[JSC] makeBoundFunction should not assume incoming "length" value is Int32 because...
authorysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 5 Apr 2019 04:17:44 +0000 (04:17 +0000)
committerysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 5 Apr 2019 04:17:44 +0000 (04:17 +0000)
https://bugs.webkit.org/show_bug.cgi?id=196631

Reviewed by Saam Barati.

JSTests:

* stress/make-bound-function-should-not-assume-int32-length.js: Added.
(assert):
(test):
(foo):

Source/JavaScriptCore:

makeBoundFunction assumes that "length" argument is always Int32. But this should not be done since this "length" value is calculated in builtin JS code.
DFG may store this value in Double format so that we should not rely on that this value is Int32. This patch fixes makeBoundFunction function to perform
toInt32 operation. We also insert a missing exception check for `JSString::value(ExecState*)` in makeBoundFunction.

* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* interpreter/CallFrameInlines.h:
* runtime/DoublePredictionFuzzerAgent.cpp: Copied from Source/JavaScriptCore/interpreter/CallFrameInlines.h.
(JSC::DoublePredictionFuzzerAgent::DoublePredictionFuzzerAgent):
(JSC::DoublePredictionFuzzerAgent::getPrediction):
* runtime/DoublePredictionFuzzerAgent.h: Copied from Source/JavaScriptCore/interpreter/CallFrameInlines.h.
* runtime/JSGlobalObject.cpp:
(JSC::makeBoundFunction):
* runtime/Options.h:
* runtime/VM.cpp:
(JSC::VM::VM):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243925 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/make-bound-function-should-not-assume-int32-length.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
Source/JavaScriptCore/Sources.txt
Source/JavaScriptCore/interpreter/CallFrameInlines.h
Source/JavaScriptCore/runtime/DoublePredictionFuzzerAgent.cpp [new file with mode: 0644]
Source/JavaScriptCore/runtime/DoublePredictionFuzzerAgent.h [new file with mode: 0644]
Source/JavaScriptCore/runtime/JSGlobalObject.cpp
Source/JavaScriptCore/runtime/Options.h
Source/JavaScriptCore/runtime/VM.cpp

index 840736b..bbf7bfd 100644 (file)
@@ -1,3 +1,15 @@
+2019-04-04  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
+        https://bugs.webkit.org/show_bug.cgi?id=196631
+
+        Reviewed by Saam Barati.
+
+        * stress/make-bound-function-should-not-assume-int32-length.js: Added.
+        (assert):
+        (test):
+        (foo):
+
 2019-04-04  Saam Barati  <sbarati@apple.com>
 
         Unreviewed. Make the test from r243906 catch the thrown exceptions.
diff --git a/JSTests/stress/make-bound-function-should-not-assume-int32-length.js b/JSTests/stress/make-bound-function-should-not-assume-int32-length.js
new file mode 100644 (file)
index 0000000..1b775ea
--- /dev/null
@@ -0,0 +1,18 @@
+//@ runDefault("--useDoublePredictionFuzzerAgent=1", "--useConcurrentJIT=0")
+// This test should not crash.
+function assert(b) {
+    if (!b)
+        throw new Error("Bad")
+}
+noInline(assert);
+
+function test(f, v, c, d) {
+    return f.bind(v, c, d);
+}
+
+function foo(a,b,c,d,e,f) { return this; }
+let thisValue = {};
+for (let i = 0; i < 10000; i++) {
+    let f = test(foo, thisValue, 20, 30);
+    assert(f(foo, thisValue, 20, 30) === thisValue);
+}
index cdfebc9..71f5a9a 100644 (file)
@@ -1,3 +1,27 @@
+2019-04-04  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
+        https://bugs.webkit.org/show_bug.cgi?id=196631
+
+        Reviewed by Saam Barati.
+
+        makeBoundFunction assumes that "length" argument is always Int32. But this should not be done since this "length" value is calculated in builtin JS code.
+        DFG may store this value in Double format so that we should not rely on that this value is Int32. This patch fixes makeBoundFunction function to perform
+        toInt32 operation. We also insert a missing exception check for `JSString::value(ExecState*)` in makeBoundFunction.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * Sources.txt:
+        * interpreter/CallFrameInlines.h:
+        * runtime/DoublePredictionFuzzerAgent.cpp: Copied from Source/JavaScriptCore/interpreter/CallFrameInlines.h.
+        (JSC::DoublePredictionFuzzerAgent::DoublePredictionFuzzerAgent):
+        (JSC::DoublePredictionFuzzerAgent::getPrediction):
+        * runtime/DoublePredictionFuzzerAgent.h: Copied from Source/JavaScriptCore/interpreter/CallFrameInlines.h.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::makeBoundFunction):
+        * runtime/Options.h:
+        * runtime/VM.cpp:
+        (JSC::VM::VM):
+
 2019-04-04  Robin Morisset  <rmorisset@apple.com>
 
         B3ReduceStrength should know that Mul distributes over Add and Sub
index d3ff105..9ab8830 100644 (file)
                E3F23A7C1ECF13E500978D99 /* SnippetParams.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SnippetParams.h; sourceTree = "<group>"; };
                E3F23A7D1ECF13E500978D99 /* SnippetReg.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SnippetReg.h; sourceTree = "<group>"; };
                E3F23A7E1ECF13E500978D99 /* SnippetSlowPathCalls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SnippetSlowPathCalls.h; sourceTree = "<group>"; };
+               E3FC25102256ECF400583518 /* DoublePredictionFuzzerAgent.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = DoublePredictionFuzzerAgent.cpp; sourceTree = "<group>"; };
+               E3FC25112256ECF400583518 /* DoublePredictionFuzzerAgent.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = DoublePredictionFuzzerAgent.h; sourceTree = "<group>"; };
                E3FF752F1D9CEA1200C7E16D /* DOMJITGetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMJITGetterSetter.h; sourceTree = "<group>"; };
                E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCacheItem.h; sourceTree = "<group>"; };
                E49DC15112EF272200184A1F /* SourceProviderCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SourceProviderCache.h; sourceTree = "<group>"; };
                                E31618101EC5FE080006A218 /* DOMAnnotation.h */,
                                E31618111EC5FE080006A218 /* DOMAttributeGetterSetter.cpp */,
                                E31618121EC5FE080006A218 /* DOMAttributeGetterSetter.h */,
+                               E3FC25102256ECF400583518 /* DoublePredictionFuzzerAgent.cpp */,
+                               E3FC25112256ECF400583518 /* DoublePredictionFuzzerAgent.h */,
                                A70447EB17A0BD7000F5898E /* DumpContext.cpp */,
                                A70447EC17A0BD7000F5898E /* DumpContext.h */,
                                FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */,
                                AD2FCBB31DB58DA400B3E736 /* WebAssemblyCompileErrorPrototype.h */,
                                AD4937C91DDD27340077C807 /* WebAssemblyFunction.cpp */,
                                AD4937CA1DDD27340077C807 /* WebAssemblyFunction.h */,
-                               523FD88D225566C4003B3DCC /* WebAssemblyFunctionHeapCellType.cpp */,
-                               523FD88C225566C3003B3DCC /* WebAssemblyFunctionHeapCellType.h */,
                                521322431ECBCE8200F65615 /* WebAssemblyFunctionBase.cpp */,
                                521322441ECBCE8200F65615 /* WebAssemblyFunctionBase.h */,
+                               523FD88D225566C4003B3DCC /* WebAssemblyFunctionHeapCellType.cpp */,
+                               523FD88C225566C3003B3DCC /* WebAssemblyFunctionHeapCellType.h */,
                                AD2FCBB41DB58DA400B3E736 /* WebAssemblyInstanceConstructor.cpp */,
                                AD2FCBB51DB58DA400B3E736 /* WebAssemblyInstanceConstructor.h */,
                                AD2FCBB61DB58DA400B3E736 /* WebAssemblyInstancePrototype.cpp */,
                                0F6B8AD91C4EDDA200969052 /* B3DuplicateTails.h in Headers */,
                                0FEC85C11BE167A00080FF74 /* B3Effects.h in Headers */,
                                0F725CA81C503DED00AD943A /* B3EliminateCommonSubexpressions.h in Headers */,
+                               3395C70722555F6D00BDBFAD /* B3EliminateDeadCode.h in Headers */,
                                0F5BF1711F23A5A10029D91D /* B3EnsureLoopPreHeaders.h in Headers */,
                                0F6971EA1D92F42400BA02A5 /* B3FenceValue.h in Headers */,
                                0F6B8AE51C4EFE1700969052 /* B3FixSSA.h in Headers */,
                                0F5BF1641F2317120029D91D /* B3HoistLoopInvariantValues.h in Headers */,
                                DC69B99D1D15F914002E3C00 /* B3InferSwitches.h in Headers */,
                                0FEC85BA1BE1462F0080FF74 /* B3InsertionSet.h in Headers */,
-                               523FD88E225566C9003B3DCC /* WebAssemblyFunctionHeapCellType.h in Headers */,
                                0FEC85BB1BE1462F0080FF74 /* B3InsertionSetInlines.h in Headers */,
                                0FDF67D21D9C6D27001B9825 /* B3Kind.h in Headers */,
                                436E54531C468E7400B5AF73 /* B3LegalizeMemoryOffsets.h in Headers */,
                                473DA4A4764C45FE871B0485 /* DefinePropertyAttributes.h in Headers */,
                                0FBB73BB1DEF8645002C009E /* DeleteAllCodeEffort.h in Headers */,
                                0F96303C1D4192CD005609D9 /* DestructionMode.h in Headers */,
-                               527CE35422555FE500C6F382 /* JSToWasmICCallee.h in Headers */,
                                A77A423E17A0BBFD00A8DB81 /* DFGAbstractHeap.h in Headers */,
                                A704D90317A0BAA8006BA554 /* DFGAbstractInterpreter.h in Headers */,
                                0F5E0FD8207C72730097F0DE /* DFGAbstractInterpreterClobberState.h in Headers */,
                                0F48532A187DFDEC0083B687 /* FTLRecoveryOpcode.h in Headers */,
                                0FCEFAAC1804C13E00472CE4 /* FTLSaveRestore.h in Headers */,
                                0F25F1B2181635F300522F39 /* FTLSlowPathCall.h in Headers */,
-                               3395C70722555F6D00BDBFAD /* B3EliminateDeadCode.h in Headers */,
                                0F25F1B4181635F300522F39 /* FTLSlowPathCallKey.h in Headers */,
                                E322E5A71DA644A8006E7709 /* FTLSnippetParams.h in Headers */,
                                0F235BD717178E1C00690C7F /* FTLStackmapArgumentList.h in Headers */,
                                0F919D0D157EE0A2004A4E7D /* JSSymbolTableObject.h in Headers */,
                                70ECA6061AFDBEA200449739 /* JSTemplateObjectDescriptor.h in Headers */,
                                AD5C36EA1F75AD6A000BCAAF /* JSToWasm.h in Headers */,
+                               527CE35422555FE500C6F382 /* JSToWasmICCallee.h in Headers */,
                                BC18C42A0E16F5CD00B34460 /* JSType.h in Headers */,
                                53486BB71C1795C300F6F3AF /* JSTypedArray.h in Headers */,
                                0F2B66FB17B6B5AB00A7AE3F /* JSTypedArrayConstructors.h in Headers */,
                                AD2FCC171DB59CB200B3E736 /* WebAssemblyCompileErrorPrototype.lut.h in Headers */,
                                AD4937D41DDD27DE0077C807 /* WebAssemblyFunction.h in Headers */,
                                521322461ECBCE8200F65615 /* WebAssemblyFunctionBase.h in Headers */,
+                               523FD88E225566C9003B3DCC /* WebAssemblyFunctionHeapCellType.h in Headers */,
                                AD2FCBF11DB58DAD00B3E736 /* WebAssemblyInstanceConstructor.h in Headers */,
                                AD2FCC181DB59CB200B3E736 /* WebAssemblyInstanceConstructor.lut.h in Headers */,
                                AD2FCBF31DB58DAD00B3E736 /* WebAssemblyInstancePrototype.h in Headers */,
index 24c2d68..3302dea 100644 (file)
@@ -745,6 +745,7 @@ runtime/DirectArguments.cpp
 runtime/DirectArgumentsOffset.cpp
 runtime/DirectEvalExecutable.cpp
 runtime/DisallowVMReentry.cpp
+runtime/DoublePredictionFuzzerAgent.cpp
 runtime/DumpContext.cpp
 runtime/ECMAScriptSpecInternalFunctions.cpp
 runtime/Error.cpp
index abdec1b..c0cbbd5 100644 (file)
@@ -26,6 +26,8 @@
 #pragma once
 
 #include "CallFrame.h"
+#include "JSCallee.h"
+#include "JSGlobalObject.h"
 
 namespace JSC {
 
diff --git a/Source/JavaScriptCore/runtime/DoublePredictionFuzzerAgent.cpp b/Source/JavaScriptCore/runtime/DoublePredictionFuzzerAgent.cpp
new file mode 100644 (file)
index 0000000..bc443d0
--- /dev/null
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DoublePredictionFuzzerAgent.h"
+
+namespace JSC {
+
+DoublePredictionFuzzerAgent::DoublePredictionFuzzerAgent(VM&)
+{
+}
+
+SpeculatedType DoublePredictionFuzzerAgent::getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType original)
+{
+    if (original && mergeSpeculations(original, SpecBytecodeNumber) == SpecBytecodeNumber)
+        return SpecBytecodeDouble;
+    return original;
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/DoublePredictionFuzzerAgent.h b/Source/JavaScriptCore/runtime/DoublePredictionFuzzerAgent.h
new file mode 100644 (file)
index 0000000..e6a04d0
--- /dev/null
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2019 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include "FuzzerAgent.h"
+
+namespace JSC {
+
+class VM;
+
+class DoublePredictionFuzzerAgent final : public FuzzerAgent {
+public:
+    DoublePredictionFuzzerAgent(VM&);
+
+    SpeculatedType getPrediction(CodeBlock*, const CodeOrigin&, SpeculatedType) override;
+};
+
+} // namespace JSC
index cd93d38..9302701 100644 (file)
@@ -238,16 +238,26 @@ static JSValue createConsoleProperty(VM& vm, JSObject* object)
 static EncodedJSValue JSC_HOST_CALL makeBoundFunction(ExecState* exec)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
 
     JSObject* target = asObject(exec->uncheckedArgument(0));
     JSValue boundThis = exec->uncheckedArgument(1);
     JSValue boundArgs = exec->uncheckedArgument(2);
-    JSValue length = exec->uncheckedArgument(3);
-    JSString* name = asString(exec->uncheckedArgument(4));
+    JSValue lengthValue = exec->uncheckedArgument(3);
+    JSString* nameString = asString(exec->uncheckedArgument(4));
+
+    ASSERT(lengthValue.isAnyInt());
+    ASSERT(lengthValue.asAnyInt() <= INT32_MAX);
+    ASSERT(lengthValue.asAnyInt() >= INT32_MIN);
+    int32_t length = lengthValue.toInt32(exec);
+    scope.assertNoException();
+
+    String name = nameString->value(exec);
+    RETURN_IF_EXCEPTION(scope, { });
 
-    return JSValue::encode(JSBoundFunction::create(
-        vm, exec, globalObject, target, boundThis, boundArgs.isCell() ? jsCast<JSArray*>(boundArgs) : nullptr, length.asInt32(), name->value(exec)));
+    RELEASE_AND_RETURN(scope, JSValue::encode(JSBoundFunction::create(vm, exec, globalObject, target, boundThis, boundArgs.isCell() ? jsCast<JSArray*>(boundArgs) : nullptr, length, WTFMove(name))));
 }
 
 static EncodedJSValue JSC_HOST_CALL hasOwnLengthProperty(ExecState* exec)
index 24206e4..1d55196 100644 (file)
@@ -437,6 +437,7 @@ constexpr bool enableWebAssemblyStreamingApi = false;
     v(bool, useRandomizingFuzzerAgent, false, Normal, nullptr) \
     v(unsigned, seedOfRandomizingFuzzerAgent, 1, Normal, nullptr) \
     v(bool, dumpRandomizingFuzzerAgentPredictions, false, Normal, nullptr) \
+    v(bool, useDoublePredictionFuzzerAgent, false, Normal, nullptr) \
     \
     v(bool, logPhaseTimes, false, Normal, nullptr) \
     v(double, rareBlockPenalty, 0.001, Normal, nullptr) \
index 87423fe..2ec84d5 100644 (file)
@@ -41,6 +41,7 @@
 #include "DFGWorklist.h"
 #include "DirectEvalExecutable.h"
 #include "Disassembler.h"
+#include "DoublePredictionFuzzerAgent.h"
 #include "Error.h"
 #include "ErrorConstructor.h"
 #include "ErrorInstance.h"
@@ -459,8 +460,11 @@ VM::VM(VMType vmType, HeapType heapType)
         m_samplingProfiler->start();
     }
 #endif // ENABLE(SAMPLING_PROFILER)
+
     if (Options::useRandomizingFuzzerAgent())
         setFuzzerAgent(std::make_unique<RandomizingFuzzerAgent>(*this));
+    else if (Options::useDoublePredictionFuzzerAgent())
+        setFuzzerAgent(std::make_unique<DoublePredictionFuzzerAgent>(*this));
 
     if (Options::alwaysGeneratePCToCodeOriginMap())
         setShouldBuildPCToCodeOriginMapping();