Skip to content

Commit 134e541

Browse files
ajkleinajklein
committed
Version 4.5.103.34 (cherry-pick)
Merged 21bd456 Disallow Object.observe calls on access-checked objects BUG=chromium:531891 LOG=N [email protected] Review URL: https://codereview.chromium.org/1352023002 . Cr-Commit-Position: refs/branch-heads/4.5@{#37} Cr-Branched-From: 7f21153-refs/heads/4.5.103@{#1} Cr-Branched-From: 4b38c15-refs/heads/master@{#29527}
1 parent 95d2e7c commit 134e541

6 files changed

Lines changed: 52 additions & 2 deletions

File tree

‎include/v8-version.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
#define V8_MAJOR_VERSION 4
1212
#define V8_MINOR_VERSION 5
1313
#define V8_BUILD_NUMBER 103
14-
#define V8_PATCH_LEVEL 33
14+
#define V8_PATCH_LEVEL 34
1515

1616
// Use 1 for candidates and 0 otherwise.
1717
// (Boolean macro values are not supported by all preprocessors.)

‎src/messages.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ class CallSite {
173173
T(ObserveCallbackFrozen, \
174174
"Object.observe cannot deliver to a frozen function object") \
175175
T(ObserveGlobalProxy, "% cannot be called on the global proxy object") \
176+
T(ObserveAccessChecked, "% cannot be called on access-checked objects") \
176177
T(ObserveInvalidAccept, \
177178
"Third argument to Object.observe must be an array of strings.") \
178179
T(ObserveNonFunction, "Object.% cannot deliver to non-function") \

‎src/object-observe.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -389,6 +389,8 @@ function ObjectObserve(object, callback, acceptList) {
389389
throw MakeTypeError(kObserveNonObject, "observe", "observe");
390390
if (%IsJSGlobalProxy(object))
391391
throw MakeTypeError(kObserveGlobalProxy, "observe");
392+
if (%IsAccessCheckNeeded(object))
393+
throw MakeTypeError(kObserveAccessChecked, "observe");
392394
if (!IS_SPEC_FUNCTION(callback))
393395
throw MakeTypeError(kObserveNonFunction, "observe");
394396
if (ObjectIsFrozen(callback))
@@ -617,6 +619,8 @@ function ObjectGetNotifier(object) {
617619
throw MakeTypeError(kObserveNonObject, "getNotifier", "getNotifier");
618620
if (%IsJSGlobalProxy(object))
619621
throw MakeTypeError(kObserveGlobalProxy, "getNotifier");
622+
if (%IsAccessCheckNeeded(object))
623+
throw MakeTypeError(kObserveAccessChecked, "getNotifier");
620624

621625
if (ObjectIsFrozen(object)) return null;
622626

‎src/runtime/runtime-object.cc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1435,5 +1435,13 @@ RUNTIME_FUNCTION(Runtime_DefineSetterPropertyUnchecked) {
14351435
setter, attrs));
14361436
return isolate->heap()->undefined_value();
14371437
}
1438+
1439+
1440+
RUNTIME_FUNCTION(Runtime_IsAccessCheckNeeded) {
1441+
SealHandleScope shs(isolate);
1442+
DCHECK_EQ(1, args.length());
1443+
CONVERT_ARG_CHECKED(Object, object, 0);
1444+
return isolate->heap()->ToBoolean(object->IsAccessCheckNeeded());
1445+
}
14381446
} // namespace internal
14391447
} // namespace v8

‎src/runtime/runtime.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -483,7 +483,8 @@ namespace internal {
483483
F(IsStrong, 1, 1) \
484484
F(ClassOf, 1, 1) \
485485
F(DefineGetterPropertyUnchecked, 4, 1) \
486-
F(DefineSetterPropertyUnchecked, 4, 1)
486+
F(DefineSetterPropertyUnchecked, 4, 1) \
487+
F(IsAccessCheckNeeded, 1, 1)
487488

488489

489490
#define FOR_EACH_INTRINSIC_OBSERVE(F) \

‎test/cctest/test-object-observe.cc‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -885,3 +885,39 @@ TEST(UseCountObjectGetNotifier) {
885885
CompileRun("Object.getNotifier(obj)");
886886
CHECK_EQ(1, use_counts[v8::Isolate::kObjectObserve]);
887887
}
888+
889+
890+
static bool NamedAccessCheckAlwaysAllow(Local<v8::Object> global,
891+
Local<v8::Value> name,
892+
v8::AccessType type,
893+
Local<Value> data) {
894+
return true;
895+
}
896+
897+
898+
TEST(DisallowObserveAccessCheckedObject) {
899+
v8::Isolate* isolate = CcTest::isolate();
900+
v8::HandleScope scope(isolate);
901+
LocalContext env;
902+
v8::Local<v8::ObjectTemplate> object_template =
903+
v8::ObjectTemplate::New(isolate);
904+
object_template->SetAccessCheckCallbacks(NamedAccessCheckAlwaysAllow, NULL);
905+
env->Global()->Set(v8_str("obj"), object_template->NewInstance());
906+
v8::TryCatch try_catch(isolate);
907+
CompileRun("Object.observe(obj, function(){})");
908+
CHECK(try_catch.HasCaught());
909+
}
910+
911+
912+
TEST(DisallowGetNotifierAccessCheckedObject) {
913+
v8::Isolate* isolate = CcTest::isolate();
914+
v8::HandleScope scope(isolate);
915+
LocalContext env;
916+
v8::Local<v8::ObjectTemplate> object_template =
917+
v8::ObjectTemplate::New(isolate);
918+
object_template->SetAccessCheckCallbacks(NamedAccessCheckAlwaysAllow, NULL);
919+
env->Global()->Set(v8_str("obj"), object_template->NewInstance());
920+
v8::TryCatch try_catch(isolate);
921+
CompileRun("Object.getNotifier(obj)");
922+
CHECK(try_catch.HasCaught());
923+
}

0 commit comments

Comments
 (0)