505593 - JIT doesn't compare wrapped objects correctly, can spuriously return false

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jeff Walden [:Waldo]]

It needs to unwrap objects before doing a direct pointer-comparison.

Comment 1

[Robert Sayre]

is this a security problem?

Comment 2

[Andreas Gal :gal]

Until I hear a no ...

Comment 3

[Jeff Walden [:Waldo]]

I don't think so, just means you get a wrong answer, but I'll defer to Blake.

Comment 4

[Jeff Walden [:Waldo]]

Also note in the unlikely event some algorithm is actually trying to be secure by object identity, it's not going to become *insecure* because it decides two windows (for example) are not the same object.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

I agree with Jeff. Using a wrapper instead of the unwrapped object should never open a security hole (though, "never say never" disagrees with that statement).

Comment 6

[Brandon Sterne (:bsterne)]

Waldo + mrbkap == good enough consensus for me.  Unhiding.

Comment 7

[Luke Wagner [:luke]]

This should have been fixed by new compartment invariants.