Changeset 243925 in webkit


Ignore:
Timestamp:
Apr 4, 2019 9:17:44 PM (5 years ago)
Author:
ysuzuki@apple.com
Message:

[JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
​https://bugs.webkit.org/show_bug.cgi?id=196631

Reviewed by Saam Barati.

JSTests:

  • stress/make-bound-function-should-not-assume-int32-length.js: Added.

(assert):
(test):
(foo):

Source/JavaScriptCore:

makeBoundFunction assumes that "length" argument is always Int32. But this should not be done since this "length" value is calculated in builtin JS code.
DFG may store this value in Double format so that we should not rely on that this value is Int32. This patch fixes makeBoundFunction function to perform
toInt32 operation. We also insert a missing exception check for JSString::value(ExecState*) in makeBoundFunction.

  • JavaScriptCore.xcodeproj/project.pbxproj:
  • Sources.txt:
  • interpreter/CallFrameInlines.h:
  • runtime/DoublePredictionFuzzerAgent.cpp: Copied from Source/JavaScriptCore/interpreter/CallFrameInlines.h.

(JSC::DoublePredictionFuzzerAgent::DoublePredictionFuzzerAgent):
(JSC::DoublePredictionFuzzerAgent::getPrediction):

  • runtime/DoublePredictionFuzzerAgent.h: Copied from Source/JavaScriptCore/interpreter/CallFrameInlines.h.
  • runtime/JSGlobalObject.cpp:

(JSC::makeBoundFunction):

  • runtime/Options.h:
  • runtime/VM.cpp:

(JSC::VM::VM):

Location:
trunk
Files:
1 added
8 edited
2 copied

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r243920 r243925  
     12019-04-04  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
     4        https://bugs.webkit.org/show_bug.cgi?id=196631
     5
     6        Reviewed by Saam Barati.
     7
     8        * stress/make-bound-function-should-not-assume-int32-length.js: Added.
     9        (assert):
     10        (test):
     11        (foo):
     12
    1132019-04-04  Saam Barati  <sbarati@apple.com>
    214

  • trunk/Source/JavaScriptCore/ChangeLog

    r243918 r243925  
     12019-04-04  Yusuke Suzuki  <ysuzuki@apple.com>
     2
     3        [JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
     4        https://bugs.webkit.org/show_bug.cgi?id=196631
     5
     6        Reviewed by Saam Barati.
     7
     8        makeBoundFunction assumes that "length" argument is always Int32. But this should not be done since this "length" value is calculated in builtin JS code.
     9        DFG may store this value in Double format so that we should not rely on that this value is Int32. This patch fixes makeBoundFunction function to perform
     10        toInt32 operation. We also insert a missing exception check for `JSString::value(ExecState*)` in makeBoundFunction.
     11
     12        * JavaScriptCore.xcodeproj/project.pbxproj:
     13        * Sources.txt:
     14        * interpreter/CallFrameInlines.h:
     15        * runtime/DoublePredictionFuzzerAgent.cpp: Copied from Source/JavaScriptCore/interpreter/CallFrameInlines.h.
     16        (JSC::DoublePredictionFuzzerAgent::DoublePredictionFuzzerAgent):
     17        (JSC::DoublePredictionFuzzerAgent::getPrediction):
     18        * runtime/DoublePredictionFuzzerAgent.h: Copied from Source/JavaScriptCore/interpreter/CallFrameInlines.h.
     19        * runtime/JSGlobalObject.cpp:
     20        (JSC::makeBoundFunction):
     21        * runtime/Options.h:
     22        * runtime/VM.cpp:
     23        (JSC::VM::VM):
     24
    1252019-04-04  Robin Morisset  <rmorisset@apple.com>
    226

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r243886 r243925  
    47944794                E3F23A7D1ECF13E500978D99 /* SnippetReg.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SnippetReg.h; sourceTree = "<group>"; };
    47954795                E3F23A7E1ECF13E500978D99 /* SnippetSlowPathCalls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SnippetSlowPathCalls.h; sourceTree = "<group>"; };
     4796                E3FC25102256ECF400583518 /* DoublePredictionFuzzerAgent.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = DoublePredictionFuzzerAgent.cpp; sourceTree = "<group>"; };
     4797                E3FC25112256ECF400583518 /* DoublePredictionFuzzerAgent.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = DoublePredictionFuzzerAgent.h; sourceTree = "<group>"; };
    47964798                E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITGetterSetter.h; sourceTree = "<group>"; };
    47974799                E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCacheItem.h; sourceTree = "<group>"; };
    … …  
    67736775                                E31618111EC5FE080006A218 /* DOMAttributeGetterSetter.cpp */,
    67746776                                E31618121EC5FE080006A218 /* DOMAttributeGetterSetter.h */,
     6777                                E3FC25102256ECF400583518 /* DoublePredictionFuzzerAgent.cpp */,
     6778                                E3FC25112256ECF400583518 /* DoublePredictionFuzzerAgent.h */,
    67756779                                A70447EB17A0BD7000F5898E /* DumpContext.cpp */,
    67766780                                A70447EC17A0BD7000F5898E /* DumpContext.h */,
    … …  
    83068310                                AD4937C91DDD27340077C807 /* WebAssemblyFunction.cpp */,
    83078311                                AD4937CA1DDD27340077C807 /* WebAssemblyFunction.h */,
     8312                                521322431ECBCE8200F65615 /* WebAssemblyFunctionBase.cpp */,
     8313                                521322441ECBCE8200F65615 /* WebAssemblyFunctionBase.h */,
    83088314                                523FD88D225566C4003B3DCC /* WebAssemblyFunctionHeapCellType.cpp */,
    83098315                                523FD88C225566C3003B3DCC /* WebAssemblyFunctionHeapCellType.h */,
    8310                                 521322431ECBCE8200F65615 /* WebAssemblyFunctionBase.cpp */,
    8311                                 521322441ECBCE8200F65615 /* WebAssemblyFunctionBase.h */,
    83128316                                AD2FCBB41DB58DA400B3E736 /* WebAssemblyInstanceConstructor.cpp */,
    83138317                                AD2FCBB51DB58DA400B3E736 /* WebAssemblyInstanceConstructor.h */,
    … …  
    86128616                                0FEC85C11BE167A00080FF74 /* B3Effects.h in Headers */,
    86138617                                0F725CA81C503DED00AD943A /* B3EliminateCommonSubexpressions.h in Headers */,
     8618                                3395C70722555F6D00BDBFAD /* B3EliminateDeadCode.h in Headers */,
    86148619                                0F5BF1711F23A5A10029D91D /* B3EnsureLoopPreHeaders.h in Headers */,
    86158620                                0F6971EA1D92F42400BA02A5 /* B3FenceValue.h in Headers */,
    … …  
    86258630                                DC69B99D1D15F914002E3C00 /* B3InferSwitches.h in Headers */,
    86268631                                0FEC85BA1BE1462F0080FF74 /* B3InsertionSet.h in Headers */,
    8627                                 523FD88E225566C9003B3DCC /* WebAssemblyFunctionHeapCellType.h in Headers */,
    86288632                                0FEC85BB1BE1462F0080FF74 /* B3InsertionSetInlines.h in Headers */,
    86298633                                0FDF67D21D9C6D27001B9825 /* B3Kind.h in Headers */,
    … …  
    88188822                                0FBB73BB1DEF8645002C009E /* DeleteAllCodeEffort.h in Headers */,
    88198823                                0F96303C1D4192CD005609D9 /* DestructionMode.h in Headers */,
    8820                                 527CE35422555FE500C6F382 /* JSToWasmICCallee.h in Headers */,
    88218824                                A77A423E17A0BBFD00A8DB81 /* DFGAbstractHeap.h in Headers */,
    88228825                                A704D90317A0BAA8006BA554 /* DFGAbstractInterpreter.h in Headers */,
    … …  
    90929095                                0FCEFAAC1804C13E00472CE4 /* FTLSaveRestore.h in Headers */,
    90939096                                0F25F1B2181635F300522F39 /* FTLSlowPathCall.h in Headers */,
    9094                                 3395C70722555F6D00BDBFAD /* B3EliminateDeadCode.h in Headers */,
    90959097                                0F25F1B4181635F300522F39 /* FTLSlowPathCallKey.h in Headers */,
    90969098                                E322E5A71DA644A8006E7709 /* FTLSnippetParams.h in Headers */,
    … …  
    94619463                                70ECA6061AFDBEA200449739 /* JSTemplateObjectDescriptor.h in Headers */,
    94629464                                AD5C36EA1F75AD6A000BCAAF /* JSToWasm.h in Headers */,
     9465                                527CE35422555FE500C6F382 /* JSToWasmICCallee.h in Headers */,
    94639466                                BC18C42A0E16F5CD00B34460 /* JSType.h in Headers */,
    94649467                                53486BB71C1795C300F6F3AF /* JSTypedArray.h in Headers */,
    … …  
    99379940                                AD4937D41DDD27DE0077C807 /* WebAssemblyFunction.h in Headers */,
    99389941                                521322461ECBCE8200F65615 /* WebAssemblyFunctionBase.h in Headers */,
     9942                                523FD88E225566C9003B3DCC /* WebAssemblyFunctionHeapCellType.h in Headers */,
    99399943                                AD2FCBF11DB58DAD00B3E736 /* WebAssemblyInstanceConstructor.h in Headers */,
    99409944                                AD2FCC181DB59CB200B3E736 /* WebAssemblyInstanceConstructor.lut.h in Headers */,

  • trunk/Source/JavaScriptCore/Sources.txt

    r243886 r243925  
    746746runtime/DirectEvalExecutable.cpp
    747747runtime/DisallowVMReentry.cpp
     748runtime/DoublePredictionFuzzerAgent.cpp
    748749runtime/DumpContext.cpp
    749750runtime/ECMAScriptSpecInternalFunctions.cpp

  • trunk/Source/JavaScriptCore/interpreter/CallFrameInlines.h

    r235419 r243925  
    2727
    2828#include "CallFrame.h"
     29#include "JSCallee.h"
     30#include "JSGlobalObject.h"
    2931
    3032namespace JSC {

  • trunk/Source/JavaScriptCore/runtime/DoublePredictionFuzzerAgent.cpp

    r243924 r243925  
    11/*
    2  * Copyright (C) 2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2424 */
    2525
    26 #pragma once
    27 
    28 #include "CallFrame.h"
     26#include "config.h"
     27#include "DoublePredictionFuzzerAgent.h"
    2928
    3029namespace JSC {
    3130
    32 inline bool CallFrame::isStackOverflowFrame() const
     31DoublePredictionFuzzerAgent::DoublePredictionFuzzerAgent(VM&)
    3332{
    34     if (callee().isWasm())
    35         return false;
    36     return jsCallee() == jsCallee()->globalObject()->stackOverflowFrameCallee();
    3733}
    3834
    39 inline bool CallFrame::isWasmFrame() const
     35SpeculatedType DoublePredictionFuzzerAgent::getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType original)
    4036{
    41     return callee().isWasm();
     37    if (original && mergeSpeculations(original, SpecBytecodeNumber) == SpecBytecodeNumber)
     38        return SpecBytecodeDouble;
     39    return original;
    4240}
    4341

  • trunk/Source/JavaScriptCore/runtime/DoublePredictionFuzzerAgent.h

    r243924 r243925  
    11/*
    2  * Copyright (C) 2018 Apple Inc. All rights reserved.
     2 * Copyright (C) 2019 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    2626#pragma once
    2727
    28 #include "CallFrame.h"
     28#include "FuzzerAgent.h"
    2929
    3030namespace JSC {
    3131
    32 inline bool CallFrame::isStackOverflowFrame() const
    33 {
    34     if (callee().isWasm())
    35         return false;
    36     return jsCallee() == jsCallee()->globalObject()->stackOverflowFrameCallee();
    37 }
     32class VM;
    3833
    39 inline bool CallFrame::isWasmFrame() const
    40 {
    41     return callee().isWasm();
    42 }
     34class DoublePredictionFuzzerAgent final : public FuzzerAgent {
     35public:
     36    DoublePredictionFuzzerAgent(VM&);
     37
     38    SpeculatedType getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType) override;
     39};
    4340
    4441} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

    r243886 r243925  
    239239{
    240240    VM& vm = exec->vm();
     241    auto scope = DECLARE_THROW_SCOPE(vm);
     242
    241243    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
    242244
    … …  
    244246    JSValue boundThis = exec->uncheckedArgument(1);
    245247    JSValue boundArgs = exec->uncheckedArgument(2);
    246     JSValue length = exec->uncheckedArgument(3);
    247     JSString* name = asString(exec->uncheckedArgument(4));
    248 
    249     return JSValue::encode(JSBoundFunction::create(
    250         vm, exec, globalObject, target, boundThis, boundArgs.isCell() ? jsCast<JSArray*>(boundArgs) : nullptr, length.asInt32(), name->value(exec)));
     248    JSValue lengthValue = exec->uncheckedArgument(3);
     249    JSString* nameString = asString(exec->uncheckedArgument(4));
     250
     251    ASSERT(lengthValue.isAnyInt());
     252    ASSERT(lengthValue.asAnyInt() <= INT32_MAX);
     253    ASSERT(lengthValue.asAnyInt() >= INT32_MIN);
     254    int32_t length = lengthValue.toInt32(exec);
     255    scope.assertNoException();
     256
     257    String name = nameString->value(exec);
     258    RETURN_IF_EXCEPTION(scope, { });
     259
     260    RELEASE_AND_RETURN(scope, JSValue::encode(JSBoundFunction::create(vm, exec, globalObject, target, boundThis, boundArgs.isCell() ? jsCast<JSArray*>(boundArgs) : nullptr, length, WTFMove(name))));
    251261}
    252262

  • trunk/Source/JavaScriptCore/runtime/Options.h

    r243857 r243925  
    438438    v(unsigned, seedOfRandomizingFuzzerAgent, 1, Normal, nullptr) \
    439439    v(bool, dumpRandomizingFuzzerAgentPredictions, false, Normal, nullptr) \
     440    v(bool, useDoublePredictionFuzzerAgent, false, Normal, nullptr) \
    440441    \
    441442    v(bool, logPhaseTimes, false, Normal, nullptr) \

  • trunk/Source/JavaScriptCore/runtime/VM.cpp

    r243886 r243925  
    4242#include "DirectEvalExecutable.h"
    4343#include "Disassembler.h"
     44#include "DoublePredictionFuzzerAgent.h"
    4445#include "Error.h"
    4546#include "ErrorConstructor.h"
    … …  
    460461    }
    461462#endif // ENABLE(SAMPLING_PROFILER)
     463
    462464    if (Options::useRandomizingFuzzerAgent())
    463465        setFuzzerAgent(std::make_unique<RandomizingFuzzerAgent>(*this));
     466    else if (Options::useDoublePredictionFuzzerAgent())
     467        setFuzzerAgent(std::make_unique<DoublePredictionFuzzerAgent>(*this));
    464468
    465469    if (Options::alwaysGeneratePCToCodeOriginMap())
Note: See TracChangeset for help on using the changeset viewer.