wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-20 22:27:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

Improve graph edge resolution code.

Browse source 
This is a follow-up to ca7ecd37c94e268972697a37eec4e46771c6e6f2 further improving the DiD resolution for CVE-2018-12386.
This commit is contained in:
wolfbeast 2018-10-23 09:44:24 +02:00 • committed by Roy Tam
commit f592b614d0
4 changed files with 48 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

17
js/src/jit-test/tests/ion/bug1493900-1.js Normal file
View file

@ -0,0 +1,17 @@
function f() {
var objs = [];
for (var i = 0; i < 100; i++) {
objs[i] = {};
}
var o = objs[0];
var a = new Float64Array(1024);
function g(a, b) {
let p = b;
for (; p.x < 0; p = p.x) {
while (p === p) {}
}
for (var i = 0; i < 10000; ++i) {}
}
g(a, o);
}
f();

7
js/src/jit-test/tests/ion/bug1493900-2.js Normal file
View file

@ -0,0 +1,7 @@
function f(a, b) {
for (; b.x < 0; b = b.x) {
while (b === b) {};
}
for (var i = 0; i < 99999; ++i) {}
}
f(0, 0);

34
js/src/jit/BacktrackingAllocator.cpp
View file

@ -1735,6 +1735,18 @@ BacktrackingAllocator::deadRange(LiveRange* range)
return true; return true;
} }
bool
BacktrackingAllocator::moveAtEdge(LBlock* predecessor, LBlock* successor, LiveRange* from,
LiveRange* to, LDefinition::Type type)
{
if (successor->mir()->numPredecessors() > 1) {
MOZ_ASSERT(predecessor->mir()->numSuccessors() == 1);
return moveAtExit(predecessor, from, to, type);
}
return moveAtEntry(successor, from, to, type);
}
bool bool
BacktrackingAllocator::resolveControlFlow() BacktrackingAllocator::resolveControlFlow()
{ {
@ -1846,16 +1858,12 @@ BacktrackingAllocator::resolveControlFlow()
if (!alloc().ensureBallast()) { if (!alloc().ensureBallast()) {
return false; return false;
} }
if (mSuccessor->numPredecessors() > 1) {
MOZ_ASSERT(predecessor->mir()->numSuccessors() == 1); // Note: we have to use moveAtEdge both here and below (for edge
if (!moveAtExit(predecessor, from, to, def->type())) { // resolution) to avoid conflicting moves. See bug 1493900.
if (!moveAtEdge(predecessor, successor, from, to, def->type())) {
return false; return false;
} }
} else {
if (!moveAtEntry(successor, from, to, def->type())) {
return false;
}
}
} }
} }
} }
@ -1884,15 +1892,11 @@ BacktrackingAllocator::resolveControlFlow()
if (targetRange->covers(exitOf(predecessor))) if (targetRange->covers(exitOf(predecessor)))
continue; continue;
if (!alloc().ensureBallast()) if (!alloc().ensureBallast()) {
return false; return false;
}
LiveRange* from = reg.rangeFor(exitOf(predecessor), true); LiveRange* from = reg.rangeFor(exitOf(predecessor), true);
if (successor->mir()->numPredecessors() > 1) { if (!moveAtEdge(predecessor, successor, from, targetRange, reg.type())) {
MOZ_ASSERT(predecessor->mir()->numSuccessors() == 1);
if (!moveAtExit(predecessor, from, targetRange, reg.type()))
return false;
} else {
if (!moveAtEntry(successor, from, targetRange, reg.type()))
return false; return false;
} }
} }

3
js/src/jit/BacktrackingAllocator.h
View file

@ -774,6 +774,9 @@ class BacktrackingAllocator : protected RegisterAllocator
return addMove(moves, from, to, type); return addMove(moves, from, to, type);
} }
MOZ_MUST_USE bool moveAtEdge(LBlock* predecessor, LBlock* successor, LiveRange* from,
LiveRange* to, LDefinition::Type type);
// Debugging methods. // Debugging methods.
void dumpAllocations(); void dumpAllocations();