Skip to content

Commit c325cf3

Browse files
leirocksleirocks
committed
[MERGE #5298 @leirocks] ChakraCore 2018-06 security updates
Merge pull request #5298 from leirocks:servicing/1806_1.8
2 parents 4314197 + 1b4f8dc commit c325cf3

File tree

5 files changed

+42
-17
lines changed

5 files changed

+42
-17
lines changed

‎Build/NuGet/.pack-version

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.8.4
1+
1.8.5

‎lib/Backend/Func.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -262,7 +262,7 @@ Func::Func(JitArenaAllocator *alloc, JITTimeWorkItem * workItem,
262262
ObjTypeSpecFldInfo * info = GetWorkItem()->GetJITTimeInfo()->GetObjTypeSpecFldInfo(i);
263263
if (info != nullptr)
264264
{
265-
Assert(info->GetObjTypeSpecFldId() < GetTopFunc()->GetWorkItem()->GetJITTimeInfo()->GetGlobalObjTypeSpecFldInfoCount());
265+
AssertOrFailFast(info->GetObjTypeSpecFldId() < GetTopFunc()->GetWorkItem()->GetJITTimeInfo()->GetGlobalObjTypeSpecFldInfoCount());
266266
GetTopFunc()->m_globalObjTypeSpecFldInfoArray[info->GetObjTypeSpecFldId()] = info;
267267
}
268268
}

‎lib/Backend/GlobOpt.cpp

Lines changed: 38 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -12746,6 +12746,8 @@ GlobOpt::DoTrackNewValueForKills(Value *const value)
1274612746
const bool isJsArray = valueInfo->IsArrayOrObjectWithArray();
1274712747
Assert(!isJsArray == valueInfo->IsOptimizedTypedArray());
1274812748

12749+
const bool isVirtualTypedArray = valueInfo->IsOptimizedVirtualTypedArray();
12750+
1274912751
Loop *implicitCallsLoop;
1275012752
if(currentBlock->next && !currentBlock->next->isDeleted && currentBlock->next->isLoopHeader)
1275112753
{
@@ -12760,7 +12762,7 @@ GlobOpt::DoTrackNewValueForKills(Value *const value)
1276012762
implicitCallsLoop = currentBlock->loop;
1276112763
}
1276212764

12763-
if(isJsArray)
12765+
if(isJsArray || isVirtualTypedArray)
1276412766
{
1276512767
if(!DoArrayCheckHoist(valueInfo->Type(), implicitCallsLoop))
1276612768
{
@@ -12779,7 +12781,7 @@ GlobOpt::DoTrackNewValueForKills(Value *const value)
1277912781
VerifyArrayValueInfoForTracking(valueInfo, isJsArray, currentBlock);
1278012782
#endif
1278112783

12782-
if(!isJsArray)
12784+
if(!isJsArray && !isVirtualTypedArray)
1278312785
{
1278412786
return;
1278512787
}
@@ -12815,11 +12817,13 @@ GlobOpt::DoTrackCopiedValueForKills(Value *const value)
1281512817
const bool isJsArray = valueInfo->IsArrayOrObjectWithArray();
1281612818
Assert(!isJsArray == valueInfo->IsOptimizedTypedArray());
1281712819

12820+
const bool isVirtualTypedArray = valueInfo->IsOptimizedVirtualTypedArray();
12821+
1281812822
#if DBG
1281912823
VerifyArrayValueInfoForTracking(valueInfo, isJsArray, currentBlock);
1282012824
#endif
1282112825

12822-
if(!isJsArray && !(valueInfo->IsArrayValueInfo() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym()))
12826+
if(!isJsArray && !isVirtualTypedArray && !(valueInfo->IsArrayValueInfo() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym()))
1282312827
{
1282412828
return;
1282512829
}
@@ -12862,11 +12866,13 @@ GlobOpt::DoTrackMergedValueForKills(
1286212866
const bool isJsArray = valueInfo->IsArrayOrObjectWithArray();
1286312867
Assert(!isJsArray == valueInfo->IsOptimizedTypedArray());
1286412868

12869+
const bool isVirtualTypedArray = valueInfo->IsOptimizedVirtualTypedArray();
12870+
1286512871
#if DBG
1286612872
VerifyArrayValueInfoForTracking(valueInfo, isJsArray, currentBlock, true);
1286712873
#endif
1286812874

12869-
if(!isJsArray && !(valueInfo->IsArrayValueInfo() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym()))
12875+
if(!isJsArray && !isVirtualTypedArray && !(valueInfo->IsArrayValueInfo() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym()))
1287012876
{
1287112877
return;
1287212878
}
@@ -12899,6 +12905,7 @@ GlobOpt::TrackValueInfoChangeForKills(BasicBlock *const block, Value *const valu
1289912905

1290012906
const bool trackOldValueInfo =
1290112907
oldValueInfo->IsArrayOrObjectWithArray() ||
12908+
oldValueInfo->IsOptimizedVirtualTypedArray() ||
1290212909
(
1290312910
oldValueInfo->IsOptimizedTypedArray() &&
1290412911
oldValueInfo->IsArrayValueInfo() &&
@@ -12915,6 +12922,7 @@ GlobOpt::TrackValueInfoChangeForKills(BasicBlock *const block, Value *const valu
1291512922

1291612923
const bool trackNewValueInfo =
1291712924
newValueInfo->IsArrayOrObjectWithArray() ||
12925+
newValueInfo->IsOptimizedVirtualTypedArray() ||
1291812926
(
1291912927
newValueInfo->IsOptimizedTypedArray() &&
1292012928
newValueInfo->IsArrayValueInfo() &&
@@ -12983,6 +12991,7 @@ GlobOpt::ProcessValueKills(IR::Instr *const instr)
1298312991
ValueInfo *const valueInfo = value->GetValueInfo();
1298412992
Assert(
1298512993
valueInfo->IsArrayOrObjectWithArray() ||
12994+
valueInfo->IsOptimizedVirtualTypedArray() ||
1298612995
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
1298712996
if (valueInfo->IsArrayOrObjectWithArray() || valueInfo->IsOptimizedVirtualTypedArray())
1298812997
{
@@ -13008,6 +13017,7 @@ GlobOpt::ProcessValueKills(IR::Instr *const instr)
1300813017
ValueInfo *const valueInfo = value->GetValueInfo();
1300913018
Assert(
1301013019
valueInfo->IsArrayOrObjectWithArray() ||
13020+
valueInfo->IsOptimizedVirtualTypedArray() ||
1301113021
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
1301213022
if(!valueInfo->IsArrayOrObjectWithArray() || !valueInfo->HasNoMissingValues())
1301313023
{
@@ -13028,6 +13038,7 @@ GlobOpt::ProcessValueKills(IR::Instr *const instr)
1302813038
ValueInfo *const valueInfo = value->GetValueInfo();
1302913039
Assert(
1303013040
valueInfo->IsArrayOrObjectWithArray() ||
13041+
valueInfo->IsOptimizedVirtualTypedArray() ||
1303113042
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
1303213043
if(!valueInfo->IsArrayOrObjectWithArray() || valueInfo->HasVarElements())
1303313044
{
@@ -13054,6 +13065,7 @@ GlobOpt::ProcessValueKills(IR::Instr *const instr)
1305413065
ValueInfo *valueInfo = value->GetValueInfo();
1305513066
Assert(
1305613067
valueInfo->IsArrayOrObjectWithArray() ||
13068+
valueInfo->IsOptimizedVirtualTypedArray() ||
1305713069
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
1305813070
if(!valueInfo->IsArrayOrObjectWithArray())
1305913071
{
@@ -13129,8 +13141,9 @@ GlobOpt::ProcessValueKills(BasicBlock *const block, GlobOptBlockData *const bloc
1312913141
ValueInfo *const valueInfo = value->GetValueInfo();
1313013142
Assert(
1313113143
valueInfo->IsArrayOrObjectWithArray() ||
13144+
valueInfo->IsOptimizedVirtualTypedArray() ||
1313213145
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
13133-
if(valueInfo->IsArrayOrObjectWithArray())
13146+
if(valueInfo->IsArrayOrObjectWithArray() || valueInfo->IsOptimizedVirtualTypedArray())
1313413147
{
1313513148
ChangeValueType(nullptr, value, valueInfo->Type().ToLikely(), false);
1313613149
continue;
@@ -13163,18 +13176,21 @@ GlobOpt::ProcessValueKillsForLoopHeaderAfterBackEdgeMerge(BasicBlock *const bloc
1316313176
ValueInfo *valueInfo = value->GetValueInfo();
1316413177
Assert(
1316513178
valueInfo->IsArrayOrObjectWithArray() ||
13179+
valueInfo->IsOptimizedVirtualTypedArray() ||
1316613180
valueInfo->IsOptimizedTypedArray() && valueInfo->AsArrayValueInfo()->HeadSegmentLengthSym());
1316713181

1316813182
const bool isJsArray = valueInfo->IsArrayOrObjectWithArray();
1316913183
Assert(!isJsArray == valueInfo->IsOptimizedTypedArray());
1317013184

13171-
if(isJsArray ? loopKills.KillsValueType(valueInfo->Type()) : loopKills.KillsTypedArrayHeadSegmentLengths())
13185+
const bool isVirtualTypedArray = valueInfo->IsOptimizedVirtualTypedArray();
13186+
13187+
if((isJsArray || isVirtualTypedArray) ? loopKills.KillsValueType(valueInfo->Type()) : loopKills.KillsTypedArrayHeadSegmentLengths())
1317213188
{
1317313189
// Hoisting array checks and other related things for this type is disabled for the loop due to the kill, as
1317413190
// compensation code is currently not added on back-edges. When merging values from a back-edge, the array value
1317513191
// type cannot be definite, as that may require adding compensation code on the back-edge if the optimization pass
1317613192
// chooses to not optimize the array.
13177-
if(isJsArray)
13193+
if(isJsArray || isVirtualTypedArray)
1317813194
{
1317913195
ChangeValueType(nullptr, value, valueInfo->Type().ToLikely(), false);
1318013196
}
@@ -16452,14 +16468,16 @@ void
1645216468
GlobOpt::OptHoistUpdateValueType(
1645316469
Loop* loop,
1645416470
IR::Instr* instr,
16455-
IR::Opnd* srcOpnd,
16471+
IR::Opnd** srcOpndPtr /* All code paths that change src, should update srcOpndPtr*/,
1645616472
Value* opndVal)
1645716473
{
16458-
if (opndVal == nullptr || instr->m_opcode == Js::OpCode::FromVar)
16474+
if (opndVal == nullptr || instr->m_opcode == Js::OpCode::FromVar || srcOpndPtr == nullptr || *srcOpndPtr == nullptr)
1645916475
{
1646016476
return;
1646116477
}
1646216478

16479+
IR::Opnd* srcOpnd = *srcOpndPtr;
16480+
1646316481
Sym* opndSym = srcOpnd->GetSym();;
1646416482

1646516483
if (opndSym)
@@ -16472,8 +16490,11 @@ GlobOpt::OptHoistUpdateValueType(
1647216490

1647316491
if (srcOpnd->GetValueType() != opndValueTypeInLandingPad)
1647416492
{
16493+
srcOpnd->SetValueType(opndValueTypeInLandingPad);
16494+
1647516495
if (instr->m_opcode == Js::OpCode::SetConcatStrMultiItemBE)
1647616496
{
16497+
Assert(!opndSym->IsPropertySym());
1647716498
Assert(!opndValueTypeInLandingPad.IsString());
1647816499
Assert(instr->GetDst());
1647916500

@@ -16484,6 +16505,9 @@ GlobOpt::OptHoistUpdateValueType(
1648416505
IR::Instr::New(Js::OpCode::Conv_PrimStr, strOpnd, srcOpnd->Use(instr->m_func), instr->m_func);
1648516506
instr->ReplaceSrc(srcOpnd, strOpnd);
1648616507

16508+
// Replace above will free srcOpnd, so reassign it
16509+
*srcOpndPtr = srcOpnd = reinterpret_cast<IR::Opnd *>(strOpnd);
16510+
1648716511
if (loop->bailOutInfo->bailOutInstr)
1648816512
{
1648916513
loop->bailOutInfo->bailOutInstr->InsertBefore(convPrimStrInstr);
@@ -16492,9 +16516,10 @@ GlobOpt::OptHoistUpdateValueType(
1649216516
{
1649316517
landingPad->InsertAfter(convPrimStrInstr);
1649416518
}
16495-
}
1649616519

16497-
srcOpnd->SetValueType(opndValueTypeInLandingPad);
16520+
// If we came here opndSym can't be PropertySym
16521+
return;
16522+
}
1649816523
}
1649916524

1650016525

@@ -16528,7 +16553,7 @@ GlobOpt::OptHoistInvariant(
1652816553
if (src1)
1652916554
{
1653016555
// We are hoisting this instruction possibly past other uses, which might invalidate the last use info. Clear it.
16531-
OptHoistUpdateValueType(loop, instr, src1, src1Val);
16556+
OptHoistUpdateValueType(loop, instr, &src1, src1Val);
1653216557

1653316558
if (src1->IsRegOpnd())
1653416559
{
@@ -16538,7 +16563,7 @@ GlobOpt::OptHoistInvariant(
1653816563
IR::Opnd* src2 = instr->GetSrc2();
1653916564
if (src2)
1654016565
{
16541-
OptHoistUpdateValueType(loop, instr, src2, src2Val);
16566+
OptHoistUpdateValueType(loop, instr, &src2, src2Val);
1654216567

1654316568
if (src2->IsRegOpnd())
1654416569
{

‎lib/Backend/GlobOpt.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -758,7 +758,7 @@ class GlobOpt
758758
bool TryHoistInvariant(IR::Instr *instr, BasicBlock *block, Value *dstVal, Value *src1Val, Value *src2Val, bool isNotTypeSpecConv,
759759
const bool lossy = false, const bool forceInvariantHoisting = false, IR::BailOutKind bailoutKind = IR::BailOutInvalid);
760760
void HoistInvariantValueInfo(ValueInfo *const invariantValueInfoToHoist, Value *const valueToUpdate, BasicBlock *const targetBlock);
761-
void OptHoistUpdateValueType(Loop* loop, IR::Instr* instr, IR::Opnd* srcOpnd, Value *const srcVal);
761+
void OptHoistUpdateValueType(Loop* loop, IR::Instr* instr, IR::Opnd** srcOpndPtr, Value *const srcVal);
762762
public:
763763
static bool IsTypeSpecPhaseOff(Func const * func);
764764
static bool DoAggressiveIntTypeSpec(Func const * func);

‎lib/Common/ChakraCoreVersion.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
// ChakraCore version number definitions (used in ChakraCore binary metadata)
1818
#define CHAKRA_CORE_MAJOR_VERSION 1
1919
#define CHAKRA_CORE_MINOR_VERSION 8
20-
#define CHAKRA_CORE_PATCH_VERSION 4
20+
#define CHAKRA_CORE_PATCH_VERSION 5
2121
#define CHAKRA_CORE_VERSION_RELEASE_QFE 0 // Redundant with PATCH_VERSION. Keep this value set to 0.
2222

2323
// -------------

0 commit comments

Comments
 (0)