355590 - __parent__ should not expose lexical scope or activation objects

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brendan Eich [:brendan]]

This is a standards violation and an optimization hazard.  Trivial patch next.

/be

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Igor Bukanov]

Comment on attachment 241369 [details] [diff] [review]
fix

>+            /* Censor activations and lexical scopes per ECMA-262. */

But ECMA does not have __parent__! Or to be precise it never exposes the activation objects to scripts.

Comment 3

[Brendan Eich [:brendan]]

(In reply to comment #2)
> (From update of attachment 241369 [details] [diff] [review] [edit])
> >+            /* Censor activations and lexical scopes per ECMA-262. */
> 
> But ECMA does not have __parent__! Or to be precise it never exposes the
> activation objects to scripts. 

Yes, that's the point! ;-)

/be

Comment 4

[Igor Bukanov]

Would it be better for compatibility to search prototype chain for the real scope?

Comment 5

[Brendan Eich [:brendan]]

(In reply to comment #4)
> Would it be better for compatibility to search prototype chain for the real
> scope?

__parent__ was always just a reflection of JSSLOT_PARENT.  So compatibility is maintained by leaving the code alone, just censoring the lexical scope objects.  It turns out that __parent__ is handy for debugging (possibly for the testsuite too) as a way to get to the Call object, but we can provide an alternative method for the suite if we have to.  The other, valid uses of __parent__ (e.g. to get to the DOM scope chain link) continue to work.

We don't want to let would-be lexical scopes to leak via either __proto__ or __parent__, and so the patch does not depend on the id of the built-in property being accessed.

Fixed on trunk:

Checking in jsobj.c;
/cvsroot/mozilla/js/src/jsobj.c,v  <--  jsobj.c
new revision: 3.292; previous revision: 3.291
done

/be

Comment 6

[Mike Schroepfer]

Comment on attachment 241369 [details] [diff] [review]
fix

Approved for RC3.

Comment 7

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch:

Checking in jsobj.c;
/cvsroot/mozilla/js/src/jsobj.c,v  <--  jsobj.c
new revision: 3.208.2.36; previous revision: 3.208.2.35
done

/be