623102 - TM: cross compartment wrappers can hide regexpness

Status: RESOLVED DUPLICATE of bug 683361

(Core :: JavaScript Engine, defect)

Description

[Chris Leary [:cdleary] (not checking bugmail)]

var re = new RegExp('foo(bar)?');
  var sandbox = evalcx('');
  sandbox.re = re;
  evalcx('result = "foobar".replace(re, "works!");', sandbox);
  assertEq(sandbox.result, "works!");

This fails because the regexp is cross-compartment wrapped and the str_replace code checks the clasp of the object to see if it is exactly &js_RegExpClass. I'm pretty sure the solution is to use a VALUE_IS_REGEXP that can see through wrappers of appropriate kinds to the primordial clasp.

This seems like a generally good category of bug to audit the code for: places where we test to see if a object has a particular clasp in order to perform correct (as opposed to optimized) behavior.

Comment 1

[Chris Leary [:cdleary] (not checking bugmail)]

Forgot to mention that split and replace's friends are similarly affected.

Comment 2

[Nicholas Nethercote [inactive]]

(In reply to comment #0)
> 
> This seems like a generally good category of bug to audit the code for: places
> where we test to see if a object has a particular clasp in order to perform
> correct (as opposed to optimized) behavior.

Aren't there, like, bazillions of places where the clasp is inspected in this way?

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

(In reply to comment #2)
> Aren't there, like, bazillions of places where the clasp is inspected in this
> way?

When I was talking with luke we figured that most of those were for performance reasons; i.e. fast paths for known clasps, falling back on a generally correct handling of wrapped objects.

If you know of a lot of places where the correctness is affected by inspecting clasp we should file an audit bug!