228075 2021-07-19 01:32:59 -0700 [JSC] invalidParameterInstanceofSourceAppender should care direct call of Symbol.hasInstance 2021-07-20 12:36:07 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 fred.wang ysuzuki bfulgham cgarcia ews-watchlist gpoo keith_miller mark.lam msaboff pmatos product-security rbuis rmorisset rniwa saam svillar ticaiolima tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1777826 0 fred.wang 2021-07-19 01:32:59 -0700 See attached testcase and error message below. Reproduced with JSC on ASAN release builds r280021, for both Linux and macos. ASSERTION FAILED: instanceofIndex != notFound ./runtime/ExceptionHelpers.cpp(222) : WTF::String JSC::invalidParameterInstanceofSourceAppender(const WTF::String &, const WTF::String &, const WTF::String &, JSC::RuntimeType, ErrorInstance::SourceTextWhereErrorOccurred) 1 0x10104f9b4 WTFCrash 2 0x103ac7714 WTFCrashWithInfo(int, char const*, char const*, int) 3 0x106e96e28 JSC::invalidParameterInstanceofSourceAppender(WTF::String const&, WTF::String const&, WTF::String const&, JSC::RuntimeType, JSC::ErrorInstance::SourceTextWhereErrorOccurred) 4 0x106e8d214 JSC::invalidParameterInstanceofhasInstanceValueNotFunctionSourceAppender(WTF::String const&, WTF::String const&, JSC::RuntimeType, JSC::ErrorInstance::SourceTextWhereErrorOccurred) 5 0x106e744c4 JSC::appendSourceToErrorMessage(JSC::CallFrame*, JSC::ErrorInstance*, JSC::BytecodeIndex, WTF::String const&) 6 0x106e737f0 JSC::ErrorInstance::finishCreation(JSC::VM&, JSC::JSGlobalObject*, WTF::String const&, JSC::JSValue, WTF::String (*)(WTF::String const&, WTF::String const&, JSC::RuntimeType, JSC::ErrorInstance::SourceTextWhereErrorOccurred), JSC::RuntimeType, bool) 7 0x106b5a780 JSC::ErrorInstance::create(JSC::JSGlobalObject*, JSC::VM&, JSC::Structure*, WTF::String const&, JSC::JSValue, WTF::String (*)(WTF::String const&, WTF::String const&, JSC::RuntimeType, JSC::ErrorInstance::SourceTextWhereErrorOccurred), JSC::RuntimeType, JSC::ErrorType, bool) 8 0x106e68c00 JSC::createTypeError(JSC::JSGlobalObject*, WTF::String const&, WTF::String (*)(WTF::String const&, WTF::String const&, JSC::RuntimeType, JSC::ErrorInstance::SourceTextWhereErrorOccurred), JSC::RuntimeType) 9 0x106e8ba04 JSC::createError(JSC::JSGlobalObject*, JSC::JSValue, WTF::String const&, WTF::String (*)(WTF::String const&, WTF::String const&, JSC::RuntimeType, JSC::ErrorInstance::SourceTextWhereErrorOccurred)) 10 0x106e8cf6c JSC::createInvalidInstanceofParameterErrorHasInstanceValueNotFunction(JSC::JSGlobalObject*, JSC::JSValue) 11 0x107340988 JSC::JSObject::hasInstance(JSC::JSGlobalObject*, JSC::JSValue, JSC::JSValue) 12 0x107341ed8 JSC::JSObject::hasInstance(JSC::JSGlobalObject*, JSC::JSValue) 13 0x1070a3ec4 JSC::hasInstanceBoundFunction(JSC::JSGlobalObject*, JSC::CallFrame*) 14 0x11d8041b4 15 0x103b6a250 llint_entry 16 0x103b45168 vmEntryToJavaScript 17 0x10623d6b8 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 18 0x10623ae00 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 19 0x106dbc4cc JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 20 0x1008b8704 runWithOptions(GlobalObject*, CommandLine&, bool&) 21 0x10081570c jscmain(int, char**)::$_8::operator()(JSC::VM&, GlobalObject*, bool&) const 22 0x10079c484 int runJSC<jscmain(int, char**)::$_8>(CommandLine const&, bool, jscmain(int, char**)::$_8 const&) 23 0x10079671c jscmain(int, char**) 24 0x100795ec0 main 25 0x189dc1450 start 1777827 1 webkit-bug-importer 2021-07-19 01:33:18 -0700 <rdar://problem/80762879> 1777831 2 433776 fred.wang 2021-07-19 01:41:09 -0700 Created attachment 433776 Testcase Sorry, I forgot to attach the testcase. 1777838 3 fred.wang 2021-07-19 02:24:33 -0700 This is happening when JSC appends a source error. The invalidParameterInstanceofSourceAppender function expects the the sourceText to contain the string "instanceof", which is not the case here: 222 RELEASE_ASSERT(instanceofIndex != notFound); (rr) p content.utf8().data() $1 = 0x607000005510 "[Symbol.hasInstance] is not a function, undefined, or null" (rr) p originalMessage.utf8().data() $2 = 0x608000004d30 "function [Symbol.hasInstance] is not a function, undefined, or null" (rr) p sourceText.utf8().data() $3 = 0x606000007c50 "Function.prototype[Symbol.hasInstance].call(b)" It does not seem a security issue. 1778133 4 ysuzuki 2021-07-20 03:30:32 -0700 Will look 1778134 5 ysuzuki 2021-07-20 03:33:06 -0700 Since this is release-assert, it is not a security issue. 1778136 6 433866 ysuzuki 2021-07-20 03:42:15 -0700 Created attachment 433866 Patch 1778145 7 433866 fred.wang 2021-07-20 04:19:07 -0700 Comment on attachment 433866 Patch Thanks. I'm going to r+ this since I suspect many reviewers are on holidays and this change seems uncontroversial. 1778223 8 433866 ysuzuki 2021-07-20 11:47:40 -0700 Comment on attachment 433866 Patch Thanks! 1778242 9 ews-feeder 2021-07-20 12:36:04 -0700 Committed r280097 (239814@main): <https://commits.webkit.org/239814@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 433866. 433776 2021-07-19 01:41:09 -0700 2021-07-19 01:41:09 -0700 Testcase release-assert-instanceofindex-not-found.js application/x-javascript 154 fred.wang bGV0IGEgPSBmdW5jdGlvbigpIHt9OwpPYmplY3QuZGVmaW5lUHJvcGVydHkoYSwgU3ltYm9sLmhh c0luc3RhbmNlLCB7IHZhbHVlOiBBdG9taWNzIH0pOwpsZXQgYiA9IGEuYmluZCgpOwpGdW5jdGlv bi5wcm90b3R5cGVbU3ltYm9sLmhhc0luc3RhbmNlXS5jYWxsKGIpCg== 433866 2021-07-20 03:42:15 -0700 2021-07-20 12:36:05 -0700 Patch bug-228075-20210720034214.patch text/plain 3622 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjgwMDY4CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBj MWNjZGQ4NjhkMjY0ODcxZGQwY2M2MDI0ZGUxMDY2NGZhOTk3ZTU4Li43MmMyODMwMTliMGVmZDli YTVhMTlmY2NlN2Q4N2ZkOTA1MjM2NDFjIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxOCBAQAorMjAyMS0wNy0yMCAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29t PgorCisgICAgICAgIFtKU0NdIGludmFsaWRQYXJhbWV0ZXJJbnN0YW5jZW9mU291cmNlQXBwZW5k ZXIgc2hvdWxkIGNhcmUgZGlyZWN0IGNhbGwgb2YgU3ltYm9sLmhhc0luc3RhbmNlCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjgwNzUKKyAgICAgICAg cmRhcjovLzgwNzYyODc5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisK KyAgICAgICAgaW52YWxpZFBhcmFtZXRlckluc3RhbmNlb2ZTb3VyY2VBcHBlbmRlciBjYW4gYmUg aW52b2tlZCB3aXRob3V0IGBpbnN0YW5jZW9mYCBleHByZXNzaW9uIHNpbmNlIHdlIGNhbiBjYWxs CisgICAgICAgIGBbU3ltYm9sLmhhc0luc3RhbmNlXWAgZnVuY3Rpb24gZGlyZWN0bHksIGJ1dCB0 aGUgaW1wbGVtZW50YXRpb24gZGlkIG5vdCBhc3N1bWUgdGhhdC4gVGhpcyBwYXRjaCBmaXhlcwor ICAgICAgICBpdCB0byBoYW5kbGUgdGhpcyBkaXJlY3QgY2FsbC4KKworICAgICAgICAqIHJ1bnRp bWUvRXhjZXB0aW9uSGVscGVycy5jcHA6CisgICAgICAgIChKU0M6OmludmFsaWRQYXJhbWV0ZXJJ bnN0YW5jZW9mU291cmNlQXBwZW5kZXIpOgorCiAyMDIxLTA3LTE5ICBZdXN1a2UgU3V6dWtpICA8 eXN1enVraUBhcHBsZS5jb20+CiAKICAgICAgICAgW0pTQ10gU3RydWN0dXJlU3R1YkluZm8ncyBt X2lkZW50aWZpZXIgc2hvdWxkIGZvbGxvdyB0byB0aGUgc2FtZSBwcm90b2NvbCBvZiBpbmxpbmVB Y2Nlc3NCYXNlU3RydWN0dXJlCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVu dGltZS9FeGNlcHRpb25IZWxwZXJzLmNwcCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1l L0V4Y2VwdGlvbkhlbHBlcnMuY3BwCmluZGV4IGI1OTVhMzAyODM3NjkzZDRiNzQ4NWZkNTE1ZWJh MTY3YmVmZjkzOTguLjA5OWZmNzFjZDYyNjViOGQxY2E4YzkxZTM2MTEzNjFlZTBlZTdmYTMgMTAw NjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0V4Y2VwdGlvbkhlbHBlcnMu Y3BwCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0V4Y2VwdGlvbkhlbHBlcnMu Y3BwCkBAIC0yMTksNyArMjE5LDEwIEBAIGlubGluZSBTdHJpbmcgaW52YWxpZFBhcmFtZXRlcklu c3RhbmNlb2ZTb3VyY2VBcHBlbmRlcihjb25zdCBTdHJpbmcmIGNvbnRlbnQsIGNvCiAKICAgICBB U1NFUlQob2NjdXJyZW5jZSA9PSBFcnJvckluc3RhbmNlOjpGb3VuZEV4YWN0U291cmNlKTsKICAg ICBhdXRvIGluc3RhbmNlb2ZJbmRleCA9IHNvdXJjZVRleHQucmV2ZXJzZUZpbmQoImluc3RhbmNl b2YiKTsKLSAgICBSRUxFQVNFX0FTU0VSVChpbnN0YW5jZW9mSW5kZXggIT0gbm90Rm91bmQpOwor ICAgIC8vIFRoaXMgY2FuIGhhcHBlbiB3aGVuIFN5bWJvbC5oYXNJbnN0YW5jZSBmdW5jdGlvbiBp cyBkaXJlY3RseSBjYWxsZWQuCisgICAgaWYgKGluc3RhbmNlb2ZJbmRleCA9PSBub3RGb3VuZCkK KyAgICAgICAgcmV0dXJuIG9yaWdpbmFsTWVzc2FnZTsKKwogICAgIGlmIChzb3VyY2VUZXh0LmZp bmQoImluc3RhbmNlb2YiKSAhPSBpbnN0YW5jZW9mSW5kZXgpCiAgICAgICAgIHJldHVybiBtYWtl U3RyaW5nKG9yaWdpbmFsTWVzc2FnZSwgIiAoZXZhbHVhdGluZyAnIiwgc291cmNlVGV4dCwgIicp Iik7CiAKZGlmZiAtLWdpdCBhL0pTVGVzdHMvQ2hhbmdlTG9nIGIvSlNUZXN0cy9DaGFuZ2VMb2cK aW5kZXggNGY0MzY3OTc5MTljYTNmZWY5ZmQwZTFhNjRhNWQ2NTE3N2U5Nzk3Ny4uYjJmNjk5NDNk OWRjZWM4YzU1NzJkYWEzMGY2ZmIzYmQxMWVlMDI1YiAxMDA2NDQKLS0tIGEvSlNUZXN0cy9DaGFu Z2VMb2cKKysrIGIvSlNUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAyMS0wNy0y MCAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29tPgorCisgICAgICAgIFtKU0NdIGlu dmFsaWRQYXJhbWV0ZXJJbnN0YW5jZW9mU291cmNlQXBwZW5kZXIgc2hvdWxkIGNhcmUgZGlyZWN0 IGNhbGwgb2YgU3ltYm9sLmhhc0luc3RhbmNlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0yMjgwNzUKKyAgICAgICAgcmRhcjovLzgwNzYyODc5CisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3Mvc3lt Ym9sLWhhc2luc3RhbmNlLWVycm9yLmpzOiBBZGRlZC4KKyAgICAgICAgKHNob3VsZFRocm93KToK KyAgICAgICAgKGxldC5hKToKKwogMjAyMS0wNy0xOSAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBs ZS5jb20+CiAKICAgICAgICAgREZHJ3MgcGFyc2VJbnRSZXN1bHQoKSBzaG91bGQgY2hlY2sgZm9y IG5lZ2F0aXZlIHplcm8uCmRpZmYgLS1naXQgYS9KU1Rlc3RzL3N0cmVzcy9zeW1ib2wtaGFzaW5z dGFuY2UtZXJyb3IuanMgYi9KU1Rlc3RzL3N0cmVzcy9zeW1ib2wtaGFzaW5zdGFuY2UtZXJyb3Iu anMKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMC4uNjg0OGUwOGM0MmUzZTE1ZjM1N2NiOGVjNmIyM2E0MGNkZjg0MzZmZgot LS0gL2Rldi9udWxsCisrKyBiL0pTVGVzdHMvc3RyZXNzL3N5bWJvbC1oYXNpbnN0YW5jZS1lcnJv ci5qcwpAQCAtMCwwICsxLDIxIEBACitmdW5jdGlvbiBzaG91bGRUaHJvdyhmdW5jLCBlcnJvck1l c3NhZ2UpIHsKKyAgICB2YXIgZXJyb3JUaHJvd24gPSBmYWxzZTsKKyAgICB2YXIgZXJyb3IgPSBu dWxsOworICAgIHRyeSB7CisgICAgICAgIGZ1bmMoKTsKKyAgICB9IGNhdGNoIChlKSB7CisgICAg ICAgIGVycm9yVGhyb3duID0gdHJ1ZTsKKyAgICAgICAgZXJyb3IgPSBlOworICAgIH0KKyAgICBp ZiAoIWVycm9yVGhyb3duKQorICAgICAgICB0aHJvdyBuZXcgRXJyb3IoJ25vdCB0aHJvd24nKTsK KyAgICBpZiAoU3RyaW5nKGVycm9yKSAhPT0gZXJyb3JNZXNzYWdlKQorICAgICAgICB0aHJvdyBu ZXcgRXJyb3IoYGJhZCBlcnJvcjogJHtTdHJpbmcoZXJyb3IpfWApOworfQorCitsZXQgYSA9IGZ1 bmN0aW9uKCkge307CitPYmplY3QuZGVmaW5lUHJvcGVydHkoYSwgU3ltYm9sLmhhc0luc3RhbmNl LCB7IHZhbHVlOiBBdG9taWNzIH0pOworbGV0IGIgPSBhLmJpbmQoKTsKK3Nob3VsZFRocm93KCgp ID0+IHsKKyAgICBGdW5jdGlvbi5wcm90b3R5cGVbU3ltYm9sLmhhc0luc3RhbmNlXS5jYWxsKGIp Cit9LCBgVHlwZUVycm9yOiBmdW5jdGlvbiBbU3ltYm9sLmhhc0luc3RhbmNlXSBpcyBub3QgYSBm dW5jdGlvbiwgdW5kZWZpbmVkLCBvciBudWxsYCk7Cg==