VULHUB ™

When creating an object in Javascript, its |Structure| is created with the constructor's prototype's |VM|. Here's some snippets of that routine. ``` Structure* InternalFunction::createSubclassStructure(ExecState* exec, JSValue newTarget, Structure* baseClass) { ... if (newTarget && newTarget != exec->jsCallee()) { // newTarget may be an InternalFunction if we were called from Reflect.construct. JSFunction* targetFunction = jsDynamicCast<JSFunction*>(newTarget); if (LIKELY(targetFunction)) { ... return targetFunction->rareData(vm)->createInternalFunctionAllocationStructureFromBase(vm, prototype, baseClass); ... } else { ... return vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(prototype, baseClass); ... } } return baseClass; } inline Structure* PrototypeMap::createEmptyStructure(JSObject* prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity) { ... Structure* structure = Structure::create(...

When creating an object in Javascript, its |Structure| is created with the constructor's prototype's |VM|. Here's some snippets of that routine. ``` Structure* InternalFunction::createSubclassStructure(ExecState* exec, JSValue newTarget, Structure* baseClass) { ... if (newTarget && newTarget != exec->jsCallee()) { // newTarget may be an InternalFunction if we were called from Reflect.construct. JSFunction* targetFunction = jsDynamicCast<JSFunction*>(newTarget); if (LIKELY(targetFunction)) { ... return targetFunction->rareData(vm)->createInternalFunctionAllocationStructureFromBase(vm, prototype, baseClass); ... } else { ... return vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(prototype, baseClass); ... } } return baseClass; } inline Structure* PrototypeMap::createEmptyStructure(JSObject* prototype, const TypeInfo& typeInfo, const ClassInfo* classInfo, IndexingType indexingType, unsigned inlineCapacity) { ... Structure* structure = Structure::create( prototype->globalObject()->vm(), prototype->globalObject(), prototype, typeInfo, classInfo, indexingType, inlineCapacity); m_structures.set(key, Weak<Structure>(structure)); ... } ``` As we can see |Structure::create| is called with prototype's |vm| and |globalObject| as arguments. So it could lead to an UXSS condition. Tested on Safari 10.0.2(12602.3.12.0.1) and Webkit Nightly 10.0.2(12602.3.12.0.1, [r210800](https://crrev.com/210800)).