39360 2010-05-19 07:53:33 -0700 JSObjectSetPrototype doesn't check for cycle in prototype chain. 2010-05-28 23:16:41 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 39356 1 jedrzej.nowacki jedrzej.nowacki commit-queue ggaren oliver oldest_to_newest 227823 0 jedrzej.nowacki 2010-05-19 07:53:33 -0700 JSObjectSetPrototype permits to set any object as prototype of any object. Lack of check if an object being added to a property chain is actually in it, could produce crashes and hangs. A small snippet: JSObjectRef object = JSObjectMake(context, /* jsClass */ 0, /* data */ 0); JSObjectSetPrototype(context, object, object); JSObjectGetProperty(context, object, invalid_property_name, /* exception*/ 0); The code should hang. I suppose to see same behavior: > a = new Object [object Object] > a.__proto__=a Exception: Error: cyclic __proto__ value > The patch is on the way... 231704 1 57329 jedrzej.nowacki 2010-05-28 07:29:00 -0700 Created attachment 57329 Fix v1 231755 2 57329 ggaren 2010-05-28 10:06:02 -0700 Comment on attachment 57329 Fix v1 r=me Nice. 232071 3 57329 commit-queue 2010-05-28 23:16:35 -0700 Comment on attachment 57329 Fix v1 Clearing flags on attachment: 57329 Committed r60390: <http://trac.webkit.org/changeset/60390> 232072 4 commit-queue 2010-05-28 23:16:41 -0700 All reviewed patches have been landed. Closing bug. 57329 2010-05-28 07:29:00 -0700 2010-05-28 23:16:35 -0700 Fix v1 proto.diff text/plain 7188 jedrzej.nowacki ZGlmZiAtLWdpdCBhL0phdmFTY3JpcHRDb3JlL0FQSS9KU09iamVjdFJlZi5jcHAgYi9KYXZhU2Ny aXB0Q29yZS9BUEkvSlNPYmplY3RSZWYuY3BwCmluZGV4IDczYmJhNjcuLjcwYzRlMTQgMTAwNjQ0 Ci0tLSBhL0phdmFTY3JpcHRDb3JlL0FQSS9KU09iamVjdFJlZi5jcHAKKysrIGIvSmF2YVNjcmlw dENvcmUvQVBJL0pTT2JqZWN0UmVmLmNwcApAQCAtMjM2LDcgKzIzNiw3IEBAIHZvaWQgSlNPYmpl Y3RTZXRQcm90b3R5cGUoSlNDb250ZXh0UmVmIGN0eCwgSlNPYmplY3RSZWYgb2JqZWN0LCBKU1Zh bHVlUmVmIHZhbHVlCiAgICAgSlNPYmplY3QqIGpzT2JqZWN0ID0gdG9KUyhvYmplY3QpOwogICAg IEpTVmFsdWUganNWYWx1ZSA9IHRvSlMoZXhlYywgdmFsdWUpOwogCi0gICAganNPYmplY3QtPnNl dFByb3RvdHlwZShqc1ZhbHVlLmlzT2JqZWN0KCkgPyBqc1ZhbHVlIDoganNOdWxsKCkpOworICAg IGpzT2JqZWN0LT5zZXRQcm90b3R5cGVXaXRoQ3ljbGVDaGVjayhqc1ZhbHVlLmlzT2JqZWN0KCkg PyBqc1ZhbHVlIDoganNOdWxsKCkpOwogfQogCiBib29sIEpTT2JqZWN0SGFzUHJvcGVydHkoSlND b250ZXh0UmVmIGN0eCwgSlNPYmplY3RSZWYgb2JqZWN0LCBKU1N0cmluZ1JlZiBwcm9wZXJ0eU5h bWUpCmRpZmYgLS1naXQgYS9KYXZhU2NyaXB0Q29yZS9BUEkvdGVzdHMvdGVzdGFwaS5jIGIvSmF2 YVNjcmlwdENvcmUvQVBJL3Rlc3RzL3Rlc3RhcGkuYwppbmRleCAyOGI0ZWM4Li43ODBlOTk2IDEw MDY0NAotLS0gYS9KYXZhU2NyaXB0Q29yZS9BUEkvdGVzdHMvdGVzdGFwaS5jCisrKyBiL0phdmFT Y3JpcHRDb3JlL0FQSS90ZXN0cy90ZXN0YXBpLmMKQEAgLTc2NCw2ICs3NjQsNTkgQEAgc3RhdGlj IHZvaWQgbWFrZUdsb2JhbE51bWJlclZhbHVlKEpTQ29udGV4dFJlZiBjb250ZXh0KSB7CiAgICAg diA9IE5VTEw7CiB9CiAKK3N0YXRpYyBib29sIGFzc2VydFRydWUoYm9vbCB2YWx1ZSwgY29uc3Qg Y2hhciogbWVzc2FnZSkKK3sKKyAgICBpZiAoIXZhbHVlKSB7CisgICAgICAgIGlmIChtZXNzYWdl KQorICAgICAgICAgICAgZnByaW50ZihzdGRlcnIsICJhc3NlcnRUcnVlIGZhaWxlZDogJyVzJ1xu IiwgbWVzc2FnZSk7CisgICAgICAgIGVsc2UKKyAgICAgICAgICAgIGZwcmludGYoc3RkZXJyLCAi YXNzZXJ0VHJ1ZSBmYWlsZWQuXG4iKTsKKyAgICAgICAgZmFpbGVkID0gMTsKKyAgICB9CisgICAg cmV0dXJuIHZhbHVlOworfQorCitzdGF0aWMgYm9vbCBjaGVja0ZvckN5Y2xlSW5Qcm90b3R5cGVD aGFpbigpCit7CisgICAgYm9vbCByZXN1bHQgPSB0cnVlOworICAgIEpTR2xvYmFsQ29udGV4dFJl ZiBjb250ZXh0ID0gSlNHbG9iYWxDb250ZXh0Q3JlYXRlKDApOworICAgIEpTT2JqZWN0UmVmIG9i amVjdDEgPSBKU09iamVjdE1ha2UoY29udGV4dCwgLyoganNDbGFzcyAqLyAwLCAvKiBkYXRhICov IDApOworICAgIEpTT2JqZWN0UmVmIG9iamVjdDIgPSBKU09iamVjdE1ha2UoY29udGV4dCwgLyog anNDbGFzcyAqLyAwLCAvKiBkYXRhICovIDApOworICAgIEpTT2JqZWN0UmVmIG9iamVjdDMgPSBK U09iamVjdE1ha2UoY29udGV4dCwgLyoganNDbGFzcyAqLyAwLCAvKiBkYXRhICovIDApOworCisg ICAgSlNPYmplY3RTZXRQcm90b3R5cGUoY29udGV4dCwgb2JqZWN0MSwgSlNWYWx1ZU1ha2VOdWxs KGNvbnRleHQpKTsKKyAgICBBU1NFUlQoSlNWYWx1ZUlzTnVsbChjb250ZXh0LCBKU09iamVjdEdl dFByb3RvdHlwZShjb250ZXh0LCBvYmplY3QxKSkpOworCisgICAgLy8gb2JqZWN0MSAtPiBvYmpl Y3QxCisgICAgSlNPYmplY3RTZXRQcm90b3R5cGUoY29udGV4dCwgb2JqZWN0MSwgb2JqZWN0MSk7 CisgICAgcmVzdWx0ICY9IGFzc2VydFRydWUoSlNWYWx1ZUlzTnVsbChjb250ZXh0LCBKU09iamVj dEdldFByb3RvdHlwZShjb250ZXh0LCBvYmplY3QxKSksICJJdCBpcyBwb3NzaWJsZSB0byBhc3Np Z24gc2VsZiBhcyBhIHByb3RvdHlwZSIpOworCisgICAgLy8gb2JqZWN0MSAtPiBvYmplY3QyIC0+ IG9iamVjdDEKKyAgICBKU09iamVjdFNldFByb3RvdHlwZShjb250ZXh0LCBvYmplY3QyLCBvYmpl Y3QxKTsKKyAgICBBU1NFUlQoSlNWYWx1ZUlzU3RyaWN0RXF1YWwoY29udGV4dCwgSlNPYmplY3RH ZXRQcm90b3R5cGUoY29udGV4dCwgb2JqZWN0MiksIG9iamVjdDEpKTsKKyAgICBKU09iamVjdFNl dFByb3RvdHlwZShjb250ZXh0LCBvYmplY3QxLCBvYmplY3QyKTsKKyAgICByZXN1bHQgJj0gYXNz ZXJ0VHJ1ZShKU1ZhbHVlSXNOdWxsKGNvbnRleHQsIEpTT2JqZWN0R2V0UHJvdG90eXBlKGNvbnRl eHQsIG9iamVjdDEpKSwgIkl0IGlzIHBvc3NpYmxlIHRvIGNsb3NlIGEgcHJvdG90eXBlIGNoYWlu IGN5Y2xlIik7CisKKyAgICAvLyBvYmplY3QxIC0+IG9iamVjdDIgLT4gb2JqZWN0MyAtPiBvYmpl Y3QxCisgICAgSlNPYmplY3RTZXRQcm90b3R5cGUoY29udGV4dCwgb2JqZWN0Miwgb2JqZWN0Myk7 CisgICAgQVNTRVJUKEpTVmFsdWVJc1N0cmljdEVxdWFsKGNvbnRleHQsIEpTT2JqZWN0R2V0UHJv dG90eXBlKGNvbnRleHQsIG9iamVjdDIpLCBvYmplY3QzKSk7CisgICAgSlNPYmplY3RTZXRQcm90 b3R5cGUoY29udGV4dCwgb2JqZWN0MSwgb2JqZWN0Mik7CisgICAgQVNTRVJUKEpTVmFsdWVJc1N0 cmljdEVxdWFsKGNvbnRleHQsIEpTT2JqZWN0R2V0UHJvdG90eXBlKGNvbnRleHQsIG9iamVjdDEp LCBvYmplY3QyKSk7CisgICAgSlNPYmplY3RTZXRQcm90b3R5cGUoY29udGV4dCwgb2JqZWN0Mywg b2JqZWN0MSk7CisgICAgcmVzdWx0ICY9IGFzc2VydFRydWUoIUpTVmFsdWVJc1N0cmljdEVxdWFs KGNvbnRleHQsIEpTT2JqZWN0R2V0UHJvdG90eXBlKGNvbnRleHQsIG9iamVjdDMpLCBvYmplY3Qx KSwgIkl0IGlzIHBvc3NpYmxlIHRvIGNsb3NlIGEgcHJvdG90eXBlIGNoYWluIGN5Y2xlIik7CisK KyAgICBKU1ZhbHVlUmVmIGV4Y2VwdGlvbjsKKyAgICBKU1N0cmluZ1JlZiBjb2RlID0gSlNTdHJp bmdDcmVhdGVXaXRoVVRGOENTdHJpbmcoIm8gPSB7IH07IHAgPSB7IH07IG8uX19wcm90b19fID0g cDsgcC5fX3Byb3RvX18gPSBvIik7CisgICAgSlNTdHJpbmdSZWYgZmlsZSA9IEpTU3RyaW5nQ3Jl YXRlV2l0aFVURjhDU3RyaW5nKCIiKTsKKyAgICByZXN1bHQgJj0gYXNzZXJ0VHJ1ZSghSlNFdmFs dWF0ZVNjcmlwdChjb250ZXh0LCBjb2RlLCAvKiB0aGlzT2JqZWN0Ki8gMCwgZmlsZSwgMSwgJmV4 Y2VwdGlvbikKKyAgICAgICAgICAgICAgICAgICAgICAgICAsICJBbiBleGNlcHRpb24gc2hvdWxk IGJlIHRocm93biIpOworCisgICAgSlNTdHJpbmdSZWxlYXNlKGNvZGUpOworICAgIEpTU3RyaW5n UmVsZWFzZShmaWxlKTsKKyAgICBKU0dsb2JhbENvbnRleHRSZWxlYXNlKGNvbnRleHQpOworICAg IHJldHVybiByZXN1bHQ7Cit9CisKIGludCBtYWluKGludCBhcmdjLCBjaGFyKiBhcmd2W10pCiB7 CiAgICAgY29uc3QgY2hhciAqc2NyaXB0UGF0aCA9ICJ0ZXN0YXBpLmpzIjsKQEAgLTEzNDYsNiAr MTM5OSwxMyBAQCBpbnQgbWFpbihpbnQgYXJnYywgY2hhciogYXJndltdKQogCiAgICAgcHJpbnRm KCJQQVNTOiBJbmZpbml0ZSBwcm90b3R5cGUgY2hhaW4gZG9lcyBub3Qgb2NjdXIuXG4iKTsKIAor ICAgIGlmIChjaGVja0ZvckN5Y2xlSW5Qcm90b3R5cGVDaGFpbigpKQorICAgICAgICBwcmludGYo IlBBU1M6IEEgY3ljbGUgaW4gYSBwcm90b3R5cGUgY2hhaW4gY2FuJ3QgYmUgY3JlYXRlZC5cbiIp OworICAgIGVsc2UgeworICAgICAgICBwcmludGYoIkZBSUw6IEEgY3ljbGUgaW4gYSBwcm90b3R5 cGUgY2hhaW4gY2FuIGJlIGNyZWF0ZWQuXG4iKTsKKyAgICAgICAgZmFpbGVkID0gdHJ1ZTsKKyAg ICB9CisKICAgICBpZiAoZmFpbGVkKSB7CiAgICAgICAgIHByaW50ZigiRkFJTDogU29tZSB0ZXN0 cyBmYWlsZWQuXG4iKTsKICAgICAgICAgcmV0dXJuIDE7CmRpZmYgLS1naXQgYS9KYXZhU2NyaXB0 Q29yZS9DaGFuZ2VMb2cgYi9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKaW5kZXggNGU3MGIyOS4u MWVmY2ExOCAxMDA2NDQKLS0tIGEvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCisrKyBiL0phdmFT Y3JpcHRDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI4IEBACisyMDEwLTA1LTI4ICBKZWRyemVq IE5vd2Fja2kgIDxqZWRyemVqLm5vd2Fja2lAbm9raWEuY29tPgorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCB0aGUgSlNPYmplY3RTZXRQcm90b3R5 cGUgZnVuY3Rpb24uCisKKyAgICAgICAgQSBjeWNsZSBpbiBhIHByb3RvdHlwZSBjaGFpbiBjYW4g Y2F1c2UgYW4gYXBwbGljYXRpb24gaGFuZyBvcgorICAgICAgICBldmVuIGNyYXNoLgorICAgICAg ICBBIGNoZWNrIGZvciBhIHByb3RvdHlwZSBjaGFpbiBjeWNsZXMgd2FzIGFkZGVkIHRvCisgICAg ICAgIHRoZSBKU09iamVjdFNldFByb3RvdHlwZS4KKworICAgICAgICBKU09iamVjdFNldFByb3Rv dHlwZSBkb2Vzbid0IGNoZWNrIGZvciBjeWNsZSBpbiBwcm90b3R5cGUgY2hhaW4uCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zOTM2MAorCisgICAgICAg ICogQVBJL0pTT2JqZWN0UmVmLmNwcDoKKyAgICAgICAgKEpTT2JqZWN0U2V0UHJvdG90eXBlKToK KyAgICAgICAgKiBBUEkvdGVzdHMvdGVzdGFwaS5jOgorICAgICAgICAoYXNzZXJ0VHJ1ZSk6Cisg ICAgICAgIChjaGVja0ZvckN5Y2xlSW5Qcm90b3R5cGVDaGFpbik6CisgICAgICAgIChtYWluKToK KyAgICAgICAgKiBydW50aW1lL0pTT2JqZWN0LmNwcDoKKyAgICAgICAgKEpTQzo6SlNPYmplY3Q6 OnB1dCk6CisgICAgICAgICogcnVudGltZS9KU09iamVjdC5oOgorICAgICAgICAoSlNDOjpKU09i amVjdDo6c2V0UHJvdG90eXBlV2l0aEN5Y2xlQ2hlY2spOgorCiAyMDEwLTA1LTEyICBKZWRyemVq IE5vd2Fja2kgIDxqZWRyemVqLm5vd2Fja2lAbm9raWEuY29tPgogCiAgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgpkaWZmIC0tZ2l0IGEvSmF2YVNjcmlwdENvcmUvcnVudGltZS9K U09iamVjdC5jcHAgYi9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2JqZWN0LmNwcAppbmRleCAz YWM4YTM0Li41Y2ZmNGZhIDEwMDY0NAotLS0gYS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2Jq ZWN0LmNwcAorKysgYi9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2JqZWN0LmNwcApAQCAtMTA0 LDE4ICsxMDQsOCBAQCB2b2lkIEpTT2JqZWN0OjpwdXQoRXhlY1N0YXRlKiBleGVjLCBjb25zdCBJ ZGVudGlmaWVyJiBwcm9wZXJ0eU5hbWUsIEpTVmFsdWUgdmFsdQogICAgICAgICAvLyBTZXR0aW5n IF9fcHJvdG9fXyB0byBhIG5vbi1vYmplY3QsIG5vbi1udWxsIHZhbHVlIGlzIHNpbGVudGx5IGln bm9yZWQgdG8gbWF0Y2ggTW96aWxsYS4KICAgICAgICAgaWYgKCF2YWx1ZS5pc09iamVjdCgpICYm ICF2YWx1ZS5pc051bGwoKSkKICAgICAgICAgICAgIHJldHVybjsKLQotICAgICAgICBKU1ZhbHVl IG5leHRQcm90b3R5cGVWYWx1ZSA9IHZhbHVlOwotICAgICAgICB3aGlsZSAobmV4dFByb3RvdHlw ZVZhbHVlICYmIG5leHRQcm90b3R5cGVWYWx1ZS5pc09iamVjdCgpKSB7Ci0gICAgICAgICAgICBK U09iamVjdCogbmV4dFByb3RvdHlwZSA9IGFzT2JqZWN0KG5leHRQcm90b3R5cGVWYWx1ZSktPnVu d3JhcHBlZE9iamVjdCgpOwotICAgICAgICAgICAgaWYgKG5leHRQcm90b3R5cGUgPT0gdGhpcykg ewotICAgICAgICAgICAgICAgIHRocm93RXJyb3IoZXhlYywgR2VuZXJhbEVycm9yLCAiY3ljbGlj IF9fcHJvdG9fXyB2YWx1ZSIpOwotICAgICAgICAgICAgICAgIHJldHVybjsKLSAgICAgICAgICAg IH0KLSAgICAgICAgICAgIG5leHRQcm90b3R5cGVWYWx1ZSA9IG5leHRQcm90b3R5cGUtPnByb3Rv dHlwZSgpOwotICAgICAgICB9Ci0KLSAgICAgICAgc2V0UHJvdG90eXBlKHZhbHVlKTsKKyAgICAg ICAgaWYgKCFzZXRQcm90b3R5cGVXaXRoQ3ljbGVDaGVjayh2YWx1ZSkpCisgICAgICAgICAgICB0 aHJvd0Vycm9yKGV4ZWMsIEdlbmVyYWxFcnJvciwgImN5Y2xpYyBfX3Byb3RvX18gdmFsdWUiKTsK ICAgICAgICAgcmV0dXJuOwogICAgIH0KIApkaWZmIC0tZ2l0IGEvSmF2YVNjcmlwdENvcmUvcnVu dGltZS9KU09iamVjdC5oIGIvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU09iamVjdC5oCmluZGV4 IGU5NDJhZDAuLjA3MzhkNjAgMTAwNjQ0Ci0tLSBhL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNP YmplY3QuaAorKysgYi9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTT2JqZWN0LmgKQEAgLTg4LDYg Kzg4LDcgQEAgbmFtZXNwYWNlIEpTQyB7CiAKICAgICAgICAgSlNWYWx1ZSBwcm90b3R5cGUoKSBj b25zdDsKICAgICAgICAgdm9pZCBzZXRQcm90b3R5cGUoSlNWYWx1ZSBwcm90b3R5cGUpOworICAg ICAgICBib29sIHNldFByb3RvdHlwZVdpdGhDeWNsZUNoZWNrKEpTVmFsdWUgcHJvdG90eXBlKTsK ICAgICAgICAgCiAgICAgICAgIHZvaWQgc2V0U3RydWN0dXJlKE5vbk51bGxQYXNzUmVmUHRyPFN0 cnVjdHVyZT4pOwogICAgICAgICBTdHJ1Y3R1cmUqIGluaGVyaXRvcklEKCk7CkBAIC0zMTIsNiAr MzEzLDE5IEBAIGlubGluZSBKU1ZhbHVlIEpTT2JqZWN0Ojpwcm90b3R5cGUoKSBjb25zdAogICAg IHJldHVybiBtX3N0cnVjdHVyZS0+c3RvcmVkUHJvdG90eXBlKCk7CiB9CiAKK2lubGluZSBib29s IEpTT2JqZWN0OjpzZXRQcm90b3R5cGVXaXRoQ3ljbGVDaGVjayhKU1ZhbHVlIHByb3RvdHlwZSkK K3sKKyAgICBKU1ZhbHVlIG5leHRQcm90b3R5cGVWYWx1ZSA9IHByb3RvdHlwZTsKKyAgICB3aGls ZSAobmV4dFByb3RvdHlwZVZhbHVlICYmIG5leHRQcm90b3R5cGVWYWx1ZS5pc09iamVjdCgpKSB7 CisgICAgICAgIEpTT2JqZWN0KiBuZXh0UHJvdG90eXBlID0gYXNPYmplY3QobmV4dFByb3RvdHlw ZVZhbHVlKS0+dW53cmFwcGVkT2JqZWN0KCk7CisgICAgICAgIGlmIChuZXh0UHJvdG90eXBlID09 IHRoaXMpCisgICAgICAgICAgICByZXR1cm4gZmFsc2U7CisgICAgICAgIG5leHRQcm90b3R5cGVW YWx1ZSA9IG5leHRQcm90b3R5cGUtPnByb3RvdHlwZSgpOworICAgIH0KKyAgICBzZXRQcm90b3R5 cGUocHJvdG90eXBlKTsKKyAgICByZXR1cm4gdHJ1ZTsKK30KKwogaW5saW5lIHZvaWQgSlNPYmpl Y3Q6OnNldFByb3RvdHlwZShKU1ZhbHVlIHByb3RvdHlwZSkKIHsKICAgICBBU1NFUlQocHJvdG90 eXBlKTsK