Skip to content

Commit 058c1cd

Browse files
leirocksleirocks
committed
[1.9>master] [1.8>1.9] [MERGE #5298 @leirocks] ChakraCore 2018-06 security updates
Merge pull request #5298 from leirocks:servicing/1806_1.8
2 parents bac4186 + 4707cbf commit 058c1cd

File tree

3 files changed

+40
-15
lines changed

3 files changed

+40
-15
lines changed

‎lib/Backend/Func.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ Func::Func(JitArenaAllocator *alloc, JITTimeWorkItem * workItem,
262262
ObjTypeSpecFldInfo * info = GetWorkItem()->GetJITTimeInfo()->GetObjTypeSpecFldInfo(i);
263263
if (info != nullptr)
264264
{
265-
Assert(info->GetObjTypeSpecFldId() < GetTopFunc()->GetWorkItem()->GetJITTimeInfo()->GetGlobalObjTypeSpecFldInfoCount());
265+
AssertOrFailFast(info->GetObjTypeSpecFldId() < GetTopFunc()->GetWorkItem()->GetJITTimeInfo()->GetGlobalObjTypeSpecFldInfoCount());
266266
GetTopFunc()->m_globalObjTypeSpecFldInfoArray[info->GetObjTypeSpecFldId()] = info;
267267
}
268268
}

‎lib/Backend/GlobOpt.cpp

Lines changed: 38 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -12554,6 +12554,8 @@ GlobOpt::DoTrackNewValueForKills(Value *const value)
1255412554
const bool isJsArray = valueInfo->IsArrayOrObjectWithArray();
1255512555
Assert(!isJsArray == valueInfo->IsOptimizedTypedArray());
1255612556

12557+
const bool isVirtualTypedArray = valueInfo->IsOptimizedVirtualTypedArray();
12558+
1255712559
Loop *implicitCallsLoop;
1255812560
if(currentBlock->next && !currentBlock->next->isDeleted && currentBlock->next->isLoopHeader)
1255912561
{
@@ -12568,7 +12570,7 @@ GlobOpt::DoTrackNewValueForKills(Value *const value)
1256812570
implicitCallsLoop = currentBlock->loop;
1256912571
}
1257012572

12571-
if(isJsArray)
12573+
if(isJsArray || isVirtualTypedArray)
1257212574
{
1257312575
if(!DoArrayCheckHoist(valueInfo->Type(), implicitCallsLoop))
1257412576
{
@@ -12587,7 +12589,7 @@ GlobOpt::DoTrackNewValueForKills(Value *const value)
1258712589
VerifyArrayValueInfoForTracking(valueInfo, isJsArray, currentBlock);
1258812590
#endif
1258912591

12590-
if(!isJsArray)
12592+
if(!isJsArray && !isVirtualTypedArray)
1259112593
{
1259212594
return;
1259312595
}
@@ -12623,11 +12625,13 @@ GlobOpt::DoTrackCopiedValueForKills(Value *const value)
1262312625
const bool isJsArray = valueInfo->IsArrayOrObjectWithArray();
1262412626
Assert(!isJsArray == valueInfo->IsOptimizedTypedArray());
1262512627

12628+
const bool isVirtualTypedArray = valueInfo->IsOptimizedVirtualTypedArray();
12629+
1262612630
#if DBG
1262712631
VerifyArrayValueInfoForTracking(valueInfo, isJsArray, currentBlock);
1262812632
#endif
1262912633

12630-
if(!isJsArray && !(valueInfo->IsArrayValueInfo() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym()))
12634+
if(!isJsArray && !isVirtualTypedArray && !(valueInfo->IsArrayValueInfo() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym()))
1263112635
{
1263212636
return;
1263312637
}
@@ -12670,11 +12674,13 @@ GlobOpt::DoTrackMergedValueForKills(
1267012674
const bool isJsArray = valueInfo->IsArrayOrObjectWithArray();
1267112675
Assert(!isJsArray == valueInfo->IsOptimizedTypedArray());
1267212676

12677+
const bool isVirtualTypedArray = valueInfo->IsOptimizedVirtualTypedArray();
12678+
1267312679
#if DBG
1267412680
VerifyArrayValueInfoForTracking(valueInfo, isJsArray, currentBlock, true);
1267512681
#endif
1267612682

12677-
if(!isJsArray && !(valueInfo->IsArrayValueInfo() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym()))
12683+
if(!isJsArray && !isVirtualTypedArray && !(valueInfo->IsArrayValueInfo() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym()))
1267812684
{
1267912685
return;
1268012686
}
@@ -12707,6 +12713,7 @@ GlobOpt::TrackValueInfoChangeForKills(BasicBlock *const block, Value *const valu
1270712713

1270812714
const bool trackOldValueInfo =
1270912715
oldValueInfo->IsArrayOrObjectWithArray() ||
12716+
oldValueInfo->IsOptimizedVirtualTypedArray() ||
1271012717
(
1271112718
oldValueInfo->IsOptimizedTypedArray() &&
1271212719
oldValueInfo->IsArrayValueInfo() &&
@@ -12723,6 +12730,7 @@ GlobOpt::TrackValueInfoChangeForKills(BasicBlock *const block, Value *const valu
1272312730

1272412731
const bool trackNewValueInfo =
1272512732
newValueInfo->IsArrayOrObjectWithArray() ||
12733+
newValueInfo->IsOptimizedVirtualTypedArray() ||
1272612734
(
1272712735
newValueInfo->IsOptimizedTypedArray() &&
1272812736
newValueInfo->IsArrayValueInfo() &&
@@ -12791,6 +12799,7 @@ GlobOpt::ProcessValueKills(IR::Instr *const instr)
1279112799
ValueInfo *const valueInfo = value->GetValueInfo();
1279212800
Assert(
1279312801
valueInfo->IsArrayOrObjectWithArray() ||
12802+
valueInfo->IsOptimizedVirtualTypedArray() ||
1279412803
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
1279512804
if (valueInfo->IsArrayOrObjectWithArray() || valueInfo->IsOptimizedVirtualTypedArray())
1279612805
{
@@ -12816,6 +12825,7 @@ GlobOpt::ProcessValueKills(IR::Instr *const instr)
1281612825
ValueInfo *const valueInfo = value->GetValueInfo();
1281712826
Assert(
1281812827
valueInfo->IsArrayOrObjectWithArray() ||
12828+
valueInfo->IsOptimizedVirtualTypedArray() ||
1281912829
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
1282012830
if(!valueInfo->IsArrayOrObjectWithArray() || !valueInfo->HasNoMissingValues())
1282112831
{
@@ -12836,6 +12846,7 @@ GlobOpt::ProcessValueKills(IR::Instr *const instr)
1283612846
ValueInfo *const valueInfo = value->GetValueInfo();
1283712847
Assert(
1283812848
valueInfo->IsArrayOrObjectWithArray() ||
12849+
valueInfo->IsOptimizedVirtualTypedArray() ||
1283912850
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
1284012851
if(!valueInfo->IsArrayOrObjectWithArray() || valueInfo->HasVarElements())
1284112852
{
@@ -12862,6 +12873,7 @@ GlobOpt::ProcessValueKills(IR::Instr *const instr)
1286212873
ValueInfo *valueInfo = value->GetValueInfo();
1286312874
Assert(
1286412875
valueInfo->IsArrayOrObjectWithArray() ||
12876+
valueInfo->IsOptimizedVirtualTypedArray() ||
1286512877
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
1286612878
if(!valueInfo->IsArrayOrObjectWithArray())
1286712879
{
@@ -12937,8 +12949,9 @@ GlobOpt::ProcessValueKills(BasicBlock *const block, GlobOptBlockData *const bloc
1293712949
ValueInfo *const valueInfo = value->GetValueInfo();
1293812950
Assert(
1293912951
valueInfo->IsArrayOrObjectWithArray() ||
12952+
valueInfo->IsOptimizedVirtualTypedArray() ||
1294012953
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
12941-
if(valueInfo->IsArrayOrObjectWithArray())
12954+
if(valueInfo->IsArrayOrObjectWithArray() || valueInfo->IsOptimizedVirtualTypedArray())
1294212955
{
1294312956
ChangeValueType(nullptr, value, valueInfo->Type().ToLikely(), false);
1294412957
continue;
@@ -12971,18 +12984,21 @@ GlobOpt::ProcessValueKillsForLoopHeaderAfterBackEdgeMerge(BasicBlock *const bloc
1297112984
ValueInfo *valueInfo = value->GetValueInfo();
1297212985
Assert(
1297312986
valueInfo->IsArrayOrObjectWithArray() ||
12987+
valueInfo->IsOptimizedVirtualTypedArray() ||
1297412988
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
1297512989

1297612990
const bool isJsArray = valueInfo->IsArrayOrObjectWithArray();
1297712991
Assert(!isJsArray == valueInfo->IsOptimizedTypedArray());
1297812992

12979-
if(isJsArray ? loopKills.KillsValueType(valueInfo->Type()) : loopKills.KillsTypedArrayHeadSegmentLengths())
12993+
const bool isVirtualTypedArray = valueInfo->IsOptimizedVirtualTypedArray();
12994+
12995+
if((isJsArray || isVirtualTypedArray) ? loopKills.KillsValueType(valueInfo->Type()) : loopKills.KillsTypedArrayHeadSegmentLengths())
1298012996
{
1298112997
// Hoisting array checks and other related things for this type is disabled for the loop due to the kill, as
1298212998
// compensation code is currently not added on back-edges. When merging values from a back-edge, the array value
1298312999
// type cannot be definite, as that may require adding compensation code on the back-edge if the optimization pass
1298413000
// chooses to not optimize the array.
12985-
if(isJsArray)
13001+
if(isJsArray || isVirtualTypedArray)
1298613002
{
1298713003
ChangeValueType(nullptr, value, valueInfo->Type().ToLikely(), false);
1298813004
}
@@ -14472,14 +14488,16 @@ void
1447214488
GlobOpt::OptHoistUpdateValueType(
1447314489
Loop* loop,
1447414490
IR::Instr* instr,
14475-
IR::Opnd* srcOpnd,
14491+
IR::Opnd** srcOpndPtr /* All code paths that change src, should update srcOpndPtr*/,
1447614492
Value* opndVal)
1447714493
{
14478-
if (opndVal == nullptr || instr->m_opcode == Js::OpCode::FromVar)
14494+
if (opndVal == nullptr || instr->m_opcode == Js::OpCode::FromVar || srcOpndPtr == nullptr || *srcOpndPtr == nullptr)
1447914495
{
1448014496
return;
1448114497
}
1448214498

14499+
IR::Opnd* srcOpnd = *srcOpndPtr;
14500+
1448314501
Sym* opndSym = srcOpnd->GetSym();;
1448414502

1448514503
if (opndSym)
@@ -14492,8 +14510,11 @@ GlobOpt::OptHoistUpdateValueType(
1449214510

1449314511
if (srcOpnd->GetValueType() != opndValueTypeInLandingPad)
1449414512
{
14513+
srcOpnd->SetValueType(opndValueTypeInLandingPad);
14514+
1449514515
if (instr->m_opcode == Js::OpCode::SetConcatStrMultiItemBE)
1449614516
{
14517+
Assert(!opndSym->IsPropertySym());
1449714518
Assert(!opndValueTypeInLandingPad.IsString());
1449814519
Assert(instr->GetDst());
1449914520

@@ -14504,6 +14525,9 @@ GlobOpt::OptHoistUpdateValueType(
1450414525
IR::Instr::New(Js::OpCode::Conv_PrimStr, strOpnd, srcOpnd->Use(instr->m_func), instr->m_func);
1450514526
instr->ReplaceSrc(srcOpnd, strOpnd);
1450614527

14528+
// Replace above will free srcOpnd, so reassign it
14529+
*srcOpndPtr = srcOpnd = reinterpret_cast<IR::Opnd *>(strOpnd);
14530+
1450714531
if (loop->bailOutInfo->bailOutInstr)
1450814532
{
1450914533
loop->bailOutInfo->bailOutInstr->InsertBefore(convPrimStrInstr);
@@ -14512,9 +14536,10 @@ GlobOpt::OptHoistUpdateValueType(
1451214536
{
1451314537
landingPad->InsertAfter(convPrimStrInstr);
1451414538
}
14515-
}
1451614539

14517-
srcOpnd->SetValueType(opndValueTypeInLandingPad);
14540+
// If we came here opndSym can't be PropertySym
14541+
return;
14542+
}
1451814543
}
1451914544

1452014545

@@ -14548,7 +14573,7 @@ GlobOpt::OptHoistInvariant(
1454814573
if (src1)
1454914574
{
1455014575
// We are hoisting this instruction possibly past other uses, which might invalidate the last use info. Clear it.
14551-
OptHoistUpdateValueType(loop, instr, src1, src1Val);
14576+
OptHoistUpdateValueType(loop, instr, &src1, src1Val);
1455214577

1455314578
if (src1->IsRegOpnd())
1455414579
{
@@ -14558,7 +14583,7 @@ GlobOpt::OptHoistInvariant(
1455814583
IR::Opnd* src2 = instr->GetSrc2();
1455914584
if (src2)
1456014585
{
14561-
OptHoistUpdateValueType(loop, instr, src2, src2Val);
14586+
OptHoistUpdateValueType(loop, instr, &src2, src2Val);
1456214587

1456314588
if (src2->IsRegOpnd())
1456414589
{

‎lib/Backend/GlobOpt.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -768,7 +768,7 @@ class GlobOpt
768768
bool TryHoistInvariant(IR::Instr *instr, BasicBlock *block, Value *dstVal, Value *src1Val, Value *src2Val, bool isNotTypeSpecConv,
769769
const bool lossy = false, const bool forceInvariantHoisting = false, IR::BailOutKind bailoutKind = IR::BailOutInvalid);
770770
void HoistInvariantValueInfo(ValueInfo *const invariantValueInfoToHoist, Value *const valueToUpdate, BasicBlock *const targetBlock);
771-
void OptHoistUpdateValueType(Loop* loop, IR::Instr* instr, IR::Opnd* srcOpnd, Value *const srcVal);
771+
void OptHoistUpdateValueType(Loop* loop, IR::Instr* instr, IR::Opnd** srcOpndPtr, Value *const srcVal);
772772
public:
773773
static bool IsTypeSpecPhaseOff(Func const * func);
774774
static bool DoAggressiveIntTypeSpec(Func const * func);

0 commit comments

Comments
 (0)