| Summary: | [jsfunfuzz] With blocks do not correctly protect their scope object | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Oliver Hunt <oliver> | ||||
| Component: | JavaScriptCore | Assignee: | Oliver Hunt <oliver> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | Keywords: | InRadar | ||||
| Priority: | P1 | ||||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | Mac | ||||||
| OS: | OS X 10.5 | ||||||
| Bug Depends on: | |||||||
| Bug Blocks: | 13638 | ||||||
| Attachments: |
|
||||||
<rdar://problem/6469742> Crash in JSC::TypeInfo::hasStandardGetOwnPropertySlot() running jsfunfuzz Created attachment 26330 [details]
Correctly guard the scope object
Yay, fixeration \o/
Comment on attachment 26330 [details] Correctly guard the scope object Seems like a good solution. r=me > + * fast/js/resources/with-scope-gc.js: Added. > + (gc): > + (): You should remove the function names here. In particular, the "()" doesn't add much. Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/bytecompiler/BytecodeGenerator.cpp M JavaScriptCore/interpreter/Interpreter.cpp M JavaScriptCore/interpreter/Interpreter.h M JavaScriptCore/jit/JIT.cpp M JavaScriptCore/parser/Nodes.cpp M LayoutTests/ChangeLog A LayoutTests/fast/js/resources/with-scope-gc.js A LayoutTests/fast/js/with-scope-gc-expected.txt A LayoutTests/fast/js/with-scope-gc.html Committed r39524 |
JSFunFuzz found this with(1){gc();a;} Which crashes as the scope object (1->toObject()) is not protected by the registerfile as is expected. Looking into this i also found that we would not correctly protect the scope when local variables are usedfor scope, as in: var z; with(z={}){z=null; {}; {}; [1,2,3,4*{}]; gc(); b}