Skip to content

Commit 78d0117

Browse files
apple-opensourceapple-opensource
committed
7601.2.3
1 parent 76d1931 commit 78d0117

File tree

11 files changed

+118
-18
lines changed

11 files changed

+118
-18
lines changed

‎ChangeLog‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,70 @@
1+
2015-09-03 Babak Shafiei <bshafiei@apple.com>
2+
3+
Merge r189046.
4+
5+
2015-08-27 Basile Clement <basile_clement@apple.com>
6+
7+
REGRESSION(r184779): Possible read-after-free in JavaScriptCore/dfg/DFGClobberize.h
8+
https://bugs.webkit.org/show_bug.cgi?id=148411
9+
10+
Reviewed by Geoffrey Garen and Filip Pizlo.
11+
12+
* dfg/DFGClobberize.h:
13+
(JSC::DFG::clobberize):
14+
15+
2015-09-03 Babak Shafiei <bshafiei@apple.com>
16+
17+
Merge r188311.
18+
19+
2015-08-11 Alexey Proskuryakov <ap@apple.com>
20+
21+
Make ASan build not depend on asan.xcconfig
22+
https://bugs.webkit.org/show_bug.cgi?id=147840
23+
rdar://problem/21093702
24+
25+
Reviewed by Daniel Bates.
26+
27+
* dfg/DFGOSREntry.cpp:
28+
(JSC::DFG::OSREntryData::dump):
29+
(JSC::DFG::prepareOSREntry):
30+
* ftl/FTLOSREntry.cpp:
31+
(JSC::FTL::prepareOSREntry):
32+
* heap/ConservativeRoots.cpp:
33+
(JSC::ConservativeRoots::genericAddPointer):
34+
(JSC::ConservativeRoots::genericAddSpan):
35+
* heap/MachineStackMarker.cpp:
36+
(JSC::MachineThreads::removeThreadIfFound):
37+
(JSC::MachineThreads::gatherFromCurrentThread):
38+
(JSC::MachineThreads::Thread::captureStack):
39+
(JSC::copyMemory):
40+
* interpreter/Register.h:
41+
(JSC::Register::operator=):
42+
(JSC::Register::asanUnsafeJSValue):
43+
(JSC::Register::jsValue):
44+
45+
2015-09-03 Babak Shafiei <bshafiei@apple.com>
46+
47+
Merge r188067.
48+
49+
2015-08-06 Filip Pizlo <fpizlo@apple.com>
50+
51+
Structures used for tryGetConstantProperty() should be registered first
52+
https://bugs.webkit.org/show_bug.cgi?id=147750
53+
54+
Reviewed by Saam Barati and Michael Saboff.
55+
56+
* dfg/DFGGraph.cpp:
57+
(JSC::DFG::Graph::tryGetConstantProperty): Add an assertion to that effect. This should catch the bug sooner.
58+
* dfg/DFGGraph.h:
59+
(JSC::DFG::Graph::addStructureSet): Register structures when we make a structure set. That ensures that we won't call tryGetConstantProperty() on a structure that hasn't been registered yet.
60+
* dfg/DFGStructureRegistrationPhase.cpp:
61+
(JSC::DFG::StructureRegistrationPhase::run): Don't register structure sets here anymore. Registering them before we get here means there is no chance of the code being DCE'd before the structures get registered. It also enables the tryGetConstantProperty() assertion, since that code runs before StructureRegisterationPhase.
62+
(JSC::DFG::StructureRegistrationPhase::registerStructures):
63+
(JSC::DFG::StructureRegistrationPhase::registerStructure):
64+
(JSC::DFG::StructureRegistrationPhase::assertAreRegistered):
65+
(JSC::DFG::StructureRegistrationPhase::assertIsRegistered):
66+
(JSC::DFG::performStructureRegistration):
67+
168
2015-08-27 Matthew Hanson <matthew_hanson@apple.com>
269

370
Merge r189012. rdar://problem/22084478

‎Configurations/Version.xcconfig‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@
2222
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2323

2424
MAJOR_VERSION = 601;
25-
MINOR_VERSION = 1;
26-
TINY_VERSION = 56;
25+
MINOR_VERSION = 2;
26+
TINY_VERSION = 3;
2727
MICRO_VERSION = 0;
2828
NANO_VERSION = 0;
2929
FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION);

‎dfg/DFGClobberize.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -888,6 +888,7 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
888888
if (operandIdx >= numElements)
889889
continue;
890890
Edge use = graph.m_varArgChildren[node->firstChild() + operandIdx];
891+
// operandIdx comes from graph.m_uint32ValuesInUse and thus is guaranteed to be already frozen
891892
def(HeapLocation(IndexedPropertyLoc, heap, node, LazyNode(graph.freeze(jsNumber(operandIdx)))),
892893
LazyNode(use.node()));
893894
}
@@ -930,9 +931,13 @@ void clobberize(Graph& graph, Node* node, const ReadFunctor& read, const WriteFu
930931
LazyNode(graph.freeze(data[index]), op));
931932
}
932933
} else {
934+
Vector<uint32_t> possibleIndices;
933935
for (uint32_t index : graph.m_uint32ValuesInUse) {
934936
if (index >= numElements)
935937
continue;
938+
possibleIndices.append(index);
939+
}
940+
for (uint32_t index : possibleIndices) {
936941
def(HeapLocation(IndexedPropertyLoc, heap, node, LazyNode(graph.freeze(jsNumber(index)))),
937942
LazyNode(graph.freeze(data[index]), op));
938943
}

‎dfg/DFGGraph.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -976,6 +976,8 @@ JSValue Graph::tryGetConstantProperty(
976976

977977
for (unsigned i = structureSet.size(); i--;) {
978978
Structure* structure = structureSet[i];
979+
assertIsRegistered(structure);
980+
979981
WatchpointSet* set = structure->propertyReplacementWatchpointSet(offset);
980982
if (!set || !set->isStillValid())
981983
return JSValue();

‎dfg/DFGGraph.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -326,6 +326,8 @@ class Graph : public virtual Scannable {
326326
StructureSet* addStructureSet(const StructureSet& structureSet)
327327
{
328328
ASSERT(structureSet.size());
329+
for (Structure* structure : structureSet)
330+
registerStructure(structure);
329331
m_structureSet.append(structureSet);
330332
return &m_structureSet.last();
331333
}

‎dfg/DFGOSREntry.cpp‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ void OSREntryData::dump(PrintStream& out) const
9090
dumpInContext(out, nullptr);
9191
}
9292

93+
SUPPRESS_ASAN
9394
void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIndex)
9495
{
9596
ASSERT(JITCode::isOptimizingJIT(codeBlock->jitType()));
@@ -202,33 +203,33 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
202203
for (size_t local = 0; local < entry->m_expectedValues.numberOfLocals(); ++local) {
203204
int localOffset = virtualRegisterForLocal(local).offset();
204205
if (entry->m_localsForcedDouble.get(local)) {
205-
if (!exec->registers()[localOffset].jsValue().isNumber()) {
206+
if (!exec->registers()[localOffset].asanUnsafeJSValue().isNumber()) {
206207
if (Options::verboseOSR()) {
207208
dataLog(
208209
" OSR failed because variable ", localOffset, " is ",
209-
exec->registers()[localOffset].jsValue(), ", expected number.\n");
210+
exec->registers()[localOffset].asanUnsafeJSValue(), ", expected number.\n");
210211
}
211212
return 0;
212213
}
213214
continue;
214215
}
215216
if (entry->m_localsForcedMachineInt.get(local)) {
216-
if (!exec->registers()[localOffset].jsValue().isMachineInt()) {
217+
if (!exec->registers()[localOffset].asanUnsafeJSValue().isMachineInt()) {
217218
if (Options::verboseOSR()) {
218219
dataLog(
219220
" OSR failed because variable ", localOffset, " is ",
220-
exec->registers()[localOffset].jsValue(), ", expected ",
221+
exec->registers()[localOffset].asanUnsafeJSValue(), ", expected ",
221222
"machine int.\n");
222223
}
223224
return 0;
224225
}
225226
continue;
226227
}
227-
if (!entry->m_expectedValues.local(local).validate(exec->registers()[localOffset].jsValue())) {
228+
if (!entry->m_expectedValues.local(local).validate(exec->registers()[localOffset].asanUnsafeJSValue())) {
228229
if (Options::verboseOSR()) {
229230
dataLog(
230231
" OSR failed because variable ", localOffset, " is ",
231-
exec->registers()[localOffset].jsValue(), ", expected ",
232+
exec->registers()[localOffset].asanUnsafeJSValue(), ", expected ",
232233
entry->m_expectedValues.local(local), ".\n");
233234
}
234235
return 0;
@@ -280,23 +281,23 @@ void* prepareOSREntry(ExecState* exec, CodeBlock* codeBlock, unsigned bytecodeIn
280281

281282
if (reg.isLocal()) {
282283
if (entry->m_localsForcedDouble.get(reg.toLocal())) {
283-
*bitwise_cast<double*>(pivot + index) = exec->registers()[reg.offset()].jsValue().asNumber();
284+
*bitwise_cast<double*>(pivot + index) = exec->registers()[reg.offset()].asanUnsafeJSValue().asNumber();
284285
continue;
285286
}
286287

287288
if (entry->m_localsForcedMachineInt.get(reg.toLocal())) {
288-
*bitwise_cast<int64_t*>(pivot + index) = exec->registers()[reg.offset()].jsValue().asMachineInt() << JSValue::int52ShiftAmount;
289+
*bitwise_cast<int64_t*>(pivot + index) = exec->registers()[reg.offset()].asanUnsafeJSValue().asMachineInt() << JSValue::int52ShiftAmount;
289290
continue;
290291
}
291292
}
292293

293-
pivot[index] = exec->registers()[reg.offset()].jsValue();
294+
pivot[index] = exec->registers()[reg.offset()].asanUnsafeJSValue();
294295
}
295296

296297
// 4) Reshuffle those registers that need reshuffling.
297298
Vector<JSValue> temporaryLocals(entry->m_reshufflings.size());
298299
for (unsigned i = entry->m_reshufflings.size(); i--;)
299-
temporaryLocals[i] = pivot[VirtualRegister(entry->m_reshufflings[i].fromOffset).toLocal()].jsValue();
300+
temporaryLocals[i] = pivot[VirtualRegister(entry->m_reshufflings[i].fromOffset).toLocal()].asanUnsafeJSValue();
300301
for (unsigned i = entry->m_reshufflings.size(); i--;)
301302
pivot[VirtualRegister(entry->m_reshufflings[i].toOffset).toLocal()] = temporaryLocals[i];
302303

‎dfg/DFGStructureRegistrationPhase.cpp‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ class StructureRegistrationPhase : public Phase {
5757
registerStructure(m_graph.m_vm.getterSetterStructure.get());
5858

5959
for (FrozenValue* value : m_graph.m_frozenValues)
60-
m_graph.assertIsRegistered(value->structure());
60+
assertIsRegistered(value->structure());
6161

6262
for (BlockIndex blockIndex = m_graph.numBlocks(); blockIndex--;) {
6363
BasicBlock* block = m_graph.block(blockIndex);
@@ -69,7 +69,7 @@ class StructureRegistrationPhase : public Phase {
6969

7070
switch (node->op()) {
7171
case CheckStructure:
72-
registerStructures(node->structureSet());
72+
assertAreRegistered(node->structureSet());
7373
break;
7474

7575
case NewObject:
@@ -152,15 +152,27 @@ class StructureRegistrationPhase : public Phase {
152152
private:
153153
void registerStructures(const StructureSet& set)
154154
{
155-
for (unsigned i = set.size(); i--;)
156-
registerStructure(set[i]);
155+
for (Structure* structure : set)
156+
registerStructure(structure);
157157
}
158158

159159
void registerStructure(Structure* structure)
160160
{
161161
if (structure)
162162
m_graph.registerStructure(structure);
163163
}
164+
165+
void assertAreRegistered(const StructureSet& set)
166+
{
167+
for (Structure* structure : set)
168+
assertIsRegistered(structure);
169+
}
170+
171+
void assertIsRegistered(Structure* structure)
172+
{
173+
if (structure)
174+
m_graph.assertIsRegistered(structure);
175+
}
164176
};
165177

166178
bool performStructureRegistration(Graph& graph)

‎ftl/FTLOSREntry.cpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838

3939
namespace JSC { namespace FTL {
4040

41+
SUPPRESS_ASAN
4142
void* prepareOSREntry(
4243
ExecState* exec, CodeBlock* dfgCodeBlock, CodeBlock* entryCodeBlock,
4344
unsigned bytecodeIndex, unsigned streamIndex)
@@ -71,7 +72,7 @@ void* prepareOSREntry(
7172
dataLog(" Values at entry: ", values, "\n");
7273

7374
for (int argument = values.numberOfArguments(); argument--;) {
74-
JSValue valueOnStack = exec->r(virtualRegisterForArgument(argument).offset()).jsValue();
75+
JSValue valueOnStack = exec->r(virtualRegisterForArgument(argument).offset()).asanUnsafeJSValue();
7576
JSValue reconstructedValue = values.argument(argument);
7677
if (valueOnStack == reconstructedValue || !argument)
7778
continue;

‎heap/ConservativeRoots.cpp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ inline void ConservativeRoots::genericAddPointer(void* p, TinyBloomFilter filter
9292
}
9393

9494
template<typename MarkHook>
95+
SUPPRESS_ASAN
9596
void ConservativeRoots::genericAddSpan(void* begin, void* end, MarkHook& markHook)
9697
{
9798
if (begin > end) {

‎heap/MachineStackMarker.cpp‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -335,7 +335,8 @@ void MachineThreads::removeThreadIfFound(PlatformThread platformThread)
335335
delete t;
336336
}
337337
}
338-
338+
339+
SUPPRESS_ASAN
339340
void MachineThreads::gatherFromCurrentThread(ConservativeRoots& conservativeRoots, JITStubRoutineSet& jitStubRoutines, CodeBlockSet& codeBlocks, void* stackOrigin, void* stackTop, RegisterState& calleeSavedRegisters)
340341
{
341342
void* registersBegin = &calleeSavedRegisters;
@@ -519,6 +520,7 @@ std::pair<void*, size_t> MachineThreads::Thread::captureStack(void* stackTop)
519520
return std::make_pair(begin, static_cast<char*>(end) - static_cast<char*>(begin));
520521
}
521522

523+
SUPPRESS_ASAN
522524
static void copyMemory(void* dst, const void* src, size_t size)
523525
{
524526
size_t dstAsSize = reinterpret_cast<size_t>(dst);

0 commit comments

Comments
 (0)