157089 CVE-2016-4735 2016-04-27 10:32:03 -0700 Crash for non-static super property call in derived class constructor 2017-10-11 10:26:00 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 andre.bargull webkit-unassigned bfulgham darin gskachkov webkit-bug-importer oldest_to_newest 1187801 0 andre.bargull 2016-04-27 10:32:03 -0700 SVN: rev200124 Build with: perl Tools/Scripts/build-jsc --gtk --debug Test case: --- (new class D extends class {} { constructor() { eval(`super["m"]()`) } }) --- Crashes with: --- Thread 1 "jsc-debug" received signal SIGSEGV, Segmentation fault. 0x00007ffff6a33742 in llint_entry () from /home/andre/svn/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 --- Also reproducible with: --- (new class D extends class {} { constructor(f) { super[f()]() } }) --- And with: --- new class extends class {} { constructor() { super["m"](super()) } } --- Stack trace: --- #0 0x00007ffff6a33742 in llint_entry () from /home/andre/svn/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #1 0x00007ffff6a2d895 in vmEntryToJavaScript () from /home/andre/svn/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #2 0x00007ffff69d46d2 in JSC::JITCode::execute (this=0x7ffff0d9c848, vm=0x7fffb09f1000, protoCallFrame=0x7fffffffc000) at ../../Source/JavaScriptCore/jit/JITCode.cpp:80 #3 0x00007ffff6999ca2 in JSC::Interpreter::execute (this=0x7ffff0def058, eval=0x7fffaedfbee0, callFrame=0x7fffffffca50, thisValue=..., scope=0x7fffaeddbec0) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:1255 #4 0x00007ffff6995405 in JSC::eval (callFrame=0x7fffffffca50) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:208 #5 0x00007ffff6a29fd7 in JSC::(anonymous namespace)::llint_slow_path_call_eval (exec=0x7fffffffcae0, pc=0x7ffff0dd7628) at ../../Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1354 #6 0x00007ffff6a33ea2 in llint_entry () from /home/andre/svn/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #7 0x00007ffff6a33b4b in llint_entry () from /home/andre/svn/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #8 0x00007ffff6a2d895 in vmEntryToJavaScript () from /home/andre/svn/webkit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18 #9 0x00007ffff69d46d2 in JSC::JITCode::execute (this=0x7ffff0d9c5f0, vm=0x7fffb09f1000, protoCallFrame=0x7fffffffcd30) at ../../Source/JavaScriptCore/jit/JITCode.cpp:80 #10 0x00007ffff6997f4f in JSC::Interpreter::execute (this=0x7ffff0def058, program=0x7fffaedfbf70, callFrame=0x7fffaede7940, thisObj=0x7fffaedba360) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:960 #11 0x00007ffff6b849ad in JSC::evaluate (exec=0x7fffaede7940, source=..., thisValue=..., returnedException=...) at ../../Source/JavaScriptCore/runtime/Completion.cpp:106 #12 0x000000000043a120 in runInteractive (globalObject=0x7fffaede7900) at ../../Source/JavaScriptCore/jsc.cpp:2083 #13 0x000000000043abcb in runJSC (vm=0x7fffb09f1000, options=...) at ../../Source/JavaScriptCore/jsc.cpp:2244 #14 0x000000000043b0a1 in jscmain (argc=1, argv=0x7fffffffdbb8) at ../../Source/JavaScriptCore/jsc.cpp:2293 #15 0x000000000043967f in main (argc=1, argv=0x7fffffffdbb8) at ../../Source/JavaScriptCore/jsc.cpp:1947 Warning: the current language does not match this frame. --- 1187805 1 andre.bargull 2016-04-27 10:33:06 -0700 Preemptively marked as s-s, please unhide if this issue is not security relevant. 1188151 2 gskachkov 2016-04-27 23:49:06 -0700 At first look, there is problem that we do not emit TDZ check of super when we are trying access to the super by bracket notation in constructor. I'll try to fix. 1188229 3 277618 gskachkov 2016-04-28 06:47:20 -0700 Created attachment 277618 Patch hot fix 1188236 4 277618 darin 2016-04-28 07:22:49 -0700 Comment on attachment 277618 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=277618&action=review > Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:940 > + } > else WebKit coding style puts this brace and else on the same line 1188284 5 277618 gskachkov 2016-04-28 10:03:55 -0700 Comment on attachment 277618 Patch Patch landed Committed 200191: <http://trac.webkit.org/changeset/200191> 1210517 6 webkit-bug-importer 2016-07-13 10:29:18 -0700 <rdar://problem/27326239> 277618 2016-04-28 06:47:20 -0700 2016-04-28 10:03:55 -0700 Patch bug-157089-20160428164750.patch text/plain 5933 gskachkov U3VidmVyc2lvbiBSZXZpc2lvbjogMjAwMTAyCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA5 MGI3ZjRiYTcwOGExODZjZTU4YzM3NjcyNWQ1OTdjOWE1MzIxZjkzLi5kYjBkOGIzZTUwZjc4MWE3 Y2JkNjRhNGQ1NjgyNGM2MjM3YjE3ZTdiIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxNiBAQAorMjAxNi0wNC0yOCAgU2thY2hrb3YgT2xla3NhbmRyICA8Z3NrYWNoa292QGdt YWlsLmNvbT4KKworICAgICAgICBDcmFzaCBmb3Igbm9uLXN0YXRpYyBzdXBlciBwcm9wZXJ0eSBj YWxsIGluIGRlcml2ZWQgY2xhc3MgY29uc3RydWN0b3IKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE1NzA4OQorCisgICAgICAgIFJldmlld2VkIGJ5IE5P Qk9EWSAoT09QUyEpLgorICAgICAgIAorICAgICAgICBBZGRlZCB0ZHogY2hlY2sgb2YgdGhlICd0 aGlzJyBiZWZvcmUgYWNjZXNzIHRvIHRoZSAnc3VwZXInIGZvciBGdW5jdGlvbkNhbGxCcmFja2V0 Tm9kZSwgCisgICAgICAgIHRoZSBzYW1lIGFzIGl0IHdhcyBkb25lIGZvciBGdW5jdGlvbkNhbGxE b3ROb2RlLgorCisgICAgICAgICogYnl0ZWNvbXBpbGVyL05vZGVzQ29kZWdlbi5jcHA6CisgICAg ICAgIChKU0M6OkZ1bmN0aW9uQ2FsbEJyYWNrZXROb2RlOjplbWl0Qnl0ZWNvZGUpOgorCiAyMDE2 LTA0LTI2ICBTa2FjaGtvdiBPbGVrc2FuZHIgIDxnc2thY2hrb3ZAZ21haWwuY29tPgogCiAgICAg ICAgIGNhbGxpbmcgc3VwZXIoKSBhIHNlY29uZCB0aW1lIGluIGEgY29uc3RydWN0b3Igc2hvdWxk IHRocm93CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvbXBpbGVyL05v ZGVzQ29kZWdlbi5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvbXBpbGVyL05vZGVz Q29kZWdlbi5jcHAKaW5kZXggMzg3ZTE0MjgzYmVmZGM3OWM3MWU4MGUyMDRhZWFmNmE2YjdmMGQw NS4uZGFkNzJjNDliYjc3ZTgzNWViMjcyYzA0ODRkYTI3MmMxMzllODZkYyAxMDA2NDQKLS0tIGEv U291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb21waWxlci9Ob2Rlc0NvZGVnZW4uY3BwCisrKyBi L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ieXRlY29tcGlsZXIvTm9kZXNDb2RlZ2VuLmNwcApAQCAt OTMzLDggKzkzMywxMCBAQCBSZWdpc3RlcklEKiBGdW5jdGlvbkNhbGxCcmFja2V0Tm9kZTo6ZW1p dEJ5dGVjb2RlKEJ5dGVjb2RlR2VuZXJhdG9yJiBnZW5lcmF0b3IsCiAKICAgICBSZWZQdHI8UmVn aXN0ZXJJRD4gcmV0dXJuVmFsdWUgPSBnZW5lcmF0b3IuZmluYWxEZXN0aW5hdGlvbihkc3QsIGZ1 bmN0aW9uLmdldCgpKTsKICAgICBDYWxsQXJndW1lbnRzIGNhbGxBcmd1bWVudHMoZ2VuZXJhdG9y LCBtX2FyZ3MpOwotICAgIGlmIChiYXNlSXNTdXBlcikKKyAgICBpZiAoYmFzZUlzU3VwZXIpIHsK KyAgICAgICAgZ2VuZXJhdG9yLmVtaXRURFpDaGVjayhnZW5lcmF0b3IudGhpc1JlZ2lzdGVyKCkp OwogICAgICAgICBnZW5lcmF0b3IuZW1pdE1vdmUoY2FsbEFyZ3VtZW50cy50aGlzUmVnaXN0ZXIo KSwgZ2VuZXJhdG9yLnRoaXNSZWdpc3RlcigpKTsKKyAgICB9CiAgICAgZWxzZQogICAgICAgICBn ZW5lcmF0b3IuZW1pdE1vdmUoY2FsbEFyZ3VtZW50cy50aGlzUmVnaXN0ZXIoKSwgYmFzZS5nZXQo KSk7CiAgICAgUmVnaXN0ZXJJRCogcmV0ID0gZ2VuZXJhdG9yLmVtaXRDYWxsSW5UYWlsUG9zaXRp b24ocmV0dXJuVmFsdWUuZ2V0KCksIGZ1bmN0aW9uLmdldCgpLCBOb0V4cGVjdGVkRnVuY3Rpb24s IGNhbGxBcmd1bWVudHMsIGRpdm90KCksIGRpdm90U3RhcnQoKSwgZGl2b3RFbmQoKSk7CmRpZmYg LS1naXQgYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5k ZXggMDliZDFmNmRkNTg0Y2Q4NDgzZDU1Y2U3OTRlMDAxODQ3MWMxMWM4ZS4uN2NhOWU1Y2Q4MTYx NzJkYzMyMDY4MWRmM2Y3ZGU2OGU3ZTQ3N2NhMiAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hh bmdlTG9nCisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEzIEBACisyMDE2 LTA0LTI4ICBTa2FjaGtvdiBPbGVrc2FuZHIgIDxnc2thY2hrb3ZAZ21haWwuY29tPgorCisgICAg ICAgIENyYXNoIGZvciBub24tc3RhdGljIHN1cGVyIHByb3BlcnR5IGNhbGwgaW4gZGVyaXZlZCBj bGFzcyBjb25zdHJ1Y3RvcgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MTU3MDg5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgKiBqcy9jbGFzcy1zeW50YXgtc3VwZXItZXhwZWN0ZWQudHh0OgorICAgICAgICAq IGpzL3NjcmlwdC10ZXN0cy9jbGFzcy1zeW50YXgtc3VwZXIuanM6CisKIDIwMTYtMDQtMjYgIFNr YWNoa292IE9sZWtzYW5kciAgPGdza2FjaGtvdkBnbWFpbC5jb20+CiAKICAgICAgICAgY2FsbGlu ZyBzdXBlcigpIGEgc2Vjb25kIHRpbWUgaW4gYSBjb25zdHJ1Y3RvciBzaG91bGQgdGhyb3cKZGlm ZiAtLWdpdCBhL0xheW91dFRlc3RzL2pzL2NsYXNzLXN5bnRheC1zdXBlci1leHBlY3RlZC50eHQg Yi9MYXlvdXRUZXN0cy9qcy9jbGFzcy1zeW50YXgtc3VwZXItZXhwZWN0ZWQudHh0CmluZGV4IDg5 YzYwYmU5N2E0YzJjMzdlYTIyNDY5NzNiNWIzYTBhMTA2ZjBjMGQuLjM5MzFhZDk0ODg2NWYxY2Y2 ZWI4OThmNzE3YTc2NDI0ZWM1OTk0OWYgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL2pzL2NsYXNz LXN5bnRheC1zdXBlci1leHBlY3RlZC50eHQKKysrIGIvTGF5b3V0VGVzdHMvanMvY2xhc3Mtc3lu dGF4LXN1cGVyLWV4cGVjdGVkLnR4dApAQCAtNTAsNiArNTAsMTIgQEAgUEFTUyAoZnVuY3Rpb24g KCkgeyBldmFsKCJzdXBlcigpIik7fSkoKTo6OlN5bnRheEVycm9yOiBzdXBlciBpcyBub3QgdmFs aWQgaW4gdGgKIFBBU1MgbmV3IChjbGFzcyB7IGNvbnN0cnVjdG9yKCkgeyAoZnVuY3Rpb24gKCkg eyBldmFsKCJzdXBlcigpIik7fSkoKTsgfSB9KTo6OlN5bnRheEVycm9yOiBzdXBlciBpcyBub3Qg dmFsaWQgaW4gdGhpcyBjb250ZXh0LgogUEFTUyAobmV3IChjbGFzcyB7IG1ldGhvZCgpIHsgKGZ1 bmN0aW9uICgpIHsgZXZhbCgic3VwZXIubWV0aG9kKCkiKTt9KSgpOyB9fSkpLm1ldGhvZCgpOjo6 U3ludGF4RXJyb3I6IHN1cGVyIGlzIG5vdCB2YWxpZCBpbiB0aGlzIGNvbnRleHQuCiBQQVNTIG5l dyAoY2xhc3MgZXh0ZW5kcyBCYXNlIHsgY29uc3RydWN0b3IoKSB7IHN1cGVyKCk7IHN1cGVyKCk7 fX0pOjo6UmVmZXJlbmNlRXJyb3I6ICdzdXBlcigpJyBjYW4ndCBiZSBjYWxsZWQgbW9yZSB0aGFu IG9uY2UgaW4gYSBjb25zdHJ1Y3Rvci4KK1BBU1MgKG5ldyBjbGFzcyBEIGV4dGVuZHMgY2xhc3Mg eyBtKCkge319IHsgY29uc3RydWN0b3IoKSB7IGV2YWwoJ3N1cGVyWyJtIl0oKScpIH0gfSk6OjpS ZWZlcmVuY2VFcnJvcjogQ2Fubm90IGFjY2VzcyB1bmluaXRpYWxpemVkIHZhcmlhYmxlLgorUEFT UyBuZXcgY2xhc3MgZXh0ZW5kcyBjbGFzcyB7IG0oKSB7fX0geyBjb25zdHJ1Y3RvcigpIHsgc3Vw ZXJbIm0iXShzdXBlcigpKSB9IH06OjpSZWZlcmVuY2VFcnJvcjogQ2Fubm90IGFjY2VzcyB1bmlu aXRpYWxpemVkIHZhcmlhYmxlLgorUEFTUyAobmV3IGNsYXNzIEQgZXh0ZW5kcyBjbGFzcyB7IG0o KSB7fX0geyBjb25zdHJ1Y3RvcihmKSB7IHN1cGVyW2YoKV0oKSB9IH0oKCk9PiJtIikpOjo6UmVm ZXJlbmNlRXJyb3I6IENhbm5vdCBhY2Nlc3MgdW5pbml0aWFsaXplZCB2YXJpYWJsZS4KK1BBU1Mg KG5ldyBjbGFzcyBEIGV4dGVuZHMgY2xhc3MgeyBtKCkge319IHsgY29uc3RydWN0b3IoKSB7IHN1 cGVyKCk7IGV2YWwoJ3N1cGVyWyJtIl0oKScpIH0gfSkKK1BBU1MgbmV3IGNsYXNzIGV4dGVuZHMg Y2xhc3MgeyBtKCkge319IHsgY29uc3RydWN0b3IoKSB7IHN1cGVyKCk7IHN1cGVyWyJtIl0oc3Vw ZXIoKSkgfSB9Ojo6UmVmZXJlbmNlRXJyb3I6ICdzdXBlcigpJyBjYW4ndCBiZSBjYWxsZWQgbW9y ZSB0aGFuIG9uY2UgaW4gYSBjb25zdHJ1Y3Rvci4KK1BBU1MgKG5ldyBjbGFzcyBEIGV4dGVuZHMg Y2xhc3MgeyBtKCkge319IHsgY29uc3RydWN0b3IoZikgeyBzdXBlcigpOyBzdXBlcltmKCldKCkg fSB9KCgpPT4ibSIpKQogUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQKIAogVEVTVCBDT01QTEVURQpk aWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvanMvc2NyaXB0LXRlc3RzL2NsYXNzLXN5bnRheC1zdXBl ci5qcyBiL0xheW91dFRlc3RzL2pzL3NjcmlwdC10ZXN0cy9jbGFzcy1zeW50YXgtc3VwZXIuanMK aW5kZXggZjczYTUyYzVhZjUzZTZhYTE4NTNkMjlhYTY5ZmM2YjI0YWQwMTZmYi4uZDNhY2E5OGRl YTdkZjZmOGVhY2VhOTQ4YjQzNTZkYTZhNDZjZThjZSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMv anMvc2NyaXB0LXRlc3RzL2NsYXNzLXN5bnRheC1zdXBlci5qcworKysgYi9MYXlvdXRUZXN0cy9q cy9zY3JpcHQtdGVzdHMvY2xhc3Mtc3ludGF4LXN1cGVyLmpzCkBAIC0xMzYsNCArMTM2LDEyIEBA IHNob3VsZFRocm93KCduZXcgKGNsYXNzIHsgY29uc3RydWN0b3IoKSB7IChmdW5jdGlvbiAoKSB7 IGV2YWwoInN1cGVyKCkiKTt9KSgpOyB9CiBzaG91bGRUaHJvdygnKG5ldyAoY2xhc3MgeyBtZXRo b2QoKSB7IChmdW5jdGlvbiAoKSB7IGV2YWwoInN1cGVyLm1ldGhvZCgpIik7fSkoKTsgfX0pKS5t ZXRob2QoKScsICciU3ludGF4RXJyb3I6IHN1cGVyIGlzIG5vdCB2YWxpZCBpbiB0aGlzIGNvbnRl eHQuIicpOwogCiBzaG91bGRUaHJvdygnbmV3IChjbGFzcyBleHRlbmRzIEJhc2UgeyBjb25zdHJ1 Y3RvcigpIHsgc3VwZXIoKTsgc3VwZXIoKTt9fSknLCAnIlJlZmVyZW5jZUVycm9yOiBcJ3N1cGVy KClcJyBjYW5cJ3QgYmUgY2FsbGVkIG1vcmUgdGhhbiBvbmNlIGluIGEgY29uc3RydWN0b3IuIicp Oworc2hvdWxkVGhyb3coJyhuZXcgY2xhc3MgRCBleHRlbmRzIGNsYXNzIHsgbSgpIHt9fSB7IGNv bnN0cnVjdG9yKCkgeyBldmFsKFwnc3VwZXJbIm0iXSgpXCcpIH0gfSknLCAnIlJlZmVyZW5jZUVy cm9yOiBDYW5ub3QgYWNjZXNzIHVuaW5pdGlhbGl6ZWQgdmFyaWFibGUuIicpOworc2hvdWxkVGhy b3coJ25ldyBjbGFzcyBleHRlbmRzIGNsYXNzIHsgbSgpIHt9fSB7IGNvbnN0cnVjdG9yKCkgeyBz dXBlclsibSJdKHN1cGVyKCkpIH0gfScsICciUmVmZXJlbmNlRXJyb3I6IENhbm5vdCBhY2Nlc3Mg dW5pbml0aWFsaXplZCB2YXJpYWJsZS4iJyk7CitzaG91bGRUaHJvdygnKG5ldyBjbGFzcyBEIGV4 dGVuZHMgY2xhc3MgeyBtKCkge319IHsgY29uc3RydWN0b3IoZikgeyBzdXBlcltmKCldKCkgfSB9 KCgpPT4ibSIpKScsICciUmVmZXJlbmNlRXJyb3I6IENhbm5vdCBhY2Nlc3MgdW5pbml0aWFsaXpl ZCB2YXJpYWJsZS4iJyk7CisKK3Nob3VsZE5vdFRocm93KCcobmV3IGNsYXNzIEQgZXh0ZW5kcyBj bGFzcyB7IG0oKSB7fX0geyBjb25zdHJ1Y3RvcigpIHsgc3VwZXIoKTsgZXZhbChcJ3N1cGVyWyJt Il0oKVwnKSB9IH0pJyk7CitzaG91bGRUaHJvdygnbmV3IGNsYXNzIGV4dGVuZHMgY2xhc3MgeyBt KCkge319IHsgY29uc3RydWN0b3IoKSB7IHN1cGVyKCk7IHN1cGVyWyJtIl0oc3VwZXIoKSkgfSB9 JywgJyJSZWZlcmVuY2VFcnJvcjogXCdzdXBlcigpXCcgY2FuXCd0IGJlIGNhbGxlZCBtb3JlIHRo YW4gb25jZSBpbiBhIGNvbnN0cnVjdG9yLiInKTsKK3Nob3VsZE5vdFRocm93KCcobmV3IGNsYXNz IEQgZXh0ZW5kcyBjbGFzcyB7IG0oKSB7fX0geyBjb25zdHJ1Y3RvcihmKSB7IHN1cGVyKCk7IHN1 cGVyW2YoKV0oKSB9IH0oKCk9PiJtIikpJyk7CisKIHZhciBzdWNjZXNzZnVsbHlQYXJzZWQgPSB0 cnVlOwo=