Bug 63398 – Poisoning of strict caller,arguments inappropriately poisoning "in"

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Mark S. Miller]

'caller' in function(){"use strict"}
TypeError: Cannot access caller property of a strict mode function
'arguments' in function(){"use strict"}
TypeError: Can't access arguments object of a strict mode function

The poisoning should be equivalent to making 'caller' and 'arguments' into accessor properties whose getter & setter throw. However, getters and setters should not be activated by "in".

[Mark S. Miller]

I'm using WebKit Nightly Version 5.0.5 (5533.21.1, r89741).


A further weirdness is that the TypeError that's thrown isn't caught by a one level try/catch.

try { 'caller' in function(){"use strict"} } catch (e) {}
TypeError: Cannot access caller property of a strict mode function


Further testing in the context of a larger system (look for "has(" in http://codereview.appspot.com/4603044/patch/8002/18002?column_width=100 ) indicates that there is some two level combination of try/catch/finally which can catch the TypeError in the out catch, even though it had skipped past both the inner catch and finally. However, I haven't isolated this yet into a standalone test case. This may be symptom of a distinct bug.

Without one of the finallys there, I also found that testing under the WebKit debigger caused WebKit as a whole to crash. I haven't yet isolated that either.

[Mark S. Miller]

Created attachment 98621 [details]
Demonstrates the ability to catch the TypeError in an outer catch

The attached file demonstrates the ability to catch the TypeError in an outer catch. Look for "has(". This file also contains other diagnostics you may find useful.

[Mark S. Miller]

(function(){"use strict";}).hasOwnProperty('caller')
TypeError: Cannot access caller property of a strict mode function

The problem also occurs for other operations besides 'in'. Again, as with 'in', the poisoning of 'caller' should not prevent hasOwnProperty from working as specified. hasOwnProperty must not attempt to access the property's value.

[Gavin Barraclough]

Created attachment 111364 [details]
The patch

[Sam Weinig]

Comment on attachment 111364 [details]
The patch

View in context: https://bugs.webkit.org/attachment.cgi?id=111364&action=review

> Source/JavaScriptCore/ChangeLog:3
> +        Poisoning of strict caller,arguments inappropriately poisoning "in"

The comma here is off.

[Gavin Barraclough]

Fixed in r97709.

The problem with the exception not being caught was specific to this case of an exception being thrown (we weren't checking for an exception in a case where one never should be thrown), so with the bug fixed there should be no related problem left, but I've added an ASSERT to JIT Stubs that guards against this.

[Ryosuke Niwa]

It appears that a bunch of tests started failing after this patch:
http://build.webkit.org/results/SnowLeopard%20Intel%20Release%20(Tests)/r97710%20(33977)/results.html

Also, the change long entry was inserted at wrong place.

[Gavin Barraclough]

> Also, the change long entry was inserted at wrong place.
Sorry, svn up keeps doing this to me, I don't always catch it. :-(

Rolled out in r97719, reopened.

[Ryosuke Niwa]

(In reply to comment #8)
> > Also, the change long entry was inserted at wrong place.
> Sorry, svn up keeps doing this to me, I don't always catch it. :-(

FYI, webkit-patch land should warn you about this.

[Gavin Barraclough]

Created attachment 111677 [details]
experimenting with an alternative way to fix the problem.

[Gavin Barraclough]

Created attachment 111698 [details]
Fix

[Gavin Barraclough]

Resolved in r97905.

[Gavin Barraclough]

*** Bug 56492 has been marked as a duplicate of this bug. ***