507453 - negative indexes on built-in objects sometimes return special properties

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Robert Sayre]

See attached URL for the stuff people have turned up. Secure JavaScript subsets consider this a problem.

Comment 1

[Robert Sayre]

js> function args() { print(arguments[-3] == arguments.callee); print(typeof arguments[-3]); } 
js> args()
true
function

Comment 2

[Mike Shaver (:shaver emeritus)]

KILL IT. KILL IT WITH FIRE.

Comment 3

[Andrea Giammarchi]

Sure, remove it, and bye bye introspection when "use strict" will be considered, right? This was my last hope about your .callee decision ... gone!

You have [-2] and [-1] as well at this point, have a look.

Comment 4

[Andrea Giammarchi]

P.S. my first comment in that post:
I wrote about arguments secrets few weeks ago but I tested performances as well. Length, as callee, cost definitively more to be exposed but if these property will be there with “use strict” they could save JS debug!

Comment 5

[Damon Sicore (:damons)]

Blake says this is a P2.  Brendan, if this requires a beta, please mark as P2.

Comment 6

[Brendan Eich [:brendan]]

This was fixed by the patch for bug 453728.

/be

Comment 7

[Robert Sayre]

bug 453728 was fixed last year.

Comment 8

[Brendan Eich [:brendan]]

(In reply to comment #7)
> bug 453728 was fixed last year.

Sorry, pasted wrong bug #, as the "Depends on:" line shows; should be bug 507573.

There's some interest in a spot-fix to 1.9.1.x. Cc'ing dveditz, I'll attach the minimal patch in a bit.

/be

Comment 9

[Brendan Eich [:brendan]]

Attachment: one-line fix

This is wanted on 1.9.1.x for the object-capability language verifiers targeting JS, so they don't have to blacklist indexing to avoid capability leaks.

/be

Comment 10

[Daniel Veditz [:dveditz]]

Comment on attachment 420403 [details] [diff] [review]
one-line fix

Approved for 1.9.1.8, a=dveditz for release-drivers

Comment 11

[Brendan Eich [:brendan]]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/6793f52d584b

/be