Closed Bug 1548063 Opened 2 years ago Closed 2 years ago

Differential Testing: Different output message involving __proto__

Categories

(Core :: JavaScript Engine: JIT, defect)

defect
Not set
major

Tracking

()

RESOLVED DUPLICATE of bug 1544386
Tracking Status
firefox68 --- affected

People

(Reporter: gkw, Unassigned)

References

(Regression)

Details

(Keywords: testcase)

x = [];
x.unshift(0, 1);
y = [];
relazifyFunctions();
y[3] = [];
y.__proto__ = x;
for (let i = 0; i < 2; ++i) {
    y.shift();
}
print(y);
$ ./js-dbg-64-dm-linux-x86_64-90234f4c094d --fuzzing-safe --ion-offthread-compile=off --ion-eager testcase.js
0,
$ ./js-dbg-64-dm-linux-x86_64-90234f4c094d --fuzzing-safe --ion-offthread-compile=off --no-baseline --no-ion testcase.js
1,

Tested this on m-c rev 90234f4c094d.

My configure flags are:

AR=ar sh ./configure --enable-debug --enable-more-deterministic --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests --disable-cranelift

python3 -u -m funfuzz.js.compile_shell -b "--enable-debug --enable-more-deterministic" -r 90234f4c094d

I'm setting this as s-s because this is yet another __proto__ issue found after the pwn2own tweaks were made, to be safe.

autobisectjs shows this is probably related to the following changeset:

The first bad revision is:
changeset: https://hg.mozilla.org/mozilla-central/rev/b6315d186b4b
user: Jan de Mooij
date: Tue May 02 14:26:44 2017 +0200
summary: Bug 1357680 part 3 - Don't mark the new group as having unknown properties when changing an object's proto. r=bhackett

Jan, is bug 1357680 a likely regressor?

Flags: needinfo?(jdemooij)
Regressed by: 1357680

This is the same issue as bug 1544386 (patch for that one fixes this too).

Gary, please keep doing differential testing :)

Status: NEW → RESOLVED
Closed: 2 years ago
Flags: needinfo?(jdemooij)
Resolution: --- → DUPLICATE
Duplicate of bug: CVE-2019-11707
Group: javascript-core-security
You need to log in before you can comment on or make changes to this bug.