Changeset 230410 in webkit

Timestamp:

Apr 9, 2018 5:14:22 AM (6 years ago)

Author:

Carlos Garcia Campos

Message:

Merge r229850 - Race Condition in arrayProtoFuncReverse() causes wrong results or crash
​https://bugs.webkit.org/show_bug.cgi?id=183901

Reviewed by Keith Miller.

JSTests:

New test.

• stress/array-reverse-doesnt-clobber.js: Added.

(testArrayReverse):
(createArrayOfArrays):
(createArrayStorage):

Source/JavaScriptCore:

Added write barriers to ensure the reversed contents are properly marked.

• runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncReverse):

Location:

releases/WebKitGTK/webkit-2.20

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/array-reverse-doesnt-clobber.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ArrayPrototype.cpp (modified) (2 diffs)

releases/WebKitGTK/webkit-2.20/JSTests/ChangeLog

@@ +1 @@
+2018-03-22  Michael Saboff  <msaboff@apple.com>
+
+        Race Condition in arrayProtoFuncReverse() causes wrong results or crash
+        https://bugs.webkit.org/show_bug.cgi?id=183901
+
+        Reviewed by Keith Miller.
+
+        New test.
+
+        * stress/array-reverse-doesnt-clobber.js: Added.
+        (testArrayReverse):
+        (createArrayOfArrays):
+        (createArrayStorage):
+
 2018-03-01  Yusuke Suzuki  <utatane.tea@gmail.com>
 

releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-03-22  Michael Saboff  <msaboff@apple.com>
+
+        Race Condition in arrayProtoFuncReverse() causes wrong results or crash
+        https://bugs.webkit.org/show_bug.cgi?id=183901
+
+        Reviewed by Keith Miller.
+
+        Added write barriers to ensure the reversed contents are properly marked.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReverse):
+
 2018-03-05  Mark Lam  <mark.lam@apple.com>
 

releases/WebKitGTK/webkit-2.20/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -838 +838 @@
             break;
         std::reverse(data, data + length);
+        if (!hasInt32(thisObject->indexingType()))
+            vm.heap.writeBarrier(thisObject);
         return JSValue::encode(thisObject);
     }
@@ -858 +860 @@
         auto data = storage.vector().data();
         std::reverse(data, data + length);
+        vm.heap.writeBarrier(thisObject);
         return JSValue::encode(thisObject);
     }