465901 - DVG confused by |let|

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> { let d = 3;  new (this.d |= d |= d); }
typein:1: TypeError: this.d |= ???this |= d is not a constructor

Security-sensitive because the "???" makes me think it's reading from uninitialized memory, and making that memory available to scripts through try..catch.

The fuzzer in bug 465479 found this accidentally: it noticed a slight difference in the error message, due to what I'm guessing is uninitialized memory, and interpreted it as a difference between JIT and non-JIT.

I'll see if I can retrofit one of my fuzzers to really look for bugs like this, perhaps by trying to compile every expression that appears in a "is not a constructor" error message.

Comment 1

[Jesse Ruderman]

js> for each (let x in [1]) { (x = {}).y(); }
typein:1: TypeError: (???{} = {}).y is not a function

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

Seems like an obvious fix...

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 349301 [details] [diff] [review]
Fix

Whoops, was this never right? Thanks for fixing.

/be

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/1c0893f3e640

Comment 5

[Bob Clary [:bc] (inactive)]

Attachment: js1_8/regress/regress-465901-01.js

Comment 6

[Bob Clary [:bc] (inactive)]

Attachment: js1_8/regress/regress-465901-02.js

Comment 8

[Bob Clary [:bc] (inactive)]

verified fixed mozilla-central but not tracemonkey

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

The 1.9.0 branch is not affected by this bug.

Comment 10

[Al Billings [:abillings - ex-MoCo]]

If 1.9.0 is not affected by this, why did we fix it there?

Comment 11

[Daniel Veditz [:dveditz]]

For security bugs we use wanted-minus to indicate "Not needed for branch, and yes, we've checked". (For other bugs it tends to mean "we don't care--stop bugging us")

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

Sorry, I was confused by what we did in bug 464174.

Comment 13

[Bob Clary [:bc] (inactive)]

v 1.9.1, 1.9.2

Comment 14

[Bob Clary [:bc] (inactive)]

when this bug is opened, the test should be checked in.