Skip to content

Commit 0f3f5be

Browse files
author
Atul Katti
committed
[MERGE #5444 @atulkatti] JULY 2018 Security Update
Merge pull request #5444 from atulkatti:servicing/1807_1.10 JULY 2018 Security Update that addresses the following issues in ChakraCore.dll: [CVE-2018-8275], [CVE-2018-8276], [CVE-2018-8279], [CVE-2018-8280], [CVE-2018-8283], [CVE-2018-8286], [CVE-2018-8287], [CVE-2018-8288], [CVE-2018-8290], [CVE-2018-8291], [CVE-2018-8294], [CVE-2018-8298]
2 parents 70866fd + 17f8fe3 commit 0f3f5be

31 files changed

+12579
-12484
lines changed

‎Build/NuGet/.pack-version

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.10.0
1+
1.10.1

‎lib/Backend/GlobOpt.h

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -849,15 +849,15 @@ class GlobOpt
849849
static void TrackByteCodeSymUsed(IR::Opnd * opnd, BVSparse<JitArenaAllocator> * instrByteCodeStackSymUsed, PropertySym **pPropertySymUse);
850850
static void TrackByteCodeSymUsed(IR::RegOpnd * opnd, BVSparse<JitArenaAllocator> * instrByteCodeStackSymUsed);
851851
static void TrackByteCodeSymUsed(StackSym * sym, BVSparse<JitArenaAllocator> * instrByteCodeStackSymUsed);
852-
void CaptureValues(BasicBlock *block, BailOutInfo * bailOutInfo);
852+
void CaptureValues(BasicBlock *block, BailOutInfo * bailOutInfo, BVSparse<JitArenaAllocator>* argsToCapture);
853853
void CaptureValuesFromScratch(
854854
BasicBlock * block,
855-
SListBase<ConstantStackSymValue>::EditingIterator & bailOutConstValuesIter,
856-
SListBase<CopyPropSyms>::EditingIterator & bailOutCopyPropIter);
855+
SListBase<ConstantStackSymValue>::EditingIterator & bailOutConstValuesIter, SListBase<CopyPropSyms>::EditingIterator & bailOutCopyPropIter,
856+
BVSparse<JitArenaAllocator>* argsToCapture);
857857
void CaptureValuesIncremental(
858858
BasicBlock * block,
859859
SListBase<ConstantStackSymValue>::EditingIterator & bailOutConstValuesIter,
860-
SListBase<CopyPropSyms>::EditingIterator & bailOutCopyPropIter);
860+
SListBase<CopyPropSyms>::EditingIterator & bailOutCopyPropIter, BVSparse<JitArenaAllocator>* argsToCapture);
861861
void CaptureCopyPropValue(BasicBlock * block, Sym * sym, Value * val, SListBase<CopyPropSyms>::EditingIterator & bailOutCopySymsIter);
862862
void CaptureArguments(BasicBlock *block, BailOutInfo * bailOutInfo, JitArenaAllocator *allocator);
863863
void CaptureByteCodeSymUses(IR::Instr * instr);

‎lib/Backend/GlobOptBailOut.cpp

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,8 @@ GlobOpt::CaptureCopyPropValue(BasicBlock * block, Sym * sym, Value * val, SListB
2222
void
2323
GlobOpt::CaptureValuesFromScratch(BasicBlock * block,
2424
SListBase<ConstantStackSymValue>::EditingIterator & bailOutConstValuesIter,
25-
SListBase<CopyPropSyms>::EditingIterator & bailOutCopySymsIter)
25+
SListBase<CopyPropSyms>::EditingIterator & bailOutCopySymsIter,
26+
BVSparse<JitArenaAllocator>* argsToCapture)
2627
{
2728
Sym * sym = nullptr;
2829
Value * value = nullptr;
@@ -49,6 +50,11 @@ GlobOpt::CaptureValuesFromScratch(BasicBlock * block,
4950
}
5051
NEXT_GLOBHASHTABLE_ENTRY;
5152

53+
if (argsToCapture)
54+
{
55+
block->globOptData.changedSyms->Or(argsToCapture);
56+
}
57+
5258
FOREACH_BITSET_IN_SPARSEBV(symId, block->globOptData.changedSyms)
5359
{
5460
HashBucket<Sym*, Value*> * bucket = block->globOptData.symToValueMap->GetBucket(symId);
@@ -80,7 +86,8 @@ GlobOpt::CaptureValuesFromScratch(BasicBlock * block,
8086
void
8187
GlobOpt::CaptureValuesIncremental(BasicBlock * block,
8288
SListBase<ConstantStackSymValue>::EditingIterator & bailOutConstValuesIter,
83-
SListBase<CopyPropSyms>::EditingIterator & bailOutCopySymsIter)
89+
SListBase<CopyPropSyms>::EditingIterator & bailOutCopySymsIter,
90+
BVSparse<JitArenaAllocator>* argsToCapture)
8491
{
8592
CapturedValues * currCapturedValues = block->globOptData.capturedValues;
8693
SListBase<ConstantStackSymValue>::Iterator iterConst(currCapturedValues ? &currCapturedValues->constantValues : nullptr);
@@ -90,6 +97,11 @@ GlobOpt::CaptureValuesIncremental(BasicBlock * block,
9097

9198
block->globOptData.changedSyms->Set(Js::Constants::InvalidSymID);
9299

100+
if (argsToCapture)
101+
{
102+
block->globOptData.changedSyms->Or(argsToCapture);
103+
}
104+
93105
FOREACH_BITSET_IN_SPARSEBV(symId, block->globOptData.changedSyms)
94106
{
95107
Value * val = nullptr;
@@ -225,7 +237,7 @@ GlobOpt::CaptureValuesIncremental(BasicBlock * block,
225237

226238

227239
void
228-
GlobOpt::CaptureValues(BasicBlock *block, BailOutInfo * bailOutInfo)
240+
GlobOpt::CaptureValues(BasicBlock *block, BailOutInfo * bailOutInfo, BVSparse<JitArenaAllocator>* argsToCapture)
229241
{
230242
if (!this->func->DoGlobOptsForGeneratorFunc())
231243
{
@@ -244,11 +256,11 @@ GlobOpt::CaptureValues(BasicBlock *block, BailOutInfo * bailOutInfo)
244256

245257
if (!block->globOptData.capturedValues)
246258
{
247-
CaptureValuesFromScratch(block, bailOutConstValuesIter, bailOutCopySymsIter);
259+
CaptureValuesFromScratch(block, bailOutConstValuesIter, bailOutCopySymsIter, argsToCapture);
248260
}
249261
else
250262
{
251-
CaptureValuesIncremental(block, bailOutConstValuesIter, bailOutCopySymsIter);
263+
CaptureValuesIncremental(block, bailOutConstValuesIter, bailOutCopySymsIter, argsToCapture);
252264
}
253265

254266
// attach capturedValues to bailOutInfo
@@ -892,6 +904,8 @@ GlobOpt::FillBailOutInfo(BasicBlock *block, BailOutInfo * bailOutInfo)
892904
{
893905
AssertMsg(!this->isCallHelper, "Bail out can't be inserted the middle of CallHelper sequence");
894906

907+
BVSparse<JitArenaAllocator>* argsToCapture = nullptr;
908+
895909
bailOutInfo->liveVarSyms = block->globOptData.liveVarSyms->CopyNew(this->func->m_alloc);
896910
bailOutInfo->liveFloat64Syms = block->globOptData.liveFloat64Syms->CopyNew(this->func->m_alloc);
897911
// The live int32 syms in the bailout info are only the syms resulting from lossless conversion to int. If the int32 value
@@ -971,7 +985,12 @@ GlobOpt::FillBailOutInfo(BasicBlock *block, BailOutInfo * bailOutInfo)
971985
sym = opnd->GetStackSym();
972986
Assert(this->currentBlock->globOptData.FindValue(sym));
973987
// StackSym args need to be re-captured
974-
this->currentBlock->globOptData.SetChangedSym(sym->m_id);
988+
if (!argsToCapture)
989+
{
990+
argsToCapture = JitAnew(this->tempAlloc, BVSparse<JitArenaAllocator>, this->tempAlloc);
991+
}
992+
993+
argsToCapture->Set(sym->m_id);
975994
}
976995

977996
Assert(totalOutParamCount != 0);
@@ -1019,7 +1038,7 @@ GlobOpt::FillBailOutInfo(BasicBlock *block, BailOutInfo * bailOutInfo)
10191038

10201039
// Save the constant values that we know so we can restore them directly.
10211040
// This allows us to dead store the constant value assign.
1022-
this->CaptureValues(block, bailOutInfo);
1041+
this->CaptureValues(block, bailOutInfo, argsToCapture);
10231042
}
10241043

10251044
void

‎lib/Backend/JnHelperMethod.cpp

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,7 @@ DECLSPEC_GUARDIGNORE _NOINLINE intptr_t GetNonTableMethodAddress(ThreadContextI
283283
///----------------------------------------------------------------------------
284284
intptr_t GetMethodOriginalAddress(ThreadContextInfo * context, JnHelperMethod helperMethod)
285285
{
286+
AssertOrFailFast(helperMethod >= 0 && helperMethod < IR::JnHelperMethodCount);
286287
intptr_t address = GetHelperMethods()[static_cast<WORD>(helperMethod)];
287288
if (address == 0)
288289
{

‎lib/Common/ChakraCoreVersion.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
// ChakraCore version number definitions (used in ChakraCore binary metadata)
1818
#define CHAKRA_CORE_MAJOR_VERSION 1
1919
#define CHAKRA_CORE_MINOR_VERSION 10
20-
#define CHAKRA_CORE_PATCH_VERSION 0
20+
#define CHAKRA_CORE_PATCH_VERSION 1
2121
#define CHAKRA_CORE_VERSION_RELEASE_QFE 0 // Redundant with PATCH_VERSION. Keep this value set to 0.
2222

2323
// -------------

‎lib/JITServer/JITServer.cpp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -329,6 +329,11 @@ ServerAddDOMFastPathHelper(
329329
Assert(false);
330330
return RPC_S_INVALID_ARG;
331331
}
332+
if (helper < 0 || helper >= IR::JnHelperMethodCount)
333+
{
334+
Assert(UNREACHED);
335+
return E_ACCESSDENIED;
336+
}
332337

333338
return ServerCallWrapper(scriptContextInfo, [&]()->HRESULT
334339
{

‎lib/Parser/Parse.cpp

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6311,7 +6311,9 @@ void Parser::ParseFncName(ParseNodeFnc * pnodeFnc, ushort flags, IdentPtr* pFncN
63116311
pnodeFnc->pnodeName = nullptr;
63126312

63136313
if ((m_token.tk != tkID || flags & fFncNoName)
6314-
&& (IsStrictMode() || (pnodeFnc->IsGenerator()) || m_token.tk != tkYIELD || fDeclaration)) // Function expressions can have the name yield even inside generator functions
6314+
&& (IsStrictMode() || fDeclaration
6315+
|| pnodeFnc->IsGenerator() || pnodeFnc->IsAsync()
6316+
|| (m_token.tk != tkYIELD && m_token.tk != tkAWAIT))) // Function expressions can have the name yield/await even inside generator/async functions
63156317
{
63166318
if (fDeclaration ||
63176319
m_token.IsReservedWord()) // For example: var x = (function break(){});
@@ -6321,7 +6323,7 @@ void Parser::ParseFncName(ParseNodeFnc * pnodeFnc, ushort flags, IdentPtr* pFncN
63216323
return;
63226324
}
63236325

6324-
Assert(m_token.tk == tkID || (m_token.tk == tkYIELD && !fDeclaration));
6326+
Assert(m_token.tk == tkID || (m_token.tk == tkYIELD && !fDeclaration) || (m_token.tk == tkAWAIT && !fDeclaration));
63256327

63266328
if (IsStrictMode())
63276329
{
@@ -8461,15 +8463,17 @@ ParseNodePtr Parser::ParseExpr(int oplMin,
84618463
// binding operator, be it unary or binary.
84628464
Error(ERRsyntax);
84638465
}
8464-
if (m_currentScope->GetScopeType() == ScopeType_Parameter)
8466+
if (m_currentScope->GetScopeType() == ScopeType_Parameter
8467+
|| (m_currentScope->GetScopeType() == ScopeType_Block && m_currentScope->GetEnclosingScope()->GetScopeType() == ScopeType_Parameter)) // Check whether this is a class definition inside param scope
84658468
{
84668469
Error(ERRsyntax);
84678470
}
84688471
}
84698472
else if (nop == knopAwait)
84708473
{
84718474
if (!this->GetScanner()->AwaitIsKeywordRegion() ||
8472-
m_currentScope->GetScopeType() == ScopeType_Parameter)
8475+
m_currentScope->GetScopeType() == ScopeType_Parameter ||
8476+
(m_currentScope->GetScopeType() == ScopeType_Block && m_currentScope->GetEnclosingScope()->GetScopeType() == ScopeType_Parameter)) // Check whether this is a class definition inside param scope
84738477
{
84748478
// As with the 'yield' keyword, the case where 'await' is scanned as a keyword (tkAWAIT)
84758479
// but the scanner is not treating await as a keyword (!this->GetScanner()->AwaitIsKeyword())

‎lib/Runtime/Base/CrossSite.cpp

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -489,7 +489,12 @@ namespace Js
489489
{
490490
args.Values[i] = CrossSite::MarshalVar(targetScriptContext, args.Values[i]);
491491
}
492-
if (args.HasExtraArg())
492+
if (args.HasNewTarget())
493+
{
494+
// Last value is new.target
495+
args.Values[count] = CrossSite::MarshalVar(targetScriptContext, args.GetNewTarget());
496+
}
497+
else if (args.HasExtraArg())
493498
{
494499
// The final eval arg is a frame display that needs to be marshaled specially.
495500
args.Values[count] = CrossSite::MarshalFrameDisplay(targetScriptContext, args.GetFrameDisplay());

‎lib/Runtime/Base/ThreadServiceWrapperBase.cpp

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,13 @@ bool ThreadServiceWrapperBase::ScheduleIdleCollect(uint ticks, bool scheduleAsTa
7878

7979
bool ThreadServiceWrapperBase::IdleCollect()
8080
{
81+
// Tracking service does not AddRef/Release the thread service and only keeps a function pointer and context parameter (this pointer)
82+
// to execute the IdleCollect callback. It is possible that the tracking service gets destroyed as part of the collection
83+
// during this IdleCollect. If that happens then we need to make sure ThreadService (which may be owned by the tracking service)
84+
// is kept alive until this callback completes. Any pending timer is killed in the thread service destructor so we should not get
85+
// any new callbacks after the thread service is destroyed.
86+
AutoAddRefReleaseThreadService autoThreadServiceKeepAlive(this);
87+
8188
Assert(hasScheduledIdleCollect);
8289
IDLE_COLLECT_VERBOSE_TRACE(_u("IdleCollect- reset hasScheduledIdleCollect\n"));
8390
hasScheduledIdleCollect = false;

‎lib/Runtime/Base/ThreadServiceWrapperBase.h

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,29 @@ class ThreadServiceWrapperBase : public ThreadServiceWrapper
4141
virtual bool OnScheduleIdleCollect(uint delta, bool scheduleAsTask) = 0;
4242
virtual void OnFinishIdleCollect() = 0;
4343
virtual bool ShouldFinishConcurrentCollectOnIdleCallback() = 0;
44+
virtual void AddRefThreadService() { /* do nothing */ };
45+
virtual void ReleaseThreadService() { /* do nothing */ };
4446

4547
ThreadContext *GetThreadContext() { return threadContext; }
4648

4749
private:
50+
class AutoAddRefReleaseThreadService
51+
{
52+
public:
53+
AutoAddRefReleaseThreadService(ThreadServiceWrapperBase * threadService)
54+
{
55+
this->threadService = threadService;
56+
threadService->AddRefThreadService();
57+
}
58+
59+
~AutoAddRefReleaseThreadService()
60+
{
61+
threadService->ReleaseThreadService();
62+
}
63+
64+
ThreadServiceWrapperBase * threadService;
65+
};
66+
4867
static const unsigned int IdleTicks = 1000; // 1 second
4968
static const unsigned int IdleFinishTicks = 100; // 100 ms;
5069

0 commit comments

Comments
 (0)