801914 - "window.__proto__ = window" doesn't throw, again

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[Jesse Ruderman]

Attachment: testcase

Expected: Line 4 should throw "TypeError: cyclic __proto__ value"
Result:   Line 5 throws "too much recursion"

Blake fixed this once, in bug 394815...

Comment 1

[Jeff Walden [:Waldo]]

...and we didn't push a testcase.  Good times.

Looking at this in a debugger, inside the __proto__ setter implementation |this| is a Window object, but the argument passed in is a Proxy (presumably around that Window).  At first pale I think this suggests the JS __proto__ setter needs to do more work here, but I'm not sure enough of that diagnosis to change the component yet.  I'll look and figure it out.

Comment 2

[Jeff Walden [:Waldo]]

Likely-looking shell testcase:

  var obj = {}; obj.__proto__ = wrap(obj);

That appears to have been failing for awhile, as the change before bug 770344 (making __proto__ an accessor, mid-July this year) reports infinite recursion on it.  Poking people now to see if the regressing bug can be determined...

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Note to self:
~/fuzzing/autobisect-js/autoBisect.py -p "-e obj={};obj.__proto__=wrap(obj);obj.toString" -i outputs --timeout=3 "InternalError: too much recursion"


autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   59231:f2938738a9b1
user:        Andreas Gal
date:        Mon Dec 13 14:53:44 2010 -0800
summary:     Check for infinite recursion when running proxy handlers (bug 571168, r=jorendorff).

It crashed at the parent changeset. I'm now verifying that the latest non-crashing changeset before f2938738a9b1 hopefully shows the cyclic message.

Comment 4

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

The last non-crashing changeset, 49da92b4c672, which before f2938738a9b1, shows:

./js-dbg-64-49da92b4c672-linux -e "obj={};obj.__proto__=wrap(obj);obj.toString"
-e:1: ReferenceError: wrap is not defined

As for the crash in comment 3,

autoBisect shows this is probably related to the following changeset:

The first bad revision is:
changeset:   42733:4dd9be00049c
user:        Andreas Gal
date:        Tue May 18 19:21:43 2010 -0700
summary:     Implement ES Harmony Proxies (bug 546590, r=mrbkap).

===

In summary:

49da92b4c672 shows "ReferenceError: wrap is not defined"
4dd9be00049c, child of 49da92b4c672, and onwards crashes, until...
f2938738a9b1 fixed the crash but shows "InternalError: too much recursion".

Hope this helps.

Comment 5

[Jeff Walden [:Waldo]]

Hmm.  Yes, and no.  Basically it appears this was broken somewhere back in the sands of time, far enough back that regression info probably won't help with a fix.  But at least we know that now!

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

(In reply to Jeff Walden [:Waldo] (remove +bmo to email) from comment #1)
> ...and we didn't push a testcase.  Good times.

I'm going to defend myself: there definitely was a testcase at some point (I think I've fixed this bug at least 3 or 4 times since the implementation of XOWs). I bet it got lost when we did the compartments work.

Comment 7

[BMO Automation]

Per policy at https://wiki.mozilla.org/Bug_Triage/Projects/Bug_Handling/Bug_Husbandry#Inactive_Bugs. If this bug is not an enhancement request or a bug not present in a supported release of Firefox, then it may be reopened.

Comment 8

[Boris Zbarsky [:bzbarsky]]

So for window this now throws because windows have immutable protos.

For other cases... I think this is all fine now, as far as I can tell.