Repository navigation
fix(ses): tolerate frozen null arguments/caller pills on API functions - #3376
Merged
Merged
Conversation
Chromium's V8 through at least 133 (the Android System WebView on the
API 36 emulator image) gives every Web IDL function own, non-writable,
non-configurable `arguments: null` and `caller: null` properties.
lockdown() tried to delete them during permit removal, could not, and
threw SES_UNCAUGHT_EXCEPTION, so SES could not initialize there at all.
Desktop Chromium 148 has no such properties.
cauterizeProperty now tolerates exactly that shape with a warning
("Tolerating undeletable <path> === null"), as it already tolerates an
undeletable `prototype` that can be set to undefined. A frozen null is
inert: it cannot be changed and leaks nothing. Any other value, or a
writable pill, still fails lockdown. (A configurable pill never reaches
this path: it is simply deleted.)
Evidence: on the API 36 x86_64 emulator, lockdown() in the WebView
completes with this change and an Endo app built on it starts and talks
CapTP to a local daemon.
Tests: frozen-null-pill-warnings(-node).test.js plant such pills on a
replacement Array.isArray and check that lockdown succeeds and warns for
frozen null, and still fails for a frozen non-null value and for a
writable null.
🦋 Changeset detectedLatest commit: d3e86a0 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
gibson042
approved these changes
Oct 15, 2026
Co-authored-by: Richard Gibson <richard.gibson@gmail.com>
kriskowal
enabled auto-merge (squash)
October 29, 2026 03:52
This was referenced Oct 29, 2026
kriscendobot
added a commit
to endojs/endo-but-for-bots
that referenced
this pull request
Oct 29, 2026
…dec constructors endojs/endo#3376 (merged 2026-10-29) fixed endojs/endo#3369 by tolerating frozen null caller/arguments pills in cauterizeProperty. The encapsulation remedy (#1349, endojs/endo#3377) closed as superseded. Rebuild this revision on current llm: record the failure, the measured Chromium boundary, the adopted tolerance and its sloppy-function residual, and the rejected alternatives. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kriscendobot
added a commit
to endojs/endo-but-for-bots
that referenced
this pull request
Oct 29, 2026
…dec constructors endojs/endo#3376 (merged 2026-10-29) fixed endojs/endo#3369 by tolerating frozen null caller/arguments pills in cauterizeProperty. The encapsulation remedy (#1349, endojs/endo#3377) closed as superseded. Rebuild this revision on current llm: record the failure, the measured Chromium boundary, the adopted tolerance and its sloppy-function residual, and the rejected alternatives. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kriscendobot
added a commit
to endojs/endo-but-for-bots
that referenced
this pull request
Oct 30, 2026
Address panel findings on #1583: say that endojs/endo#3376 is on endojs/endo master but not yet on llm, source the Chromium version list, enumerate the involved PRs as superseded / still wanted / owned elsewhere, make the XS smoke follow-up depend on #1425, re-run the Phase 3 audit snapshot, keep the Phases 1-2 vocabulary, and shorten the index cells. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs: #3372
Description
Chromium's V8 through at least 133, as shipped in the Android System WebView, gives every Web IDL function own, frozen
arguments: nullandcaller: nullproperties.lockdown()could not delete them and threw, so SES could not initialize there.cauterizePropertynow tolerates exactly that shape with a warning, just as it already tolerates an undeletableprototype. Any other value, or a writable pill, still fails lockdown.This supersedes #3372, carrying the same fix by @danfinlay rebased onto current
master. #3372 also needed aconfigstore/nconfresolution workaround for hardened-mode installs;masternow carries an equivalent fix, so that commit is no longer part of this change.Security Considerations
A frozen
nullis inert: it cannot change and it leaks nothing. Every other undeletable shape still fails lockdown.Scaling Considerations
None.
Documentation Considerations
The
seschangeset describes the new tolerance.Testing Considerations
New tests plant pills on a replacement
Array.isArrayand check that a frozen null pill passes lockdown with a warning, while a frozen non-null pill and a writable null pill still fail. On the API 36 x86_64 emulator, lockdown completes in the WebView with this change.Compatibility Considerations
lockdown()now succeeds on more inputs. It still fails on every shape it failed on before, apart from the frozen null pill.Upgrade Considerations
None.