (cx=0x7ffff695d800, selfHostedObject=..., id=..., vp=...)
    at /home/qy/Downloads/mozilla-latest/js/src/vm/SelfHosting.cpp:2994
#3  getUnclonedSelfHostedValue (cx=0x7ffff695d800, vp=..., this=<optimized out>, name=...)
    at /home/qy/Downloads/mozilla-latest/js/src/vm/SelfHosting.cpp:3252
#4  JSRuntime::cloneSelfHostedValue (this=0x7ffff6954000, cx=0x7ffff695d800, name=..., vp=...)
    at /home/qy/Downloads/mozilla-latest/js/src/vm/SelfHosting.cpp:3269
#5  0x000000000046e4a9 in GetSelfHostedValue (cx=0x7ffff695d800, argc=<optimized out>, vp=0x7fffefdff090)
    at /home/qy/Downloads/mozilla-latest/js/src/shell/js.cpp:5190
#6  0x00000000006244a5 in CallJSNative (native=0x46e360 <GetSelfHostedValue(JSContext*, unsigned int, JS::Value*)>, cx=<optimized out>, args=...)
    at /home/qy/Downloads/mozilla-latest/js/src/jscntxtinlines.h:291
#7  js::InternalCallOrConstruct (cx=0x7ffff695d800, args=..., construct=<optimized out>)
    at /home/qy/Downloads/mozilla-latest/js/src/vm/Interpreter.cpp:455
#8  0x0000000000617ce5 in CallFromStack (cx=0x7ffff695d800, args=...) at /home/qy/Downloads/mozilla-latest/js/src/vm/Interpreter.cpp:506
#9  Interpret (cx=0x7ffff695d800, state=...) at /home/qy/Downloads/mozilla-latest/js/src/vm/Interpreter.cpp:2997
#10 0x00000000005fe011 in js::RunScript (cx=0x7ffff695d800, state=...) at /home/qy/Downloads/mozilla-latest/js/src/vm/Interpreter.cpp:395
#11 0x000000000062781f in js::ExecuteKernel (cx=0x7ffff695d800, script=..., envChainArg=..., newTargetValue=..., evalInFrame=..., result=0x0)
    at /home/qy/Downloads/mozilla-latest/js/src/vm/Interpreter.cpp:684
#12 0x0000000000627b86 in js::Execute (cx=0x7ffff695d800, script=..., envChainArg=..., rval=0x0)
    at /home/qy/Downloads/mozilla-latest/js/src/vm/Interpreter.cpp:716
#13 0x0000000000e61188 in JS_ExecuteScript (cx=0x7ffff695d800, scriptArg=...) at /home/qy/Downloads/mozilla-latest/js/src/jsapi.cpp:4556
#14 0x00000000004763cb in RunFile (cx=<optimized out>, filename=<optimized out>, file=<optimized out>, compileOnly=<optimized out>)
    at /home/qy/Downloads/mozilla-latest/js/src/shell/js.cpp:714
#15 Process (cx=0x7ffff695d800, filename=0x7fffffffe1b5 "/home/qy/crashes/firefox/crash-latest/0002.js", forceTTY=<optimized out>, 
    kind=<optimized out>) at /home/qy/Downloads/mozilla-latest/js/src/shell/js.cpp:1161
#16 0x0000000000443538 in ProcessArgs (cx=<optimized out>, op=<optimized out>) at /home/qy/Downloads/mozilla-latest/js/src/shell/js.cpp:7901
#17 Shell (cx=<optimized out>, op=<optimized out>, envp=<optimized out>) at /home/qy/Downloads/mozilla-latest/js/src/shell/js.cpp:8264
#18 main (argc=0, argv=<optimized out>, envp=<optimized out>) at /home/qy/Downloads/mozilla-latest/js/src/shell/js.cpp:8664

Comment 1

[Jan de Mooij [:jandem]]

getSelfHostedValue is a fuzzing-unsafe testing function, it means fuzzers should not use it because it will break a lot of things.

Use the --fuzzing-safe shell flag for fuzzing to disable these functions.