Skip to content
This repository was archived by the owner on Oct 15, 2020. It is now read-only.

Commit 64028ef

Browse files
Thomas Moore (CHAKRA)kfarnung
Thomas Moore (CHAKRA)
authored and
kfarnung
committed
deps: update ChakraCore to chakra-core/ChakraCore@e02b39aaf6
[MERGE #4503 @thomasmo] 18-01 Security Update Merge pull request #4503 from thomasmo:1801 18-01 Security Update that addresses the following issues in ChakraCore: CVE-2018-0758 CVE-2018-0762 CVE-2018-0767 CVE-2018-0768 CVE-2018-0769 CVE-2018-0770 CVE-2018-0772 CVE-2018-0773 CVE-2018-0774 CVE-2018-0775 CVE-2018-0776 CVE-2018-0777 CVE-2018-0778 CVE-2018-0780 CVE-2018-0781 Reviewed-By: chakrabot <chakrabot@users.noreply.github.com>
1 parent 1ca3b1e commit 64028ef

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+480
-163
lines changed

‎deps/chakrashim/core/Build/NuGet/.pack-version

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.7.5
1+
1.7.6

‎deps/chakrashim/core/lib/Backend/BailOut.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1006,7 +1006,7 @@ BailOutRecord::RestoreValue(IR::BailOutKind bailOutKind, Js::JavascriptCallStack
10061006
if (boxStackInstance)
10071007
{
10081008
Js::Var oldValue = value;
1009-
value = Js::JavascriptOperators::BoxStackInstance(oldValue, scriptContext, /* allowStackFunction */ true);
1009+
value = Js::JavascriptOperators::BoxStackInstance(oldValue, scriptContext, /* allowStackFunction */ true, /* deepCopy */ false);
10101010

10111011
if (oldValue != value)
10121012
{
@@ -1275,7 +1275,7 @@ BailOutRecord::BailOutInlinedHelper(Js::JavascriptCallStackLayout * layout, Bail
12751275
if (inlineeFrameRecord)
12761276
{
12771277
InlinedFrameLayout* outerMostFrame = (InlinedFrameLayout *)(((uint8 *)Js::JavascriptCallStackLayout::ToFramePointer(layout)) - entryPointInfo->frameHeight);
1278-
inlineeFrameRecord->RestoreFrames(functionBody, outerMostFrame, layout);
1278+
inlineeFrameRecord->RestoreFrames(functionBody, outerMostFrame, layout, false /* deepCopy */);
12791279
}
12801280
}
12811281

@@ -1480,7 +1480,7 @@ BailOutRecord::BailOutHelper(Js::JavascriptCallStackLayout * layout, Js::ScriptF
14801480
{
14811481
const Js::Var arg = args.Values[i];
14821482
BAILOUT_VERBOSE_TRACE(executeFunction, bailOutKind, _u("BailOut: Argument #%3u: value: 0x%p"), i, arg);
1483-
const Js::Var boxedArg = Js::JavascriptOperators::BoxStackInstance(arg, functionScriptContext, true);
1483+
const Js::Var boxedArg = Js::JavascriptOperators::BoxStackInstance(arg, functionScriptContext, /* allowStackFunction */ true, /* deepCopy */ false);
14841484
if(boxedArg != arg)
14851485
{
14861486
args.Values[i] = boxedArg;
@@ -1775,7 +1775,7 @@ BailOutRecord::BailOutHelper(Js::JavascriptCallStackLayout * layout, Js::ScriptF
17751775
aReturn = Js::JavascriptFunction::FinishConstructor(aReturn, args.Values[0], function);
17761776

17771777
Js::Var oldValue = aReturn;
1778-
aReturn = Js::JavascriptOperators::BoxStackInstance(oldValue, functionScriptContext, /* allowStackFunction */ true);
1778+
aReturn = Js::JavascriptOperators::BoxStackInstance(oldValue, functionScriptContext, /* allowStackFunction */ true, /* deepCopy */ false);
17791779
#if ENABLE_DEBUG_CONFIG_OPTIONS
17801780
if (oldValue != aReturn)
17811781
{

‎deps/chakrashim/core/lib/Backend/GlobOpt.cpp

Lines changed: 38 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -2859,7 +2859,7 @@ GlobOpt::OptTagChecks(IR::Instr *instr)
28592859

28602860
if (valueType.CanBeTaggedValue() &&
28612861
!valueType.HasBeenNumber() &&
2862-
(this->IsLoopPrePass() || !this->currentBlock->loop))
2862+
!this->IsLoopPrePass())
28632863
{
28642864
ValueType newValueType = valueType.SetCanBeTaggedValue(false);
28652865

@@ -2883,7 +2883,16 @@ GlobOpt::OptTagChecks(IR::Instr *instr)
28832883
bailOutInstr->SetSrc1(srcOpnd);
28842884
bailOutInstr->GetSrc1()->SetValueType(valueType);
28852885
instr->InsertBefore(bailOutInstr);
2886-
2886+
if (this->currentBlock->loop)
2887+
{
2888+
// Try hoisting the BailOnNotObject instr.
2889+
// But since this isn't the current instr being optimized, we need to play tricks with
2890+
// the byteCodeUse fields...
2891+
TrackByteCodeUsesForInstrAddedInOptInstr(bailOutInstr, [&]()
2892+
{
2893+
TryHoistInvariant(bailOutInstr, this->currentBlock, nullptr, value, nullptr, true, false, false, IR::BailOutOnTaggedValue);
2894+
});
2895+
}
28872896
if (symOpnd)
28882897
{
28892898
symOpnd->SetPropertyOwnerValueType(newValueType);
@@ -3968,25 +3977,10 @@ GlobOpt::CopyPropReplaceOpnd(IR::Instr * instr, IR::Opnd * opnd, StackSym * copy
39683977
// Try hoisting this checkObjType.
39693978
// But since this isn't the current instr being optimized, we need to play tricks with
39703979
// the byteCodeUse fields...
3971-
BVSparse<JitArenaAllocator> *currentBytecodeUses = this->byteCodeUses;
3972-
PropertySym * currentPropertySymUse = this->propertySymUse;
3973-
PropertySym * tempPropertySymUse = NULL;
3974-
this->byteCodeUses = NULL;
3975-
BVSparse<JitArenaAllocator> *tempByteCodeUse = JitAnew(this->tempAlloc, BVSparse<JitArenaAllocator>, this->tempAlloc);
3976-
#if DBG
3977-
BVSparse<JitArenaAllocator> *currentBytecodeUsesBeforeOpt = this->byteCodeUsesBeforeOpt;
3978-
this->byteCodeUsesBeforeOpt = tempByteCodeUse;
3979-
#endif
3980-
this->propertySymUse = NULL;
3981-
GlobOpt::TrackByteCodeSymUsed(checkObjTypeInstr, tempByteCodeUse, &tempPropertySymUse);
3982-
3983-
TryHoistInvariant(checkObjTypeInstr, this->currentBlock, NULL, CurrentBlockData()->FindValue(copySym), NULL, true);
3984-
3985-
this->byteCodeUses = currentBytecodeUses;
3986-
this->propertySymUse = currentPropertySymUse;
3987-
#if DBG
3988-
this->byteCodeUsesBeforeOpt = currentBytecodeUsesBeforeOpt;
3989-
#endif
3980+
TrackByteCodeUsesForInstrAddedInOptInstr(checkObjTypeInstr, [&]()
3981+
{
3982+
TryHoistInvariant(checkObjTypeInstr, this->currentBlock, NULL, CurrentBlockData()->FindValue(copySym), NULL, true);
3983+
});
39903984
}
39913985
}
39923986
}
@@ -7072,6 +7066,18 @@ GlobOpt::OptConstFoldUnary(
70727066
this->ToFloat64Dst(instr, dst->AsRegOpnd(), this->currentBlock);
70737067
}
70747068
}
7069+
7070+
// If this is an induction variable, then treat it the way the prepass would have if it had seen
7071+
// the assignment and the resulting change to the value number, and mark it as indeterminate.
7072+
for (Loop * loop = this->currentBlock->loop; loop; loop = loop->parent)
7073+
{
7074+
InductionVariable *iv = nullptr;
7075+
if (loop->inductionVariables && loop->inductionVariables->TryGetReference(dstSym->m_id, &iv))
7076+
{
7077+
iv->SetChangeIsIndeterminate();
7078+
}
7079+
}
7080+
70757081
return true;
70767082
}
70777083

@@ -12391,6 +12397,17 @@ GlobOpt::OptConstFoldBinary(
1239112397
this->ToInt32Dst(instr, dst->AsRegOpnd(), this->currentBlock);
1239212398
}
1239312399

12400+
// If this is an induction variable, then treat it the way the prepass would have if it had seen
12401+
// the assignment and the resulting change to the value number, and mark it as indeterminate.
12402+
for (Loop * loop = this->currentBlock->loop; loop; loop = loop->parent)
12403+
{
12404+
InductionVariable *iv = nullptr;
12405+
if (loop->inductionVariables && loop->inductionVariables->TryGetReference(dstSym->m_id, &iv))
12406+
{
12407+
iv->SetChangeIsIndeterminate();
12408+
}
12409+
}
12410+
1239412411
return true;
1239512412
}
1239612413

‎deps/chakrashim/core/lib/Backend/GlobOpt.h

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -798,6 +798,29 @@ class GlobOpt
798798
bool DoPowIntIntTypeSpec() const;
799799
bool DoTagChecks() const;
800800

801+
template <class Fn>
802+
void TrackByteCodeUsesForInstrAddedInOptInstr(IR::Instr * trackByteCodeUseOnInstr, Fn fn)
803+
{
804+
BVSparse<JitArenaAllocator> *currentBytecodeUses = this->byteCodeUses;
805+
PropertySym * currentPropertySymUse = this->propertySymUse;
806+
PropertySym * tempPropertySymUse = NULL;
807+
this->byteCodeUses = NULL;
808+
BVSparse<JitArenaAllocator> *tempByteCodeUse = JitAnew(this->tempAlloc, BVSparse<JitArenaAllocator>, this->tempAlloc);
809+
#if DBG
810+
BVSparse<JitArenaAllocator> *currentBytecodeUsesBeforeOpt = this->byteCodeUsesBeforeOpt;
811+
this->byteCodeUsesBeforeOpt = tempByteCodeUse;
812+
#endif
813+
this->propertySymUse = NULL;
814+
GlobOpt::TrackByteCodeSymUsed(trackByteCodeUseOnInstr, tempByteCodeUse, &tempPropertySymUse);
815+
816+
fn();
817+
818+
this->byteCodeUses = currentBytecodeUses;
819+
this->propertySymUse = currentPropertySymUse;
820+
#if DBG
821+
this->byteCodeUsesBeforeOpt = currentBytecodeUsesBeforeOpt;
822+
#endif
823+
}
801824
private:
802825
// GlobOptBailout.cpp
803826
bool MayNeedBailOut(Loop * loop) const;

‎deps/chakrashim/core/lib/Backend/GlobOptIntBounds.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -840,7 +840,7 @@ void GlobOpt::TrackIntSpecializedAddSubConstant(
840840
}
841841
} while(false);
842842

843-
if(updateSourceBounds && addSubConstantInfo->Offset() != IntConstMin)
843+
if(!this->IsLoopPrePass() && updateSourceBounds && addSubConstantInfo->Offset() != IntConstMin)
844844
{
845845
// Track bounds for add or sub with a constant. For instance, consider (b = a + 2). The value of 'b' should track
846846
// that it is equal to (the value of 'a') + 2. That part has been done above. Similarly, the value of 'a' should

‎deps/chakrashim/core/lib/Backend/InlineeFrameInfo.cpp

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -199,13 +199,14 @@ void InlineeFrameRecord::Finalize(Func* inlinee, uint32 currentOffset)
199199
Assert(this->inlineDepth != 0);
200200
}
201201

202-
void InlineeFrameRecord::Restore(Js::FunctionBody* functionBody, InlinedFrameLayout *inlinedFrame, Js::JavascriptCallStackLayout * layout) const
202+
void InlineeFrameRecord::Restore(Js::FunctionBody* functionBody, InlinedFrameLayout *inlinedFrame, Js::JavascriptCallStackLayout * layout, bool deepCopy) const
203203
{
204204
Assert(this->inlineDepth != 0);
205205
Assert(inlineeStartOffset != 0);
206206

207207
BAILOUT_VERBOSE_TRACE(functionBody, _u("Restore function object: "));
208-
Js::Var varFunction = this->Restore(this->functionOffset, /*isFloat64*/ false, /*isInt32*/ false, layout, functionBody);
208+
// No deepCopy needed for just the function
209+
Js::Var varFunction = this->Restore(this->functionOffset, /*isFloat64*/ false, /*isInt32*/ false, layout, functionBody, /*deepCopy*/ false);
209210
Assert(Js::ScriptFunction::Is(varFunction));
210211

211212
Js::ScriptFunction* function = Js::ScriptFunction::FromVar(varFunction);
@@ -219,7 +220,9 @@ void InlineeFrameRecord::Restore(Js::FunctionBody* functionBody, InlinedFrameLay
219220
bool isInt32 = losslessInt32Args.Test(i) != 0;
220221
BAILOUT_VERBOSE_TRACE(functionBody, _u("Restore argument %d: "), i);
221222

222-
Js::Var var = this->Restore(this->argOffsets[i], isFloat64, isInt32, layout, functionBody);
223+
// Forward deepCopy flag for the arguments in case their data must be guaranteed
224+
// to have its own lifetime
225+
Js::Var var = this->Restore(this->argOffsets[i], isFloat64, isInt32, layout, functionBody, deepCopy);
223226
#if DBG
224227
if (!Js::TaggedNumber::Is(var))
225228
{
@@ -233,7 +236,7 @@ void InlineeFrameRecord::Restore(Js::FunctionBody* functionBody, InlinedFrameLay
233236
BAILOUT_FLUSH(functionBody);
234237
}
235238

236-
void InlineeFrameRecord::RestoreFrames(Js::FunctionBody* functionBody, InlinedFrameLayout* outerMostFrame, Js::JavascriptCallStackLayout* callstack)
239+
void InlineeFrameRecord::RestoreFrames(Js::FunctionBody* functionBody, InlinedFrameLayout* outerMostFrame, Js::JavascriptCallStackLayout* callstack, bool deepCopy)
237240
{
238241
InlineeFrameRecord* innerMostRecord = this;
239242
class AutoReverse
@@ -271,7 +274,7 @@ void InlineeFrameRecord::RestoreFrames(Js::FunctionBody* functionBody, InlinedFr
271274

272275
while (currentRecord)
273276
{
274-
currentRecord->Restore(functionBody, currentFrame, callstack);
277+
currentRecord->Restore(functionBody, currentFrame, callstack, deepCopy);
275278
currentRecord = currentRecord->parent;
276279
currentFrame = currentFrame->Next();
277280
}
@@ -280,7 +283,7 @@ void InlineeFrameRecord::RestoreFrames(Js::FunctionBody* functionBody, InlinedFr
280283
currentFrame->callInfo.Count = 0;
281284
}
282285

283-
Js::Var InlineeFrameRecord::Restore(int offset, bool isFloat64, bool isInt32, Js::JavascriptCallStackLayout * layout, Js::FunctionBody* functionBody) const
286+
Js::Var InlineeFrameRecord::Restore(int offset, bool isFloat64, bool isInt32, Js::JavascriptCallStackLayout * layout, Js::FunctionBody* functionBody, bool deepCopy) const
284287
{
285288
Js::Var value;
286289
bool boxStackInstance = true;
@@ -322,7 +325,7 @@ Js::Var InlineeFrameRecord::Restore(int offset, bool isFloat64, bool isInt32, Js
322325
if (boxStackInstance)
323326
{
324327
Js::Var oldValue = value;
325-
value = Js::JavascriptOperators::BoxStackInstance(oldValue, functionBody->GetScriptContext(), /* allowStackFunction */ true);
328+
value = Js::JavascriptOperators::BoxStackInstance(oldValue, functionBody->GetScriptContext(), /* allowStackFunction */ true, deepCopy);
326329

327330
#if ENABLE_DEBUG_CONFIG_OPTIONS
328331
if (oldValue != value)

‎deps/chakrashim/core/lib/Backend/InlineeFrameInfo.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ struct InlineeFrameRecord
108108
}
109109

110110
void PopulateParent(Func* func);
111-
void RestoreFrames(Js::FunctionBody* functionBody, InlinedFrameLayout* outerMostInlinee, Js::JavascriptCallStackLayout* callstack);
111+
void RestoreFrames(Js::FunctionBody* functionBody, InlinedFrameLayout* outerMostInlinee, Js::JavascriptCallStackLayout* callstack, bool deepCopy);
112112
void Finalize(Func* inlinee, uint currentOffset);
113113
#if DBG_DUMP
114114
void Dump() const;
@@ -123,8 +123,8 @@ struct InlineeFrameRecord
123123
}
124124

125125
private:
126-
void Restore(Js::FunctionBody* functionBody, InlinedFrameLayout *outerMostFrame, Js::JavascriptCallStackLayout * layout) const;
127-
Js::Var Restore(int offset, bool isFloat64, bool isInt32, Js::JavascriptCallStackLayout * layout, Js::FunctionBody* functionBody) const;
126+
void Restore(Js::FunctionBody* functionBody, InlinedFrameLayout *outerMostFrame, Js::JavascriptCallStackLayout * layout, bool deepCopy) const;
127+
Js::Var Restore(int offset, bool isFloat64, bool isInt32, Js::JavascriptCallStackLayout * layout, Js::FunctionBody* functionBody, bool deepCopy) const;
128128
InlineeFrameRecord* Reverse();
129129
};
130130

‎deps/chakrashim/core/lib/Backend/JITThunkEmitter.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ JITThunkEmitter<TAlloc>::CreateThunk(uintptr_t entryPoint)
7777

7878
if (IsThunkPageEmpty(pageStartAddress))
7979
{
80-
if (this->codeAllocator->Alloc((PVOID)pageStartAddress, AutoSystemInfo::PageSize, MEM_COMMIT, PAGE_EXECUTE, true) == nullptr)
80+
if (this->codeAllocator->AllocPages((PVOID)pageStartAddress, 1, MEM_COMMIT, PAGE_EXECUTE, true) == nullptr)
8181
{
8282
this->codeAllocator->FreeLocal(localPageAddress);
8383
return NULL;
@@ -165,7 +165,7 @@ JITThunkEmitter<TAlloc>::EnsureInitialized()
165165
// check again because we did the first one outside of lock
166166
if (this->baseAddress == NULL)
167167
{
168-
this->baseAddress = (uintptr_t)this->codeAllocator->Alloc(nullptr, TotalThunkSize, MEM_RESERVE, PAGE_EXECUTE, true);
168+
this->baseAddress = (uintptr_t)this->codeAllocator->AllocPages(nullptr, PageCount, MEM_RESERVE, PAGE_EXECUTE, true);
169169
}
170170
}
171171
return this->baseAddress;

‎deps/chakrashim/core/lib/Backend/Lower.cpp

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8330,7 +8330,7 @@ Lowerer::LowerAddLeftDeadForString(IR::Instr *instr)
83308330
InsertCompareBranch(
83318331
regLeftCharLengthOpnd,
83328332
IR::IntConstOpnd::New(Js::JavascriptString::MaxCharLength, TyUint32, m_func),
8333-
Js::OpCode::BrGt_A,
8333+
Js::OpCode::BrGe_A,
83348334
labelHelper,
83358335
insertBeforeInstr);
83368336

@@ -14702,6 +14702,29 @@ IR::BranchInstr *Lowerer::InsertTestBranch(
1470214702
return InsertBranch(branchOpCode, isUnsigned, target, insertBeforeInstr);
1470314703
}
1470414704

14705+
/* Inserts add with an overflow check, if we overflow throw OOM
14706+
* add dst, src
14707+
* jno $continueLabel
14708+
* overflow code
14709+
* $continueLabel : fall through
14710+
*/
14711+
void Lowerer::InsertAddWithOverflowCheck(
14712+
const bool needFlags,
14713+
IR::Opnd *const dst,
14714+
IR::Opnd *src1,
14715+
IR::Opnd *src2,
14716+
IR::Instr *const insertBeforeInstr,
14717+
IR::Instr **const onOverflowInsertBeforeInstrRef)
14718+
{
14719+
Func * func = insertBeforeInstr->m_func;
14720+
InsertAdd(needFlags, dst, src1, src2, insertBeforeInstr);
14721+
14722+
IR::LabelInstr *const continueLabel = IR::LabelInstr::New(Js::OpCode::Label, func, false);
14723+
InsertBranch(LowererMD::MDNotOverflowBranchOpcode, continueLabel, insertBeforeInstr);
14724+
14725+
*onOverflowInsertBeforeInstrRef = continueLabel;
14726+
}
14727+
1470514728
IR::Instr *Lowerer::InsertAdd(
1470614729
const bool needFlags,
1470714730
IR::Opnd *const dst,
@@ -23210,7 +23233,15 @@ Lowerer::LowerSetConcatStrMultiItem(IR::Instr * instr)
2321023233
srcLength = IR::RegOpnd::New(TyUint32, func);
2321123234
InsertMove(srcLength, IR::IndirOpnd::New(srcOpnd, Js::ConcatStringMulti::GetOffsetOfcharLength(), TyUint32, func), instr);
2321223235
}
23213-
InsertAdd(false, dstLength, dstLength, srcLength, instr);
23236+
23237+
IR::Instr *onOverflowInsertBeforeInstr;
23238+
InsertAddWithOverflowCheck(false, dstLength, dstLength, srcLength, instr, &onOverflowInsertBeforeInstr);
23239+
IR::Instr* callInstr = IR::Instr::New(Js::OpCode::Call, func);
23240+
callInstr->SetSrc1(IR::HelperCallOpnd::New(IR::HelperOp_OutOfMemoryError, func));
23241+
23242+
instr->InsertBefore(onOverflowInsertBeforeInstr);
23243+
onOverflowInsertBeforeInstr->InsertBefore(callInstr);
23244+
this->m_lowererMD.LowerCall(callInstr, 0);
2321423245

2321523246
dstOpnd->SetOffset(dstOpnd->GetOffset() * sizeof(Js::JavascriptString *) + Js::ConcatStringMulti::GetOffsetOfSlots());
2321623247

‎deps/chakrashim/core/lib/Backend/Lower.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,8 @@ class Lowerer
359359

360360
public:
361361
static void InsertDecUInt32PreventOverflow(IR::Opnd *const dst, IR::Opnd *const src, IR::Instr *const insertBeforeInstr, IR::Instr * *const onOverflowInsertBeforeInstrRef = nullptr);
362+
static void InsertAddWithOverflowCheck(const bool needFlags, IR::Opnd *const dst, IR::Opnd *src1, IR::Opnd *src2, IR::Instr *const insertBeforeInstr, IR::Instr **const onOverflowInsertBeforeInstrRef);
363+
362364
void InsertFloatCheckForZeroOrNanBranch(IR::Opnd *const src, const bool branchOnZeroOrNan, IR::LabelInstr *const target, IR::LabelInstr *const fallthroughLabel, IR::Instr *const insertBeforeInstr);
363365

364366
public:

0 commit comments

Comments
 (0)