1732543 - Instant evaluation called on expression using Function.prototype.call.bind(Function.prototype.call) but shouldn't

Status: VERIFIED FIXED

(DevTools :: Console, defect, P2)

Description

[BZZZZ]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:92.0) Gecko/20100101 Firefox/92.0

Steps to reproduce:

1. press F12
2. select console tab
3. make sure "Instant Evaluation" is on
4. copy+paste "Function.prototype.call.bind(Function.prototype.call)(document.write,document,'<h1>why did <code>document.write</code> execute?</h1>');" without pressing enter

https://www.reddit.com/r/firefox/comments/pvojtj/running_stuff_in_javascript_console_without/

Actual results:

document.write executed and page changed to "why did document.write execute?"

Expected results:

page not changed and document.write not executed because it has side effects (same as if you copy+paste "document.write('<h1>why did <code>document.write</code> execute?</h1>');" without pressing enter)

Comment 1

[Nicolas Chevobbe [:nchevobbe]]

We should look at what's going on

Comment 5

[Tooru Fujisawa [:arai]]

Attachment: Bug 1732543 - Part 1: Call onNativeCall for Function.prototype.{call,apply} inside self-hosted JS. r?jandem!

Depends on D152348

Comment 6

[Tooru Fujisawa [:arai]]

Attachment: Bug 1732543 - Part 2: Add eager evaluation testcase. r?nchevobbe!

Depends on D152349

Comment 7

[BugBot [:suhaib / :marco]]

The severity field for this bug is relatively low, S3. However, the bug has 3 duplicates.
:arai, could you consider increasing the bug severity?

For more information, please visit auto_nag documentation.

Comment 8

[Tooru Fujisawa [:arai]]

This is not security sensitive (the hidden one is also not security sensitive. it needs to be opened up by someone who has privilege).
While it's nice to fix, this is not major issue nor blocker, in my opinion.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/dacb2580cb23
Part 1: Call onNativeCall for Function.prototype.{call,apply} inside self-hosted JS. r=jandem
https://hg.mozilla.org/integration/autoland/rev/e5706a3cddeb
Part 2: Add eager evaluation testcase. r=nchevobbe

Comment 10

[Marian-Vasile Laza]

https://hg.mozilla.org/mozilla-central/rev/dacb2580cb23
https://hg.mozilla.org/mozilla-central/rev/e5706a3cddeb

Comment 11

[Ardelean Oana, Desktop Test Engineering [:oardelean]]

I was able to reproduce this issue on Firefox 104.0(build ID: 20220818191623) on Ubuntu 22.04 using the STR from the Description. Verified as fixed on Firefox 105.0b7(build ID: 20220904185841) and Nightly 106.0a1(build ID: 20220905214329) on Ubuntu 22.04, Windows 10, macOS 12.