Diff
Modified: trunk/JSTests/ChangeLog (243924 => 243925)
--- trunk/JSTests/ChangeLog 2019-04-05 01:45:12 UTC (rev 243924)
+++ trunk/JSTests/ChangeLog 2019-04-05 04:17:44 UTC (rev 243925)
@@ -1,3 +1,15 @@
+2019-04-04 Yusuke Suzuki <[email protected]>
+
+ [JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
+ https://bugs.webkit.org/show_bug.cgi?id=196631
+
+ Reviewed by Saam Barati.
+
+ * stress/make-bound-function-should-not-assume-int32-length.js: Added.
+ (assert):
+ (test):
+ (foo):
+
2019-04-04 Saam Barati <[email protected]>
Unreviewed. Make the test from r243906 catch the thrown exceptions.
Added: trunk/JSTests/stress/make-bound-function-should-not-assume-int32-length.js (0 => 243925)
--- trunk/JSTests/stress/make-bound-function-should-not-assume-int32-length.js (rev 0)
+++ trunk/JSTests/stress/make-bound-function-should-not-assume-int32-length.js 2019-04-05 04:17:44 UTC (rev 243925)
@@ -0,0 +1,18 @@
+//@ runDefault("--useDoublePredictionFuzzerAgent=1", "--useConcurrentJIT=0")
+// This test should not crash.
+function assert(b) {
+ if (!b)
+ throw new Error("Bad")
+}
+noInline(assert);
+
+function test(f, v, c, d) {
+ return f.bind(v, c, d);
+}
+
+function foo(a,b,c,d,e,f) { return this; }
+let thisValue = {};
+for (let i = 0; i < 10000; i++) {
+ let f = test(foo, thisValue, 20, 30);
+ assert(f(foo, thisValue, 20, 30) === thisValue);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (243924 => 243925)
--- trunk/Source/_javascript_Core/ChangeLog 2019-04-05 01:45:12 UTC (rev 243924)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-04-05 04:17:44 UTC (rev 243925)
@@ -1,3 +1,27 @@
+2019-04-04 Yusuke Suzuki <[email protected]>
+
+ [JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
+ https://bugs.webkit.org/show_bug.cgi?id=196631
+
+ Reviewed by Saam Barati.
+
+ makeBoundFunction assumes that "length" argument is always Int32. But this should not be done since this "length" value is calculated in builtin JS code.
+ DFG may store this value in Double format so that we should not rely on that this value is Int32. This patch fixes makeBoundFunction function to perform
+ toInt32 operation. We also insert a missing exception check for `JSString::value(ExecState*)` in makeBoundFunction.
+
+ * _javascript_Core.xcodeproj/project.pbxproj:
+ * Sources.txt:
+ * interpreter/CallFrameInlines.h:
+ * runtime/DoublePredictionFuzzerAgent.cpp: Copied from Source/_javascript_Core/interpreter/CallFrameInlines.h.
+ (JSC::DoublePredictionFuzzerAgent::DoublePredictionFuzzerAgent):
+ (JSC::DoublePredictionFuzzerAgent::getPrediction):
+ * runtime/DoublePredictionFuzzerAgent.h: Copied from Source/_javascript_Core/interpreter/CallFrameInlines.h.
+ * runtime/JSGlobalObject.cpp:
+ (JSC::makeBoundFunction):
+ * runtime/Options.h:
+ * runtime/VM.cpp:
+ (JSC::VM::VM):
+
2019-04-04 Robin Morisset <[email protected]>
B3ReduceStrength should know that Mul distributes over Add and Sub
Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (243924 => 243925)
--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2019-04-05 01:45:12 UTC (rev 243924)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2019-04-05 04:17:44 UTC (rev 243925)
@@ -4793,6 +4793,8 @@
E3F23A7C1ECF13E500978D99 /* SnippetParams.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SnippetParams.h; sourceTree = "<group>"; };
E3F23A7D1ECF13E500978D99 /* SnippetReg.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SnippetReg.h; sourceTree = "<group>"; };
E3F23A7E1ECF13E500978D99 /* SnippetSlowPathCalls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SnippetSlowPathCalls.h; sourceTree = "<group>"; };
+ E3FC25102256ECF400583518 /* DoublePredictionFuzzerAgent.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = DoublePredictionFuzzerAgent.cpp; sourceTree = "<group>"; };
+ E3FC25112256ECF400583518 /* DoublePredictionFuzzerAgent.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = DoublePredictionFuzzerAgent.h; sourceTree = "<group>"; };
E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITGetterSetter.h; sourceTree = "<group>"; };
E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCacheItem.h; sourceTree = "<group>"; };
E49DC15112EF272200184A1F /* SourceProviderCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCache.h; sourceTree = "<group>"; };
@@ -6772,6 +6774,8 @@
E31618101EC5FE080006A218 /* DOMAnnotation.h */,
E31618111EC5FE080006A218 /* DOMAttributeGetterSetter.cpp */,
E31618121EC5FE080006A218 /* DOMAttributeGetterSetter.h */,
+ E3FC25102256ECF400583518 /* DoublePredictionFuzzerAgent.cpp */,
+ E3FC25112256ECF400583518 /* DoublePredictionFuzzerAgent.h */,
A70447EB17A0BD7000F5898E /* DumpContext.cpp */,
A70447EC17A0BD7000F5898E /* DumpContext.h */,
FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */,
@@ -8305,10 +8309,10 @@
AD2FCBB31DB58DA400B3E736 /* WebAssemblyCompileErrorPrototype.h */,
AD4937C91DDD27340077C807 /* WebAssemblyFunction.cpp */,
AD4937CA1DDD27340077C807 /* WebAssemblyFunction.h */,
+ 521322431ECBCE8200F65615 /* WebAssemblyFunctionBase.cpp */,
+ 521322441ECBCE8200F65615 /* WebAssemblyFunctionBase.h */,
523FD88D225566C4003B3DCC /* WebAssemblyFunctionHeapCellType.cpp */,
523FD88C225566C3003B3DCC /* WebAssemblyFunctionHeapCellType.h */,
- 521322431ECBCE8200F65615 /* WebAssemblyFunctionBase.cpp */,
- 521322441ECBCE8200F65615 /* WebAssemblyFunctionBase.h */,
AD2FCBB41DB58DA400B3E736 /* WebAssemblyInstanceConstructor.cpp */,
AD2FCBB51DB58DA400B3E736 /* WebAssemblyInstanceConstructor.h */,
AD2FCBB61DB58DA400B3E736 /* WebAssemblyInstancePrototype.cpp */,
@@ -8611,6 +8615,7 @@
0F6B8AD91C4EDDA200969052 /* B3DuplicateTails.h in Headers */,
0FEC85C11BE167A00080FF74 /* B3Effects.h in Headers */,
0F725CA81C503DED00AD943A /* B3EliminateCommonSubexpressions.h in Headers */,
+ 3395C70722555F6D00BDBFAD /* B3EliminateDeadCode.h in Headers */,
0F5BF1711F23A5A10029D91D /* B3EnsureLoopPreHeaders.h in Headers */,
0F6971EA1D92F42400BA02A5 /* B3FenceValue.h in Headers */,
0F6B8AE51C4EFE1700969052 /* B3FixSSA.h in Headers */,
@@ -8624,7 +8629,6 @@
0F5BF1641F2317120029D91D /* B3HoistLoopInvariantValues.h in Headers */,
DC69B99D1D15F914002E3C00 /* B3InferSwitches.h in Headers */,
0FEC85BA1BE1462F0080FF74 /* B3InsertionSet.h in Headers */,
- 523FD88E225566C9003B3DCC /* WebAssemblyFunctionHeapCellType.h in Headers */,
0FEC85BB1BE1462F0080FF74 /* B3InsertionSetInlines.h in Headers */,
0FDF67D21D9C6D27001B9825 /* B3Kind.h in Headers */,
436E54531C468E7400B5AF73 /* B3LegalizeMemoryOffsets.h in Headers */,
@@ -8817,7 +8821,6 @@
473DA4A4764C45FE871B0485 /* DefinePropertyAttributes.h in Headers */,
0FBB73BB1DEF8645002C009E /* DeleteAllCodeEffort.h in Headers */,
0F96303C1D4192CD005609D9 /* DestructionMode.h in Headers */,
- 527CE35422555FE500C6F382 /* JSToWasmICCallee.h in Headers */,
A77A423E17A0BBFD00A8DB81 /* DFGAbstractHeap.h in Headers */,
A704D90317A0BAA8006BA554 /* DFGAbstractInterpreter.h in Headers */,
0F5E0FD8207C72730097F0DE /* DFGAbstractInterpreterClobberState.h in Headers */,
@@ -9091,7 +9094,6 @@
0F48532A187DFDEC0083B687 /* FTLRecoveryOpcode.h in Headers */,
0FCEFAAC1804C13E00472CE4 /* FTLSaveRestore.h in Headers */,
0F25F1B2181635F300522F39 /* FTLSlowPathCall.h in Headers */,
- 3395C70722555F6D00BDBFAD /* B3EliminateDeadCode.h in Headers */,
0F25F1B4181635F300522F39 /* FTLSlowPathCallKey.h in Headers */,
E322E5A71DA644A8006E7709 /* FTLSnippetParams.h in Headers */,
0F235BD717178E1C00690C7F /* FTLStackmapArgumentList.h in Headers */,
@@ -9460,6 +9462,7 @@
0F919D0D157EE0A2004A4E7D /* JSSymbolTableObject.h in Headers */,
70ECA6061AFDBEA200449739 /* JSTemplateObjectDescriptor.h in Headers */,
AD5C36EA1F75AD6A000BCAAF /* JSToWasm.h in Headers */,
+ 527CE35422555FE500C6F382 /* JSToWasmICCallee.h in Headers */,
BC18C42A0E16F5CD00B34460 /* JSType.h in Headers */,
53486BB71C1795C300F6F3AF /* JSTypedArray.h in Headers */,
0F2B66FB17B6B5AB00A7AE3F /* JSTypedArrayConstructors.h in Headers */,
@@ -9936,6 +9939,7 @@
AD2FCC171DB59CB200B3E736 /* WebAssemblyCompileErrorPrototype.lut.h in Headers */,
AD4937D41DDD27DE0077C807 /* WebAssemblyFunction.h in Headers */,
521322461ECBCE8200F65615 /* WebAssemblyFunctionBase.h in Headers */,
+ 523FD88E225566C9003B3DCC /* WebAssemblyFunctionHeapCellType.h in Headers */,
AD2FCBF11DB58DAD00B3E736 /* WebAssemblyInstanceConstructor.h in Headers */,
AD2FCC181DB59CB200B3E736 /* WebAssemblyInstanceConstructor.lut.h in Headers */,
AD2FCBF31DB58DAD00B3E736 /* WebAssemblyInstancePrototype.h in Headers */,
Modified: trunk/Source/_javascript_Core/Sources.txt (243924 => 243925)
--- trunk/Source/_javascript_Core/Sources.txt 2019-04-05 01:45:12 UTC (rev 243924)
+++ trunk/Source/_javascript_Core/Sources.txt 2019-04-05 04:17:44 UTC (rev 243925)
@@ -745,6 +745,7 @@
runtime/DirectArgumentsOffset.cpp
runtime/DirectEvalExecutable.cpp
runtime/DisallowVMReentry.cpp
+runtime/DoublePredictionFuzzerAgent.cpp
runtime/DumpContext.cpp
runtime/ECMAScriptSpecInternalFunctions.cpp
runtime/Error.cpp
Modified: trunk/Source/_javascript_Core/interpreter/CallFrameInlines.h (243924 => 243925)
--- trunk/Source/_javascript_Core/interpreter/CallFrameInlines.h 2019-04-05 01:45:12 UTC (rev 243924)
+++ trunk/Source/_javascript_Core/interpreter/CallFrameInlines.h 2019-04-05 04:17:44 UTC (rev 243925)
@@ -26,6 +26,8 @@
#pragma once
#include "CallFrame.h"
+#include "JSCallee.h"
+#include "JSGlobalObject.h"
namespace JSC {
Copied: trunk/Source/_javascript_Core/runtime/DoublePredictionFuzzerAgent.cpp (from rev 243924, trunk/Source/_javascript_Core/interpreter/CallFrameInlines.h) (0 => 243925)
--- trunk/Source/_javascript_Core/runtime/DoublePredictionFuzzerAgent.cpp (rev 0)
+++ trunk/Source/_javascript_Core/runtime/DoublePredictionFuzzerAgent.cpp 2019-04-05 04:17:44 UTC (rev 243925)
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DoublePredictionFuzzerAgent.h"
+
+namespace JSC {
+
+DoublePredictionFuzzerAgent::DoublePredictionFuzzerAgent(VM&)
+{
+}
+
+SpeculatedType DoublePredictionFuzzerAgent::getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType original)
+{
+ if (original && mergeSpeculations(original, SpecBytecodeNumber) == SpecBytecodeNumber)
+ return SpecBytecodeDouble;
+ return original;
+}
+
+} // namespace JSC
Copied: trunk/Source/_javascript_Core/runtime/DoublePredictionFuzzerAgent.h (from rev 243924, trunk/Source/_javascript_Core/interpreter/CallFrameInlines.h) (0 => 243925)
--- trunk/Source/_javascript_Core/runtime/DoublePredictionFuzzerAgent.h (rev 0)
+++ trunk/Source/_javascript_Core/runtime/DoublePredictionFuzzerAgent.h 2019-04-05 04:17:44 UTC (rev 243925)
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "FuzzerAgent.h"
+
+namespace JSC {
+
+class VM;
+
+class DoublePredictionFuzzerAgent final : public FuzzerAgent {
+public:
+ DoublePredictionFuzzerAgent(VM&);
+
+ SpeculatedType getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType) override;
+};
+
+} // namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp (243924 => 243925)
--- trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp 2019-04-05 01:45:12 UTC (rev 243924)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp 2019-04-05 04:17:44 UTC (rev 243925)
@@ -238,16 +238,26 @@
static EncodedJSValue JSC_HOST_CALL makeBoundFunction(ExecState* exec)
{
VM& vm = exec->vm();
+ auto scope = DECLARE_THROW_SCOPE(vm);
+
JSGlobalObject* globalObject = exec->lexicalGlobalObject();
JSObject* target = asObject(exec->uncheckedArgument(0));
JSValue boundThis = exec->uncheckedArgument(1);
JSValue boundArgs = exec->uncheckedArgument(2);
- JSValue length = exec->uncheckedArgument(3);
- JSString* name = asString(exec->uncheckedArgument(4));
+ JSValue lengthValue = exec->uncheckedArgument(3);
+ JSString* nameString = asString(exec->uncheckedArgument(4));
- return JSValue::encode(JSBoundFunction::create(
- vm, exec, globalObject, target, boundThis, boundArgs.isCell() ? jsCast<JSArray*>(boundArgs) : nullptr, length.asInt32(), name->value(exec)));
+ ASSERT(lengthValue.isAnyInt());
+ ASSERT(lengthValue.asAnyInt() <= INT32_MAX);
+ ASSERT(lengthValue.asAnyInt() >= INT32_MIN);
+ int32_t length = lengthValue.toInt32(exec);
+ scope.assertNoException();
+
+ String name = nameString->value(exec);
+ RETURN_IF_EXCEPTION(scope, { });
+
+ RELEASE_AND_RETURN(scope, JSValue::encode(JSBoundFunction::create(vm, exec, globalObject, target, boundThis, boundArgs.isCell() ? jsCast<JSArray*>(boundArgs) : nullptr, length, WTFMove(name))));
}
static EncodedJSValue JSC_HOST_CALL hasOwnLengthProperty(ExecState* exec)
Modified: trunk/Source/_javascript_Core/runtime/Options.h (243924 => 243925)
--- trunk/Source/_javascript_Core/runtime/Options.h 2019-04-05 01:45:12 UTC (rev 243924)
+++ trunk/Source/_javascript_Core/runtime/Options.h 2019-04-05 04:17:44 UTC (rev 243925)
@@ -437,6 +437,7 @@
v(bool, useRandomizingFuzzerAgent, false, Normal, nullptr) \
v(unsigned, seedOfRandomizingFuzzerAgent, 1, Normal, nullptr) \
v(bool, dumpRandomizingFuzzerAgentPredictions, false, Normal, nullptr) \
+ v(bool, useDoublePredictionFuzzerAgent, false, Normal, nullptr) \
\
v(bool, logPhaseTimes, false, Normal, nullptr) \
v(double, rareBlockPenalty, 0.001, Normal, nullptr) \
Modified: trunk/Source/_javascript_Core/runtime/VM.cpp (243924 => 243925)
--- trunk/Source/_javascript_Core/runtime/VM.cpp 2019-04-05 01:45:12 UTC (rev 243924)
+++ trunk/Source/_javascript_Core/runtime/VM.cpp 2019-04-05 04:17:44 UTC (rev 243925)
@@ -41,6 +41,7 @@
#include "DFGWorklist.h"
#include "DirectEvalExecutable.h"
#include "Disassembler.h"
+#include "DoublePredictionFuzzerAgent.h"
#include "Error.h"
#include "ErrorConstructor.h"
#include "ErrorInstance.h"
@@ -459,8 +460,11 @@
m_samplingProfiler->start();
}
#endif // ENABLE(SAMPLING_PROFILER)
+
if (Options::useRandomizingFuzzerAgent())
setFuzzerAgent(std::make_unique<RandomizingFuzzerAgent>(*this));
+ else if (Options::useDoublePredictionFuzzerAgent())
+ setFuzzerAgent(std::make_unique<DoublePredictionFuzzerAgent>(*this));
if (Options::alwaysGeneratePCToCodeOriginMap())
setShouldBuildPCToCodeOriginMapping();
