950118 - Don't allow the object metadata hook to reenter JS

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

Allowing the object metadata hook to reenter JS allows all sorts of silly cases to be found by fuzzers and which have no bearing on how the metadata hook will be used.  Users of this callback do not need to let it reenter JS (let alone invoke arbitrary JS).

The attached patch uses AutoEnterAnalysis to disallow reentering JS within the metadata hook, and updates the C++ hook in the testing functions to do something interesting --- make a metadata object with the creation index and stack information for the allocation.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

Comment 2

[Jim Blandy :jimb]

Comment on attachment 8347337 [details] [diff] [review]
patch

Review of attachment 8347337 [details] [diff] [review]:
-----------------------------------------------------------------

Looks fine.

I wonder whether this is part of a creeping expansion of the meaning of JSCompartment::activeAnalysis, but we can cross that bridge when we come to it.

Comment 3

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/bec71542c055

Comment 4

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/bec71542c055