522123 - Indirect eval befuddles scopeChain

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jim Blandy :jimb]

obj_eval doesn't succeed in using the global object for indirect eval calls:

$ obj~/js
js> evil=eval
function eval() {[native code]}
js> let (x=1) { print (evil("x")); }
1
js> 

The underlying problem is that, while the 'if indirectCall' code does swap out the frame's scopeChain, if there are lexical blocks on caller->blockChain, the subsequent call to js_GetScopeChain re-clones them, uses them for the compile and execute, and then drops them when it restores the frame's original scopeChain.

These double clones never get their variables copied out of their stack frames when the frames are popped, so you can get functions that have closed over blocks pointing to popped frames:

$ cat ~/mc/b/strict/eval-scope-2.js
evil=eval;
var f, g;
let (x=1) {
  evil("f=function () { return x; };");
  x++;
};
print(f());
$ obj~/js ~/mc/b/strict/eval-scope-2.js
function print() {
    [native code]
}
$ 

I think I have a patch for this.

Comment 1

[Jim Blandy :jimb]

(In reply to comment #0)
> caller->blockChain

fp->blockChain, that should be.

Comment 2

[Jim Blandy :jimb]

I may not have made it clear from the description, but you can end up with references to freed memory using this bug, or pointers into the stack.

Comment 3

[Jim Blandy :jimb]

Attachment: Don't reify lazy scope chain blocks twice in 'eval'.

Comment 4

[Jim Blandy :jimb]

Attachment: Test case for indirect eval scope chain bug.

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 406301 [details] [diff] [review]
Don't reify lazy scope chain blocks twice in 'eval'.

Thanks for catching this.

Comment 6

[Jim Blandy :jimb]

http://hg.mozilla.org/tracemonkey/rev/64094cb2f8b2

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to comment #6)
> http://hg.mozilla.org/tracemonkey/rev/64094cb2f8b2

This seems to have fixed the assertions in bug 521163 and bug 521279. There are testcases in these 2 bugs.

Comment 8

[Robert Sayre]

http://hg.mozilla.org/mozilla-central/rev/8499ce94e7a1