Closed Bug 601505 Opened 14 years ago Closed 14 years ago

Assertion failure: isObject() on |new Error.prototype|

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- betaN+

People

(Reporter: cdleary, Assigned: luke)

References

Details

(Whiteboard: [sg:critical] fixed-in-tracemonkey)

Attachments

(1 file, 1 obsolete file)

$ js/src/dbg64/js
js> function CustomError() {}
js> CustomError.prototype = new Error.prototype;
Assertion failure: isObject(), at ../jsvalue.h:592
Group: core-security
confused types are often exploitable, lets make sure this bug isn't before we make it public (and whether this exists in shipped products)
This test shows an undefined-as-object confusion instance. Still, there is a bad bug at work: Error.prototype is a (the first) Error instance created, and per ECMA-262,

"Error instances have no special properties."

(Same for //Native//Error, e.g. SyntaxError, etc. instances).

But our Error.prototype has a clasp->construct hook. D'oh! It should not get this far. JSC (in Safari as tested) gives

TypeError: Result of expression 'Error.prototype' [Error: Unknown error] is not a constructor.

This should get fixed. I believe the latent bug is old, but slow native removal (bug 581263) exposed it.

/be
Depends on: 581263
blocking2.0: --- → ?
OS: Mac OS X → All
Hardware: x86 → All
blocking2.0: ? → betaN+
So is the fix simply to init js_ErrorClass.construct to NULL instead of Exception?  With that, is it valid for Exception to assume that the prototype lookup returns an object?
(In reply to comment #3)
> So is the fix simply to init js_ErrorClass.construct to NULL instead of
> Exception?  With that, is it valid for Exception to assume that the prototype
> lookup returns an object?

Yes, because the Exception native constructor can be invoked only via a direct call or new, not via new someExceptionInstance.

/be
Luke, can you take this one?

/be
You bet.
Assignee: general → lw
Status: NEW → ASSIGNED
Attachment #480773 - Flags: review?(brendan)
Attached patch with testSplinter Review
And with a test.
Attachment #480773 - Attachment is obsolete: true
Attachment #480779 - Flags: review?(brendan)
Attachment #480773 - Flags: review?(brendan)
Comment on attachment 480779 [details] [diff] [review]
with test

Great, thanks.

/be
Attachment #480779 - Flags: review?(brendan) → review+
Whiteboard: [sg:critical]
http://hg.mozilla.org/tracemonkey/rev/cf3746fc25f9
Whiteboard: [sg:critical] → [sg:critical] fixed-in-tracemonkey
Summary: TM: Assertion failure: isObject() on |new Error.prototype| → Assertion failure: isObject() on |new Error.prototype|
http://hg.mozilla.org/mozilla-central/rev/cf3746fc25f9
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Group: core-security
You need to log in before you can comment on or make changes to this bug.