897403 - "Assertion failure: !((attrs ^ shape->attrs) & 0x40) || !(attrs & 0x40)" with bound function proxy

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

Attachment: stack

var boundFun = (function(){}).bind({});
var prox = new Proxy(boundFun, {});
Object.defineProperty(prox, "caller", {get: function(){}});

Assertion failure: !((attrs ^ shape->attrs) & 0x40) || !(attrs & 0x40), at js/src/vm/Shape.cpp:767

This testcase causes trouble all the way back to the landing of direct proxies in bug 703537.  Bug 788172 made it easier for one of my fuzzers to find it.

Comment 1

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Bug 703537 landed in Firefox 18, setting tracking flags as necessary.

Comment 2

[Lukas Blakk [:lsblakk] use ?needinfo]

If this is present all the way back to FF18 we have no reason to track this but a low risk uplift nomination can be considered when a fix is available.

Comment 3

[Andrew McCreight [:mccr8]]

The assertion is this:

    /* Allow only shared (slotless) => unshared (slotful) transition. */
    JS_ASSERT(!((attrs ^ shape->attrs) & JSPROP_SHARED) ||
              !(attrs & JSPROP_SHARED));

I have no idea what that means, so I'm going to assume it is bad.  Feel free to adjust.

Comment 4

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 5

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

jandem, you fixed a similar bug 867082 as well, possible to take a look?

Comment 6

[Jan de Mooij [:jandem]]

(In reply to Gary Kwong [:gkw] [:nth10sd] from comment #5)
> jandem, you fixed a similar bug 867082 as well, possible to take a look?

Unfortunately I've no idea what's causing this. Somebody more familiar with proxies should take a look (maybe Eddy or Jason).

Comment 7

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

(In reply to Jan de Mooij [:jandem] from comment #6)
> (In reply to Gary Kwong [:gkw] [:nth10sd] from comment #5)
> > jandem, you fixed a similar bug 867082 as well, possible to take a look?
> 
> Unfortunately I've no idea what's causing this. Somebody more familiar with
> proxies should take a look (maybe Eddy or Jason).

Jason, thoughts?

Comment 8

[Jason Orendorff [:jorendorff]]

(In reply to Andrew McCreight [:mccr8] from comment #3)
> The assertion is this:
> 
>     /* Allow only shared (slotless) => unshared (slotful) transition. */
>     JS_ASSERT(!((attrs ^ shape->attrs) & JSPROP_SHARED) ||
>               !(attrs & JSPROP_SHARED));
> 
> I have no idea what that means, so I'm going to assume it is bad.  Feel free
> to adjust.

I don't think this assertion is security-important. Changing a property from slotful to slotless leaks a slot, I think.

I have a shallow fix for the symptom here: just make the property slotless to begin with. fun_getProperty doesn't use the slot for anything.

Of course the real fix would be to make it so JS_DefineProperty doesn't flunk an assertion in this sort of case; I think it should fail with an exception instead. Let's save that for a followup.

Comment 9

[Jason Orendorff [:jorendorff]]

Attachment: v1

Comment 10

[Andrew McCreight [:mccr8]]

Clearing sec-flag per comment 8.

Comment 11

[Jason Orendorff [:jorendorff]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3cb16a4bf227

Comment 12

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3cb16a4bf227