Closed
Bug 601505
Opened 14 years ago
Closed 14 years ago
Assertion failure: isObject() on |new Error.prototype|
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
Tracking | Status | |
---|---|---|
blocking2.0 | --- | betaN+ |
People
(Reporter: cdleary, Assigned: luke)
References
Details
(Whiteboard: [sg:critical] fixed-in-tracemonkey)
Attachments
(1 file, 1 obsolete file)
3.97 KB,
patch
|
brendan
:
review+
|
Details | Diff | Splinter Review |
$ js/src/dbg64/js js> function CustomError() {} js> CustomError.prototype = new Error.prototype; Assertion failure: isObject(), at ../jsvalue.h:592
Updated•14 years ago
|
Group: core-security
Comment 1•14 years ago
|
||
confused types are often exploitable, lets make sure this bug isn't before we make it public (and whether this exists in shipped products)
Comment 2•14 years ago
|
||
This test shows an undefined-as-object confusion instance. Still, there is a bad bug at work: Error.prototype is a (the first) Error instance created, and per ECMA-262, "Error instances have no special properties." (Same for //Native//Error, e.g. SyntaxError, etc. instances). But our Error.prototype has a clasp->construct hook. D'oh! It should not get this far. JSC (in Safari as tested) gives TypeError: Result of expression 'Error.prototype' [Error: Unknown error] is not a constructor. This should get fixed. I believe the latent bug is old, but slow native removal (bug 581263) exposed it. /be
Depends on: 581263
Updated•14 years ago
|
blocking2.0: --- → ?
OS: Mac OS X → All
Hardware: x86 → All
Updated•14 years ago
|
blocking2.0: ? → betaN+
Assignee | ||
Comment 3•14 years ago
|
||
So is the fix simply to init js_ErrorClass.construct to NULL instead of Exception? With that, is it valid for Exception to assume that the prototype lookup returns an object?
Comment 4•14 years ago
|
||
(In reply to comment #3) > So is the fix simply to init js_ErrorClass.construct to NULL instead of > Exception? With that, is it valid for Exception to assume that the prototype > lookup returns an object? Yes, because the Exception native constructor can be invoked only via a direct call or new, not via new someExceptionInstance. /be
Comment 5•14 years ago
|
||
Luke, can you take this one? /be
Assignee | ||
Comment 6•14 years ago
|
||
You bet.
Assignee | ||
Comment 7•14 years ago
|
||
And with a test.
Attachment #480773 -
Attachment is obsolete: true
Attachment #480779 -
Flags: review?(brendan)
Attachment #480773 -
Flags: review?(brendan)
Comment 8•14 years ago
|
||
Comment on attachment 480779 [details] [diff] [review] with test Great, thanks. /be
Attachment #480779 -
Flags: review?(brendan) → review+
Updated•14 years ago
|
Whiteboard: [sg:critical]
Assignee | ||
Comment 9•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/cf3746fc25f9
Whiteboard: [sg:critical] → [sg:critical] fixed-in-tracemonkey
Updated•14 years ago
|
Summary: TM: Assertion failure: isObject() on |new Error.prototype| → Assertion failure: isObject() on |new Error.prototype|
Comment 10•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/cf3746fc25f9
Status: ASSIGNED → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
Updated•9 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•