Skip to content

Commit 75162b7

Browse files
atulkattiatulkatti
committed
[MERGE #6196 @atulkatti] ChakraCore servicing update for July, 2019
Merge pull request #6196 from atulkatti:servicing/1907 This release addresses the following issues: CVE-2019-1001 CVE-2019-1062 CVE-2019-1092 CVE-2019-1103 CVE-2019-1106 CVE-2019-1107
2 parents ba1f445 + 12c31f0 commit 75162b7

16 files changed

+81
-27
lines changed

‎Build/NuGet/.pack-version

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.11.10
1+
1.11.11

‎lib/Backend/BackwardPass.cpp

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4151,13 +4151,17 @@ BackwardPass::UpdateImplicitCallBailOutKind(IR::Instr *const instr, bool needsBa
41514151

41524152
IR::BailOutKind implicitCallBailOutKind = needsBailOutOnImplicitCall ? IR::BailOutOnImplicitCalls : IR::BailOutInvalid;
41534153

4154-
const IR::BailOutKind instrBailOutKind = instr->GetBailOutKind();
4154+
IR::BailOutKind instrBailOutKind = instr->GetBailOutKind();
41554155
if (instrBailOutKind & IR::BailOutMarkTempObject)
41564156
{
4157-
// Don't remove the implicit call pre op bailout for mark temp object
41584157
// Remove the mark temp object bit, as we don't need it after the dead store pass
4159-
instr->SetBailOutKind(instrBailOutKind & ~IR::BailOutMarkTempObject);
4160-
return true;
4158+
instrBailOutKind &= ~IR::BailOutMarkTempObject;
4159+
instr->SetBailOutKind(instrBailOutKind);
4160+
4161+
if (!instr->GetBailOutInfo()->canDeadStore)
4162+
{
4163+
return true;
4164+
}
41614165
}
41624166

41634167
const IR::BailOutKind instrImplicitCallBailOutKind = instrBailOutKind & ~IR::BailOutKindBits;

‎lib/Backend/BailOut.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ class BailOutInfo
2727
BailOutInfo(uint32 bailOutOffset, Func* bailOutFunc) :
2828
bailOutOffset(bailOutOffset), bailOutFunc(bailOutFunc),
2929
byteCodeUpwardExposedUsed(nullptr), polymorphicCacheIndex((uint)-1), startCallCount(0), startCallInfo(nullptr), bailOutInstr(nullptr),
30-
totalOutParamCount(0), argOutSyms(nullptr), bailOutRecord(nullptr), wasCloned(false), isInvertedBranch(false), sharedBailOutKind(true), isLoopTopBailOutInfo(false),
30+
totalOutParamCount(0), argOutSyms(nullptr), bailOutRecord(nullptr), wasCloned(false), isInvertedBranch(false), sharedBailOutKind(true), isLoopTopBailOutInfo(false), canDeadStore(true),
3131
outParamInlinedArgSlot(nullptr), liveVarSyms(nullptr), liveLosslessInt32Syms(nullptr), liveFloat64Syms(nullptr),
3232
branchConditionOpnd(nullptr),
3333
stackLiteralBailOutInfoCount(0), stackLiteralBailOutInfo(nullptr)
@@ -69,6 +69,7 @@ class BailOutInfo
6969
#endif
7070
bool wasCloned;
7171
bool isInvertedBranch;
72+
bool canDeadStore;
7273
bool sharedBailOutKind;
7374
bool isLoopTopBailOutInfo;
7475

‎lib/Backend/Func.cpp

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,6 +345,9 @@ Func::Codegen(JitArenaAllocator *alloc, JITTimeWorkItem * workItem,
345345
case RejitReason::TrackIntOverflowDisabled:
346346
outputData->disableTrackCompoundedIntOverflow = TRUE;
347347
break;
348+
case RejitReason::MemOpDisabled:
349+
outputData->disableMemOp = TRUE;
350+
break;
348351
default:
349352
Assume(UNREACHED);
350353
}
@@ -1124,6 +1127,12 @@ Func::IsTrackCompoundedIntOverflowDisabled() const
11241127
return (HasProfileInfo() && GetReadOnlyProfileInfo()->IsTrackCompoundedIntOverflowDisabled()) || m_output.IsTrackCompoundedIntOverflowDisabled();
11251128
}
11261129

1130+
bool
1131+
Func::IsMemOpDisabled() const
1132+
{
1133+
return (HasProfileInfo() && GetReadOnlyProfileInfo()->IsMemOpDisabled()) || m_output.IsMemOpDisabled();
1134+
}
1135+
11271136
bool
11281137
Func::IsArrayCheckHoistDisabled() const
11291138
{

‎lib/Backend/Func.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -995,6 +995,7 @@ static const unsigned __int64 c_debugFillPattern8 = 0xcececececececece;
995995
void SetScopeObjSym(StackSym * sym);
996996
StackSym * GetScopeObjSym();
997997
bool IsTrackCompoundedIntOverflowDisabled() const;
998+
bool IsMemOpDisabled() const;
998999
bool IsArrayCheckHoistDisabled() const;
9991000
bool IsStackArgOptDisabled() const;
10001001
bool IsSwitchOptDisabled() const;

‎lib/Backend/GlobOpt.cpp

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2624,7 +2624,7 @@ GlobOpt::OptInstr(IR::Instr *&instr, bool* isInstrRemoved)
26242624
!(instr->IsJitProfilingInstr()) &&
26252625
this->currentBlock->loop && !IsLoopPrePass() &&
26262626
!func->IsJitInDebugMode() &&
2627-
(func->HasProfileInfo() && !func->GetReadOnlyProfileInfo()->IsMemOpDisabled()) &&
2627+
!func->IsMemOpDisabled() &&
26282628
this->currentBlock->loop->doMemOp)
26292629
{
26302630
CollectMemOpInfo(instrPrev, instr, src1Val, src2Val);
@@ -16531,6 +16531,7 @@ GlobOpt::GenerateBailOutMarkTempObjectIfNeeded(IR::Instr * instr, IR::Opnd * opn
1653116531
if (instr->HasBailOutInfo())
1653216532
{
1653316533
instr->SetBailOutKind(instr->GetBailOutKind() | IR::BailOutMarkTempObject);
16534+
instr->GetBailOutInfo()->canDeadStore = false;
1653416535
}
1653516536
else
1653616537
{
@@ -16540,6 +16541,11 @@ GlobOpt::GenerateBailOutMarkTempObjectIfNeeded(IR::Instr * instr, IR::Opnd * opn
1654016541
|| (instr->m_opcode == Js::OpCode::FromVar && !opnd->GetValueType().IsPrimitive())
1654116542
|| propertySymOpnd == nullptr
1654216543
|| !propertySymOpnd->IsTypeCheckProtected())
16544+
{
16545+
this->GenerateBailAtOperation(&instr, IR::BailOutMarkTempObject);
16546+
instr->GetBailOutInfo()->canDeadStore = false;
16547+
}
16548+
else if (propertySymOpnd->MayHaveImplicitCall())
1654316549
{
1654416550
this->GenerateBailAtOperation(&instr, IR::BailOutMarkTempObject);
1654516551
}
@@ -16680,7 +16686,14 @@ GlobOpt::GenerateInductionVariableChangeForMemOp(Loop *loop, byte unroll, IR::In
1668016686
}
1668116687
else
1668216688
{
16683-
uint size = (loopCount->LoopCountMinusOneConstantValue() + 1) * unroll;
16689+
int32 loopCountMinusOnePlusOne;
16690+
int32 size;
16691+
if (Int32Math::Add(loopCount->LoopCountMinusOneConstantValue(), 1, &loopCountMinusOnePlusOne) ||
16692+
Int32Math::Mul(loopCountMinusOnePlusOne, unroll, &size))
16693+
{
16694+
throw Js::RejitException(RejitReason::MemOpDisabled);
16695+
}
16696+
Assert(size > 0);
1668416697
sizeOpnd = IR::IntConstOpnd::New(size, IRType::TyUint32, localFunc);
1668516698
}
1668616699
loop->memOpInfo->inductionVariableOpndPerUnrollMap->Add(unroll, sizeOpnd);

‎lib/Backend/GlobOptBlockData.cpp

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -974,7 +974,8 @@ GlobOptBlockData::MergeValueInfo(
974974
fromDataValueInfo->AsArrayValueInfo(),
975975
fromDataSym,
976976
symsRequiringCompensation,
977-
symsCreatedForMerge);
977+
symsCreatedForMerge,
978+
isLoopBackEdge);
978979
}
979980

980981
// Consider: If both values are VarConstantValueInfo with the same value, we could
@@ -1072,7 +1073,8 @@ ValueInfo *GlobOptBlockData::MergeArrayValueInfo(
10721073
const ArrayValueInfo *const fromDataValueInfo,
10731074
Sym *const arraySym,
10741075
BVSparse<JitArenaAllocator> *const symsRequiringCompensation,
1075-
BVSparse<JitArenaAllocator> *const symsCreatedForMerge)
1076+
BVSparse<JitArenaAllocator> *const symsCreatedForMerge,
1077+
bool isLoopBackEdge)
10761078
{
10771079
Assert(mergedValueType.IsAnyOptimizedArray());
10781080
Assert(toDataValueInfo);
@@ -1095,7 +1097,7 @@ ValueInfo *GlobOptBlockData::MergeArrayValueInfo(
10951097
}
10961098
else
10971099
{
1098-
if (!this->globOpt->IsLoopPrePass())
1100+
if (!this->globOpt->IsLoopPrePass() && !isLoopBackEdge)
10991101
{
11001102
// Adding compensation code in the prepass won't help, as the symstores would again be different in the main pass.
11011103
Assert(symsRequiringCompensation);
@@ -1123,7 +1125,7 @@ ValueInfo *GlobOptBlockData::MergeArrayValueInfo(
11231125
}
11241126
else
11251127
{
1126-
if (!this->globOpt->IsLoopPrePass())
1128+
if (!this->globOpt->IsLoopPrePass() && !isLoopBackEdge)
11271129
{
11281130
Assert(symsRequiringCompensation);
11291131
symsRequiringCompensation->Set(arraySym->m_id);
@@ -1150,7 +1152,7 @@ ValueInfo *GlobOptBlockData::MergeArrayValueInfo(
11501152
}
11511153
else
11521154
{
1153-
if (!this->globOpt->IsLoopPrePass())
1155+
if (!this->globOpt->IsLoopPrePass() && !isLoopBackEdge)
11541156
{
11551157
Assert(symsRequiringCompensation);
11561158
symsRequiringCompensation->Set(arraySym->m_id);

‎lib/Backend/GlobOptBlockData.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ class GlobOptBlockData
264264
Value * MergeValues(Value *toDataValue, Value *fromDataValue, Sym *fromDataSym, bool isLoopBackEdge, BVSparse<JitArenaAllocator> *const symsRequiringCompensation, BVSparse<JitArenaAllocator> *const symsCreatedForMerge);
265265
ValueInfo * MergeValueInfo(Value *toDataVal, Value *fromDataVal, Sym *fromDataSym, bool isLoopBackEdge, bool sameValueNumber, BVSparse<JitArenaAllocator> *const symsRequiringCompensation, BVSparse<JitArenaAllocator> *const symsCreatedForMerge);
266266
JsTypeValueInfo * MergeJsTypeValueInfo(JsTypeValueInfo * toValueInfo, JsTypeValueInfo * fromValueInfo, bool isLoopBackEdge, bool sameValueNumber);
267-
ValueInfo * MergeArrayValueInfo(const ValueType mergedValueType, const ArrayValueInfo *const toDataValueInfo, const ArrayValueInfo *const fromDataValueInfo, Sym *const arraySym, BVSparse<JitArenaAllocator> *const symsRequiringCompensation, BVSparse<JitArenaAllocator> *const symsCreatedForMerge);
267+
ValueInfo * MergeArrayValueInfo(const ValueType mergedValueType, const ArrayValueInfo *const toDataValueInfo, const ArrayValueInfo *const fromDataValueInfo, Sym *const arraySym, BVSparse<JitArenaAllocator> *const symsRequiringCompensation, BVSparse<JitArenaAllocator> *const symsCreatedForMerge, bool isLoopBackEdge);
268268

269269
// Argument Tracking
270270
public:

‎lib/Backend/GlobOptFields.cpp

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -410,6 +410,14 @@ GlobOpt::ProcessFieldKills(IR::Instr *instr, BVSparse<JitArenaAllocator> *bv, bo
410410
if (inGlobOpt)
411411
{
412412
KillObjectHeaderInlinedTypeSyms(this->currentBlock, false);
413+
if (this->objectTypeSyms)
414+
{
415+
if (this->currentBlock->globOptData.maybeWrittenTypeSyms == nullptr)
416+
{
417+
this->currentBlock->globOptData.maybeWrittenTypeSyms = JitAnew(this->alloc, BVSparse<JitArenaAllocator>, this->alloc);
418+
}
419+
this->currentBlock->globOptData.maybeWrittenTypeSyms->Or(this->objectTypeSyms);
420+
}
413421
}
414422

415423
// fall through

‎lib/Backend/JITOutput.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,12 @@ JITOutput::IsTrackCompoundedIntOverflowDisabled() const
6565
return m_outputData->disableTrackCompoundedIntOverflow != FALSE;
6666
}
6767

68+
bool
69+
JITOutput::IsMemOpDisabled() const
70+
{
71+
return m_outputData->disableMemOp != FALSE;
72+
}
73+
6874
bool
6975
JITOutput::IsArrayCheckHoistDisabled() const
7076
{

0 commit comments

Comments
 (0)