Bug 39360 - JSObjectSetPrototype doesn't check for cycle in prototype chain.
Summary: JSObjectSetPrototype doesn't check for cycle in prototype chain.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Jędrzej Nowacki
URL:
Keywords:
Depends on:
Blocks: 39356
  Show dependency treegraph
 
Reported: 2010-05-19 07:53 PDT by Jędrzej Nowacki
Modified: 2010-05-28 23:16 PDT (History)
3 users (show)

See Also:


Attachments
Fix v1 (7.02 KB, patch)
2010-05-28 07:29 PDT, Jędrzej Nowacki
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jędrzej Nowacki 2010-05-19 07:53:33 PDT
JSObjectSetPrototype permits to set any object as prototype of any object. Lack of check if an object being added to a property chain is actually in it, could produce crashes and hangs.

A small snippet:
    JSObjectRef object = JSObjectMake(context, /* jsClass */ 0, /* data */ 0);
    JSObjectSetPrototype(context, object, object);
    JSObjectGetProperty(context, object, invalid_property_name, /* exception*/ 0);
The code should hang.

I suppose to see same behavior:
> a = new Object
[object Object]
> a.__proto__=a
Exception: Error: cyclic __proto__ value
>

The patch is on the way...
Comment 1 Jędrzej Nowacki 2010-05-28 07:29:00 PDT
Created attachment 57329 [details]
Fix v1
Comment 2 Geoffrey Garen 2010-05-28 10:06:02 PDT
Comment on attachment 57329 [details]
Fix v1

r=me

Nice.
Comment 3 WebKit Commit Bot 2010-05-28 23:16:35 PDT
Comment on attachment 57329 [details]
Fix v1

Clearing flags on attachment: 57329

Committed r60390: <http://trac.webkit.org/changeset/60390>
Comment 4 WebKit Commit Bot 2010-05-28 23:16:41 PDT
All reviewed patches have been landed.  Closing bug.