2055647 - Validation assistance for arguments.length

Status: NEW

(Core :: JavaScript Engine, task, P3)

Description

[Matthew Gaudet (he/him) [:mgaudet]]

I think there's a way for us to provide some validation assistance to the arguments.length optimization.

The idea in my head is roughly you create a mode where when the arguments.length optimization is applied, you create the arguments binding (normally it's elided). However, you initialize that binding it to a poisoned proxy object which calls crash should it ever have any of its properties accessed.

Then, if fuzzers or scanners can show a way to get to that crash, you know that you've got a bug.