endoli / endoli/javascriptcore.rs
Unsoundness: `JSValue` (and others) can outlive the `Context`
- Dominant language
- Rust
- Stars
- 54
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
`JSValue`, `JSObject` and others are not restricted in the lifetime, therefore are able to outlive the `Context`, in the best case just crashing the program and in the worst case causing a use-after-free.
The following script reproduces the problem and leads to a segfault (due to an safety check in jsc itself):
```rs
use javascriptcore::*;
fn main() {
let v;
{
let ctx = JSContext::default();
v = evaluate_script(&ctx, "'Hello' + ' ' + 'World'", None, "test.js", 1)
.expect("Failed to evaluate script");
println!("Value: {:?}", v.as_string());
}
println!("Value: {:?}", v.as_string());
}
```
Typically, you would add `PhantomData` to add a phantom lifetime. However, you already hold a raw pointer to the context in these structs and the context should be a widespread object in many real-world users of your bindings, ref-counting the context in Rust with `Arc` might be the best option.
Kind Regards
Tim
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.