2037186 - Consider removing some of the transplanting APIs.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, task, P3)

Description

[Emilio Cobos Álvarez [:emilio]]

After bug 2037172 some of the transplanting APIs like JS_CopyOwnPropertiesAndPrivateFields and co become unused except for the JS shell, which seems like it exposes them for fuzzing. Seems they come from bug 1403679. Anba do you know if these are safe to remove?

Comment 1

[Jan de Mooij [:jandem]]

That's exciting. I'm actively working on our transplanting code currently so I can look into this.

Comment 2

[Jan de Mooij [:jandem]]

I think you just eliminated a major footgun: object transplant/swap involving native objects! The remaining transplant cases involve two proxies and that's easier to reason about. I also think we can simplify some code paths in JS_TransplantObject.

First we should add support for the transplant-WindowProxy case to newGlobal in the JS shell. After that I think we can remove transplantableObject.

Comment 3

[André Bargull [:anba]]

Jan's plan is exactly what I'd have proposed: Support transplantable window proxies in the shell to cover the JS_TransplantObject call in TransplantObjectNukingXrayWaiver and then remove transplantableObject from the shell.

Comment 4

[Jan de Mooij [:jandem]]

Attachment: Bug 2037186 part 1 - Change transplantableObject shell builtin to only support proxies. r?anba!,jonco!

Initially the plan was to remove the shell builtin completely. However the WindowProxy
transplanting added in bug 2037348 is only a partial replacement because some operations
unwrap wrappers including window proxies. In the browser, RemoteObjectProxy is a non-wrapper
proxy that can be transplanted.

To ensure we don't lose coverage, this patch simplifies transplantableObject to only support
simple non-DOM proxy objects. This also means we don't have to rewrite some of the shell tests
that use it. Some other tests that only made sense for transplanting native objects were deleted.

Comment 5

[Jan de Mooij [:jandem]]

Attachment: Bug 2037186 part 2 - Change transplant/swap to only support proxies and require matching AllocKinds. r?jonco!

Comment 6

[Jan de Mooij [:jandem]]

Attachment: Bug 2037186 part 3 - Remove external ProxyValueArray support. r?jonco!

We no longer support swapping a proxy with a smaller object.

Comment 7

[Jan de Mooij [:jandem]]

Attachment: Bug 2037186 part 4 - Remove some checks for native/proxy object swapping. r?jonco!,iain!

Comment 8

[Jan de Mooij [:jandem]]

Attachment: Bug 2037186 part 5 - Remove Watchtower object-swap code. r?iain!

Object fuses are only used for native objects and WatchProtoChangeImpl is a no-op
for proxy objects.

Comment 9

[Andrew McCreight [:mccr8]]

Thank you for your ongoing work to improve testing of our weird DOM transplanting!

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/75034f8eafa9
https://hg.mozilla.org/integration/autoland/rev/85ca364372d4
part 1 - Change transplantableObject shell builtin to only support proxies. r=anba,jonco
https://github.com/mozilla-firefox/firefox/commit/37e8af186444
https://hg.mozilla.org/integration/autoland/rev/59d96b3e0392
part 2 - Change transplant/swap to only support proxies and require matching AllocKinds. r=jonco
https://github.com/mozilla-firefox/firefox/commit/d1e5dbced8f0
https://hg.mozilla.org/integration/autoland/rev/614f7207c2eb
part 3 - Remove external ProxyValueArray support. r=jonco
https://github.com/mozilla-firefox/firefox/commit/4b0fd85ddc57
https://hg.mozilla.org/integration/autoland/rev/923e17501f0c
part 4 - Remove some checks for native/proxy object swapping. r=jonco,iain
https://github.com/mozilla-firefox/firefox/commit/e4b62f258e1c
https://hg.mozilla.org/integration/autoland/rev/82845daf0008
part 5 - Remove Watchtower object-swap code. r=iain

Comment 11

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/85ca364372d4
https://hg.mozilla.org/mozilla-central/rev/59d96b3e0392
https://hg.mozilla.org/mozilla-central/rev/614f7207c2eb
https://hg.mozilla.org/mozilla-central/rev/923e17501f0c
https://hg.mozilla.org/mozilla-central/rev/82845daf0008