Strict Equality not working properly with tainted values

[alexbara2000]

I ran into a script that did a strict equality check with a tainted value and it was failing. I reproduced the bug and this is the JS code that I use. KeyCode is marked as a taint source.

document.addEventListener('keyup', keyHandler2);
function keyHandler2(e) {
    const {keyCode} = e;
    var arr = new Array(90);
    arr[45]=0;
    arr[58]=0;
    arr[65]=1;
    arr[66]=0;
    arr[75]=0;

    var value=arr[keyCode];
    if (value === 1){
        console.log("IT WORKS");
    }
    else{
        console.log("IT doesn't work :(");
    }
}

KeyCode number 65 is the character 'a' in lowercase. So the normal flow of execution would be that when 'a' is pressed the script will output to the console "IT WORKS". This is the case for the first 11 times this code gets executed but fails afterwards. So if you press 20 times on the letter 'a', you will see in the console "IT WORKS" 11 times and "IT doesn't work :(" 9 times.

I tracked down the code and noticed that the first 10 times the 'a' is pressed, the code is executed from the class Interpreter.cpp. The eleventh time, the code is executed from the class BaselineIC.cpp from the method DoCompareFallback. After that, I don't know from where the code gets executed. I assume something is being cached.

[tmbrbr]

Can I double check, this is presumably for the primitaint branch?

[alexbara2000]

Yes this is for the primitaint-merge branch. I tested it using a website I created for testing purposes, not unit tests

[leeN]

Good catch!
We saw a bunch of diverging behavior when tainting was enabled for the WASM use case. This issue looks like it might be the root cause.

[alexbara2000]

It is a very weird behaviour to say the least. When ION and JIT are fully disabled in the Firefox settings, they are still actually being used. The inline caches still get created and still get used for optimization reasons. The taint gets lost when the strict equality gets used from the inline caches. I found that not allowing the code to create inline caches was the only way to ensure all the code gets interpreted and the taint propagates properly. However, there is a big slowdown when using this approach which is something to consider.