Unsoundness: `JSValue` (and others) can outlive the `Context`
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript, rust
- Domain
- tooling
Research direction
Start with the Rust reproduction in the issue and trace the definitions of JSContext, JSValue, JSObject, and evaluate_script. Confirm the use-after-free after the Context scope ends, then determine and document a lifetime-safe ownership approach. Done means the reproduction cannot access values after their Context is dropped and the relevant safety behavior is covered by a test.
Written by the indexing model from the issue text.
Description
Hi,
JSValue, JSObject and others are not restricted in the lifetime, therefore are able to outlive the Context, in the best case just crashing the program and in the worst case causing a use-after-free.
The following script reproduces the problem and leads to a segfault (due to an safety check in jsc itself):
use javascriptcore::*;
fn main() {
let v;
{
let ctx = JSContext::default();
v = evaluate_script(&ctx, "'Hello' + ' ' + 'World'", None, "test.js", 1)
.expect("Failed to evaluate script");
println!("Value: {:?}", v.as_string());
}
println!("Value: {:?}", v.as_string());
}
Typically, you would add PhantomData to add a phantom lifetime. However, you already hold a raw pointer to the context in these structs and the context should be a widespread object in many real-world users of your bindings, ref-counting the context in Rust with Arc might be the best option.
Kind Regards
Tim
- Dominant language
- Rust
- Stars
- 54
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from endoli/javascriptcore.rs
-
Difficulty 3/5 1-2 days Newbie friendliness 25/100
-
Difficulty 5/5 Over a week Newbie friendliness 15/100
-
Difficulty 4/5 3-5 days Newbie friendliness 20/100
-
Windows support Open
Difficulty 5/5 Over a week Newbie friendliness 20/100
endoli/javascriptcore.rs#4 · 5 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
All issues in endoli/javascriptcore.rs
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
state:needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
zed-industries/zed#64680 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
RustPython/RustPython#8802 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
TheLarkInn/aipm#2390 ·