Template objects loaded from qjsc bytecode are not frozen
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 68/100
Research direction
Start in quickjs.c at JS_ReadArray() and inspect the BC_TAG_TEMPLATE_OBJECT handling alongside seal_template_obj(). The reproduction compares parser execution with qjsc bytecode execution; run it both ways and confirm both report frozen template and raw objects after the change. Add a bytecode round-trip regression test, since the issue says make test has no coverage for this case.
Written by the indexing model from the issue text.
Description
Environment
- QuickJS master 712e8c0 (2026-11-02) and release 2026-06-04,
make, Debian 12 x86-64, gcc 12.2 - Reference: node v26.13.0, and
./qjsrunning the same source - Checked on 2026-11-03
Reproduction
function site() { return (s => s)`same`; }
var t = site();
console.log(String([site() === t, Object.isFrozen(t), Object.isFrozen(t.raw)]));
./qjs x.js:true,true,true(same as node)./qjsc -o x x.js && ./x:true,false,false
Expected (spec)
GetTemplateObject: SetIntegrityLevel(rawObj, frozen) and
SetIntegrityLevel(template, frozen).
Cause and patch
JS_ReadArray() handles BC_TAG_TEMPLATE_OBJECT with JS_PreventExtensions(ctx, obj) only. The parser's
seal_template_obj() also makes length read-only.
diff --git a/quickjs.c b/quickjs.c
--- a/quickjs.c
+++ b/quickjs.c
@@ -40288,7 +40288,10 @@ static JSValue JS_ReadArray(BCReaderState *s, int tag)
if (ret < 0)
goto fail;
}
- JS_PreventExtensions(ctx, obj);
+ /* same state as a template object created by the parser:
+ non-extensible and 'length' non-writable (frozen) */
+ if (seal_template_obj(ctx, obj))
+ goto fail;
}
return obj;
fail:
With the patch, the qjsc-compiled reproduction prints true,true,true and make test passes. make test has no
bytecode round trip, so there is no regression test for this; I checked the qjsc case by hand.
Related
- quickjs-ng has the same code: quickjs-ng/quickjs#1888
- Dominant language
- C
- Stars
- 11.1k
- Forks
- 1.2k
- Avg merge
- 11h 20m
- Merged PRs (30d)
- 1
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from bellard/quickjs
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 2 days
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
Maintainers usually reply within 2 days
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
Maintainers usually reply within 2 days
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Maintainers usually reply within 2 days
Similar issues
-
area/docs
Difficulty 1/5 Under an hour Newbie friendliness 83/100
Clodmony/starship-coop#72 ·
Maintainers usually reply within 1 day
-
ospf6d: heap-use-after-free in seqnumber_mismatch()/bad_lsreq() when a neighbor is deleted with events pendingPossibly taken @lichenlang89 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 61/100
Maintainers usually reply within 2 days
-
5700模组网络优先级问题Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
luainkernel/lunatik#2372 ·
Maintainers usually reply within 1 day