1506861 - Accessing "prototype" or keys of Proxy with XrayWrapper causes crash / assertion failure

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Rob Wu [:robwu]]

Proxy objects have no prototype, yet trying to access the property over a XrayWrapper results in a crash.

STR:

Cu.sandbox(null).Proxy.prototype;

or

Object.keys(Cu.sandbox(null).Proxy);

Assertion failure: isObject(), at objdir-debug/dist/include/js/Value.h:795
#01: js::GlobalObject::getOrCreatePrototype(JSContext*, JSProtoKey) (js/src/vm/GlobalObject.h:182)
#02: JS_GetClassPrototype(JSContext*, JSProtoKey, JS::MutableHandle<JSObject*>) (js/src/jsapi.cpp:1192)
#03: xpc::JSXrayTraits::resolveOwnProperty(JSContext*, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<JSObject*>, JS::Handle<jsid>, JS::MutableHandle<JS::PropertyDescriptor>) (js/xpconnect/wrappers/XrayWrapper.cpp:595)


There is a crash report of this at bp-1320578c-776c-4384-8cd9-3564a0181113, but it is currently of limited use due to bug 1506781.


[1] https://searchfox.org/mozilla-central/rev/7f7c353e969e61a6a85201cc8ad3c3de12ac30d8/js/src/vm/GlobalObject.h#182
[2] https://searchfox.org/mozilla-central/rev/7f7c353e969e61a6a85201cc8ad3c3de12ac30d8/js/src/jsapi.cpp#1192
[3] https://searchfox.org/mozilla-central/rev/7f7c353e969e61a6a85201cc8ad3c3de12ac30d8/js/xpconnect/wrappers/XrayWrapper.cpp#595

Comment 1

[Rob Wu [:robwu]]

Attachment: Bug 1506861 - Stop accessing Proxy.prototype in XrayWrapper

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8a8fbc85088e
Stop accessing Proxy.prototype in XrayWrapper r=bholley

Comment 3

[Eliza Balazs [:ebalazs_]]

https://hg.mozilla.org/mozilla-central/rev/8a8fbc85088e