1980263 - Devtools debugger can be crashed by two lines of javascript

Status: RESOLVED FIXED

(DevTools :: Debugger, defect, P2)

Description

[Bartha Áron]

Attachment: crash.html

Steps

1. Open crash.html
2. Make sure, that breakpoints are enabled
3. Open DevTools (press F12)

What happened?

Error:
TypeError: Object.entries(...)[0] is undefined

React Component Stack:
in Scopes
in Connect(Scopes)
in div
in aside
in div
in Accordion
in div
in div
in div
in SecondaryPanes
in Connect(SecondaryPanes)
in div
in div
in SplitBox
in AppErrorBoundary
in div
in App
in Connect(App)
in Provider
in Provider

Stacktrace:
_getBindingVariables@resource://devtools/client/debugger/src/utils/pause/scopes.js:81:37
_getScopeItem@resource://devtools/client/debugger/src/utils/pause/scopes.js:116:36
getScopesItemsForSelectedFrame@resource://devtools/client/debugger/src/utils/pause/scopes.js:271:41
UNSAFE_componentWillReceiveProps@resource://devtools/client/debugger/src/components/SecondaryPanes/Scopes.js:174:69
callComponentWillReceiveProps@resource://devtools/client/shared/vendor/react-dom.js:8306:14
updateClassInstance@resource://devtools/client/shared/vendor/react-dom.js:8482:36
updateClassComponent@resource://devtools/client/shared/vendor/react-dom.js:10599:20
beginWork@resource://devtools/client/shared/vendor/react-dom.js:11419:16
performUnitOfWork@resource://devtools/client/shared/vendor/react-dom.js:14702:12
workLoop@resource://devtools/client/shared/vendor/react-dom.js:14720:24
renderRoot@resource://devtools/client/shared/vendor/react-dom.js:14803:15
performWorkOnRoot@resource://devtools/client/shared/vendor/react-dom.js:15655:17
performWork@resource://devtools/client/shared/vendor/react-dom.js:15567:24
performSyncWork@resource://devtools/client/shared/vendor/react-dom.js:15541:14
requestWork@resource://devtools/client/shared/vendor/react-dom.js:15410:5
scheduleWork@resource://devtools/client/shared/vendor/react-dom.js:15224:16
enqueueSetState@resource://devtools/client/shared/vendor/react-dom.js:8192:17
Component.prototype.setState@resource://devtools/client/shared/vendor/react.js:328:16
onStateChange@resource://devtools/client/shared/vendor/react-redux.js:1412:16
notify@resource://devtools/client/shared/vendor/react-redux.js:1159:21
notifyNestedSubs@resource://devtools/client/shared/vendor/react-redux.js:1198:20
onStateChange@resource://devtools/client/shared/vendor/react-redux.js:1409:16
notify@resource://devtools/client/shared/vendor/react-redux.js:1159:21
notifyNestedSubs@resource://devtools/client/shared/vendor/react-redux.js:1198:20
onStateChange@resource://devtools/client/shared/vendor/react-redux.js:1409:16
dispatch@resource://devtools/client/shared/vendor/redux.js:265:7
waitUntilService/</<@resource://devtools/client/debugger/src/actions/utils/middleware/wait-service.js:71:24
promiseMiddleware/</<@resource://devtools/client/debugger/src/actions/utils/middleware/promise.js:38:14
context/</<@resource://devtools/client/debugger/src/actions/utils/middleware/context.js:84:12
thunk/</</<@resource://devtools/client/debugger/src/actions/utils/middleware/thunk.js:29:100
dispatch@resource://devtools/client/shared/vendor/redux.js:681:28
promiseMiddleware/</</<@resource://devtools/client/debugger/src/actions/utils/middleware/promise.js:57:15

Comment 1

[Nicolas Chevobbe [:nchevobbe]]

This comes from https://searchfox.org/mozilla-central/rev/f2da682709d6dcdb1e5fd3573bc269e22db7e11e/devtools/client/debugger/src/utils/pause/scopes.js#54,63-66,68,75

function _getBindingVariables(bindings, parentName) {
...
  for (const arg of bindings.arguments) {
    // `arg` is an object which only has a single property whose name is the name of the
    // argument. So here we can directly pick the first (and only) entry of `arg`
    const [name, contents] = Object.entries(arg)[0];
...
  }
...
}

With the test page, bindings.arguments is [{}], so Object.entries(arg) returns an empty array

Note that we get an other exception in https://searchfox.org/mozilla-central/rev/f2da682709d6dcdb1e5fd3573bc269e22db7e11e/devtools/client/shared/sourceeditor/editor.js#2468

bindingReferences[level][bindingName].refs.push(ref);

TypeError: can't access property "push", bindingReferences[level][bindingName].refs is undefined
That's because in https://searchfox.org/mozilla-central/rev/f2da682709d6dcdb1e5fd3573bc269e22db7e11e/devtools/client/shared/sourceeditor/editor.js#2463-2466

bindingReferences[level][bindingName] = {
  ...bindingData,
  refs: [],
};

bindingName is __proto__ , so we're not populating the object as we want.

Comment 2

[Nicolas Chevobbe [:nchevobbe]]

Attachment: Bug 1980263 - [devtools] Fix EnvironmentActor#bindings when arg/variable name is __proto__. r=#devtools.

Use a null-prototype Object to hold variables / argument name to avoid the name
messing up with the prototype.

Comment 3

[Nicolas Chevobbe [:nchevobbe]]

Attachment: Bug 1980263 - [devtools] Prevent issue in Editor#getBindingReferences when arg name is __proto__. r=bomsy.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/df9fc993216f
https://hg.mozilla.org/integration/autoland/rev/b7f789a60e4a
[devtools] Fix EnvironmentActor#bindings when arg/variable name is __proto__. r=devtools-reviewers,bomsy.
https://github.com/mozilla-firefox/firefox/commit/6c2a8a93e9ce
https://hg.mozilla.org/integration/autoland/rev/1644fabf507c
[devtools] Prevent issue in Editor#getBindingReferences when arg name is __proto__. r=bomsy,devtools-reviewers.

Comment 5

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/b7f789a60e4a
https://hg.mozilla.org/mozilla-central/rev/1644fabf507c