Closed Bug 1589302 Opened 6 years ago Closed 4 years ago

Assert PropertyReadNeedsTypeBarrier and friends aren't used on environment objects

Categories

(Core :: JavaScript Engine: JIT, task, P1)

Product:
Core
Component:
JavaScript Engine: JIT
Type:
task

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: jandem, Unassigned)

Details

(Keywords: sec-audit)

We don't use TI for (most) environment objects so we should assert we don't try to depend on TI when it's unsound. See bug 1586599 for example.

Maybe we should just mark these objects as having unknown properties and assert against EnvironmentObjects at the point where we add constraints.

Keywords: sec-audit
Priority: -- → P1

TI removal solved this.

Status: NEW → RESOLVED
Closed: 4 years ago
Resolution: --- → FIXED
Group: javascript-core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.