Changeset 205522 in webkit

Timestamp:

Sep 6, 2016 4:51:24 PM (8 years ago)

Author:

sbarati@apple.com

Message:

Member call on NULL pointer in JavaScriptCore/dfg/DFGAbstractInterpretterInlines.h
​https://bugs.webkit.org/show_bug.cgi?id=160870

Reviewed by Darin Adler.

Credit goes to Jonathan Bedard for finding this bug using the undefined
behavior sanitizer.

The rule for MaterializeNewObject inside AI was assuming that the graph
is in SSA form. This used to be true when MaterializeNewObject was only
inserted by the allocation sinking phase. However, Filip added more uses
of MaterializeNewObject in his RegExp constant folding patch. This fixes
the bug by using the structure set inside the Node's OpInfo rather than
generating it from m_phiChildren inside AI.

• dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• dfg/DFGAbstractInterpreterInlines.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-09-06  Saam Barati  <sbarati@apple.com>
+
+        Member call on NULL pointer in JavaScriptCore/dfg/DFGAbstractInterpretterInlines.h
+        https://bugs.webkit.org/show_bug.cgi?id=160870
+
+        Reviewed by Darin Adler.
+
+        Credit goes to Jonathan Bedard for finding this bug using the undefined
+        behavior sanitizer.
+
+        The rule for MaterializeNewObject inside AI was assuming that the graph
+        is in SSA form. This used to be true when MaterializeNewObject was only
+        inserted by the allocation sinking phase. However, Filip added more uses
+        of MaterializeNewObject in his RegExp constant folding patch. This fixes
+        the bug by using the structure set inside the Node's OpInfo rather than
+        generating it from m_phiChildren inside AI.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+
 2016-09-06  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

@@ -1966 +1966 @@
         
     case MaterializeNewObject: {
-        StructureSet set;
-        
-        m_phiChildren->forAllTransitiveIncomingValues(
-            m_graph.varArgChild(node, 0).node(),
-            [&] (Node* incoming) {
-                set.add(incoming->castConstant<Structure*>());
-            });
-        
-        forNode(node).set(m_graph, set);
+        forNode(node).set(m_graph, node->structureSet());
         break;
     }