Status: New Owner: [EMAIL PROTECTED] CC: [EMAIL PROTECTED] Labels: Type-Bug Priority-Medium
New issue 174 by [EMAIL PROTECTED]: Uninitialized accessing of PropertyAttributes in ic. http://code.google.com/p/v8/issues/detail?id=174 We have code that looks something like: if (lookup.type() == INTERCEPTOR) { // Get the property. PropertyAttributes attr; result = object->GetProperty(*name, &attr); if (result->IsFailure()) return result; // If the object does not have the requested property, check which // exception we need to throw. if (attr == ABSENT) { if (is_contextual()) { return ReferenceError("not_defined", name); } return TypeError("undefined_method", object, name); } It seems that for the case of cross-domain security checks, GetProperty can return a non failure without assigning to attr. For example, in: Object* Object::GetProperty(Object* receiver, LookupResult* result, String* name, PropertyAttributes* attributes) { When walking the prototype and deciding an access check is needed, when can return via GetPropertyWithFailedAccessCheck without having touched attributes. Breaking on objects.cc:403 (the return case for failed access check), #0 v8::internal::Object::GetProperty (this=0xf4c07be1, receiver=0xf4c07be1, result=0xffffb818, name=0xf4d52b69, attributes=0xffffb918) at v8/src/objects.cc:405 (gdb) print *attributes $2 = 4100555492 Following it down a few frames, we can see we end up with an uninitialized attr variable in the ABSENT check: if (attr == ABSENT) { #0 v8::internal::CallIC::LoadFunction (this=0xffffb968, state=v8::internal::UNINITIALIZED, object={location_ = 0xffffb9c0}, name= {location_ = 0xffffb9bc}) at v8/src/ic.cc:328 (gdb) print attr $8 = 4100555492 It should also be easy to reproduce this by adding a DCHECK(attr <= ABSENT) before all of the uses of ABSENT in ic.cc, and chances are the uninitialized stack data should not be within the valid range of a PropertyAttributes. A layout test that should reproduce this easily is: LayoutTests/http/tests/messaging/cross-domain-message-send.html -- You received this message because you are listed in the owner or CC fields of this issue, or because you starred this issue. You may adjust your issue notification preferences at: http://code.google.com/hosting/settings --~--~---------~--~----~------------~-------~--~----~ v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev -~----------~----~----~----~------~----~------~--~---
