650633 - "Assertion failure: obj" with InstallTrigger, typed array [@ js_IsArrayBuffer] [@ js::ArrayBuffer::prop_getByteLength]

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: testcase (crashes Firefox when loaded)

Debug: Assertion failure: obj, at js/src/jstypedarray.cpp:1609

Opt:   Crash (bp-40bdcfdb-65e0-484e-85a7-d622c2110417)

Security-sensitive for now because the testcase involves InstallTrigger. That usually means something is going wrong involving a security boundary.

Comment 1

[Jesse Ruderman]

Attachment: stack trace for the assertion (mac debug)

Comment 2

[Jeff Walden [:Waldo]]

Attachment: ArrayBuffer byteLength property getter assumes that it's called on an ArrayBuffer object, or on an object with such on its [[Prototype]] chain

Not a security problem, just a case where the property getter is passed an object that doesn't have an ArrayBuffer on its prototype chain (InstallTrigger is a proxy because it's from another compartment), and the prototype-chain walk doesn't check for getting to a null [[Prototype]].

This patch fixes the crash, but it doesn't quite make behavior correct.  You'd think, for the testcase here, that evaluating InstallTrigger.byteLength would compute 0, but instead it computes |undefined|.  That doesn't happen using Int8Array or Array or something else with a JSPropertyOp-getter/setter property, and I *think* it's due to ArrayBuffer not having a getProperty hook, while all the typed arrays, and Array, do.  But I'm not certain.  If you see an easy way to fix that, I'd be interested to hear it, but for now fixing the crash seems a worthy step even if it's not the entire way.

Comment 3

[Jeff Walden [:Waldo]]

This is a guaranteed dereference of NULL, no security hazard.

Comment 4

[Nikhil Marathe [:nsm] (No longer reading bugmail, please needinfo?)]

http://hg.mozilla.org/tracemonkey/rev/b89374bc34ee fixes this.

Comment 5

[Jesse Ruderman]

WFM on trunk.