[compiler] Sanitize entry points to LookupSlot access.

src/compiler/ast-graph-builder.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/ast-graph-builder.h"
 
 #include "src/ast/scopes.h"
 #include "src/compiler.h"
 #include "src/compiler/ast-loop-assignment-analyzer.h"
 #include "src/compiler/control-builders.h"
@@ skipping 2320 matching lines @@
           BuildVariableLoad(proxy->var(), expr->expression()->id(), states,
                             pair, OutputFrameStateCombine::Push());
       receiver_hint = ConvertReceiverMode::kNullOrUndefined;
       receiver_value = jsgraph()->UndefinedConstant();
       break;
     }
     case Call::LOOKUP_SLOT_CALL: {
       Variable* variable = callee->AsVariableProxy()->var();
       DCHECK(variable->location() == VariableLocation::LOOKUP);
       Node* name = jsgraph()->Constant(variable->name());
-      const Operator* op = javascript()->CallRuntime(Runtime::kLoadLookupSlot);
-      Node* pair = NewNode(op, current_context(), name);
+      const Operator* op =
+          javascript()->CallRuntime(Runtime::kLoadLookupSlotForCall);
+      Node* pair = NewNode(op, name);
       callee_value = NewNode(common()->Projection(0), pair);
       receiver_value = NewNode(common()->Projection(1), pair);
       PrepareFrameState(pair, expr->LookupId(),
                         OutputFrameStateCombine::Push(2));
       break;
     }
     case Call::NAMED_PROPERTY_CALL: {
       Property* property = callee->AsProperty();
       VectorSlotPair feedback =
           CreateVectorSlotPair(property->PropertyFeedbackSlot());
@@ skipping 74 matching lines @@
       break;
     }
     case Call::SUPER_CALL:
       return VisitCallSuper(expr);
     case Call::POSSIBLY_EVAL_CALL:
       possibly_eval = true;
       if (callee->AsVariableProxy()->var()->IsLookupSlot()) {
         Variable* variable = callee->AsVariableProxy()->var();
         Node* name = jsgraph()->Constant(variable->name());
         const Operator* op =
-            javascript()->CallRuntime(Runtime::kLoadLookupSlot);
-        Node* pair = NewNode(op, current_context(), name);
+            javascript()->CallRuntime(Runtime::kLoadLookupSlotForCall);
+        Node* pair = NewNode(op, name);
         callee_value = NewNode(common()->Projection(0), pair);
         receiver_value = NewNode(common()->Projection(1), pair);
         PrepareFrameState(pair, expr->LookupId(),
                           OutputFrameStateCombine::Push(2));
         break;
       }
     // Fall through.
     case Call::OTHER_CALL:
       VisitForValue(callee);
       callee_value = environment()->Pop();
@@ skipping 946 matching lines @@
       return value;
     }
     case VariableLocation::LOOKUP: {
       // Dynamic lookup of context variable (anywhere in the chain).
       Handle<String> name = variable->name();
       if (Node* node =
               TryLoadDynamicVariable(variable, name, bailout_id, states,
                                      feedback, combine, typeof_mode)) {
         return node;
       }
-      const Operator* op = javascript()->LoadDynamic(name, typeof_mode);
-      Node* value = NewNode(op, BuildLoadFeedbackVector(), current_context());
+      const Operator* op =
+          javascript()->CallRuntime(typeof_mode == TypeofMode::NOT_INSIDE_TYPEOF
+                                        ? Runtime::kLoadLookupSlot
+                                        : Runtime::kLoadLookupSlotInsideTypeof);
+      Node* value = NewNode(op, jsgraph()->Constant(name));

[Michael Starzinger, 2016/02/10 19:48:16]

nit: Can we wrap this into a helper with the following signature?
Node* BuildDynamicLoad(Handle<Name> name, TypeofMode typeof_mode);

[Benedikt Meurer, 2016/02/11 05:25:04]

Done.

       states.AddToNode(value, bailout_id, combine);
       return value;
     }
   }
   UNREACHABLE();
   return nullptr;
 }
 
 
 Node* AstGraphBuilder::BuildVariableDelete(Variable* variable,
@@ skipping 137 matching lines @@
         Node* current = NewNode(op, current_context());
         BuildHoleCheckThenThrow(current, variable, value, bailout_id);
         return BuildThrowConstAssignError(bailout_id);
       }
       const Operator* op = javascript()->StoreContext(depth, variable->index());
       return NewNode(op, current_context(), value);
     }
     case VariableLocation::LOOKUP: {
       // Dynamic lookup of context variable (anywhere in the chain).
       Node* name = jsgraph()->Constant(variable->name());
-      Node* language = jsgraph()->Constant(language_mode());
       // TODO(mstarzinger): Use Runtime::kInitializeLegacyConstLookupSlot for
       // initializations of const declarations.
-      const Operator* op = javascript()->CallRuntime(Runtime::kStoreLookupSlot);
-      Node* store = NewNode(op, value, current_context(), name, language);
+      const Operator* op = javascript()->CallRuntime(
+          is_strict(language_mode()) ? Runtime::kStoreLookupSlot_Strict
+                                     : Runtime::kStoreLookupSlot_Sloppy);
+      Node* store = NewNode(op, name, value);

[Michael Starzinger, 2016/02/10 19:48:16]

nit: Can we wrap this into a helper with the following signature?
Node* BuildDynamicStore(Handle<Name> name, Node* value);

[Benedikt Meurer, 2016/02/11 05:25:04]

Done.

       PrepareFrameState(store, bailout_id, combine);
       return store;
     }
   }
   UNREACHABLE();
   return nullptr;
 }
 
 
 Node* AstGraphBuilder::BuildKeyedLoad(Node* object, Node* key,
@@ skipping 85 matching lines @@
 
 Node* AstGraphBuilder::BuildGlobalStore(Handle<Name> name, Node* value,
                                         const VectorSlotPair& feedback) {
   const Operator* op =
       javascript()->StoreGlobal(language_mode(), name, feedback);
   Node* node = NewNode(op, value, GetFunctionClosure());
   return node;
 }
 
 
-Node* AstGraphBuilder::BuildLoadImmutableObjectField(Node* object, int offset) {
-  return graph()->NewNode(jsgraph()->machine()->Load(MachineType::AnyTagged()),
-                          object,
-                          jsgraph()->IntPtrConstant(offset - kHeapObjectTag),
-                          graph()->start(), graph()->start());
-}
-
-
 Node* AstGraphBuilder::BuildLoadGlobalObject() {
   return BuildLoadNativeContextField(Context::EXTENSION_INDEX);
 }
 
 
 Node* AstGraphBuilder::BuildLoadNativeContextField(int index) {
   const Operator* op =
       javascript()->LoadContext(0, Context::NATIVE_CONTEXT_INDEX, true);
   Node* native_context = NewNode(op, current_context());
   return NewNode(javascript()->LoadContext(0, index, true), native_context);
 }
 
 
-Node* AstGraphBuilder::BuildLoadFeedbackVector() {
-  if (!feedback_vector_.is_set()) {
-    Node* closure = GetFunctionClosure();
-    Node* shared = BuildLoadImmutableObjectField(
-        closure, JSFunction::kSharedFunctionInfoOffset);
-    Node* vector = BuildLoadImmutableObjectField(
-        shared, SharedFunctionInfo::kFeedbackVectorOffset);
-    feedback_vector_.set(vector);
-  }
-  return feedback_vector_.get();
-}
-
-
 Node* AstGraphBuilder::BuildToBoolean(Node* input, TypeFeedbackId feedback_id) {
   if (Node* node = TryFastToBoolean(input)) return node;
   ToBooleanHints hints;
   if (!type_hint_analysis_ ||
       !type_hint_analysis_->GetToBooleanHints(feedback_id, &hints)) {
     hints = ToBooleanHint::kAny;
   }
   return NewNode(javascript()->ToBoolean(hints), input);
 }
 
@@ skipping 198 matching lines @@
       // Perform global slot load.
       Node* fast = BuildGlobalLoad(name, feedback, typeof_mode);
       states.AddToNode(fast, bailout_id, combine);
       environment()->Push(fast);
     }
     slow_block.Break();
     environment()->Pop();
     fast_block.EndBlock();
 
     // Slow case, because variable potentially shadowed. Perform dynamic lookup.
-    const Operator* op = javascript()->LoadDynamic(name, typeof_mode);
-    Node* slow = NewNode(op, BuildLoadFeedbackVector(), current_context());
+    const Operator* op =
+        javascript()->CallRuntime(typeof_mode == TypeofMode::NOT_INSIDE_TYPEOF
+                                      ? Runtime::kLoadLookupSlot
+                                      : Runtime::kLoadLookupSlotInsideTypeof);
+    Node* slow = NewNode(op, jsgraph()->Constant(name));

[Michael Starzinger, 2016/02/10 19:48:16]

nit: Use aforementioned helper.

[Benedikt Meurer, 2016/02/11 05:25:05]

Done.

     states.AddToNode(slow, bailout_id, combine);
     environment()->Push(slow);
     slow_block.EndBlock();
 
     return environment()->Pop();
   }
 
   if (mode == DYNAMIC_LOCAL) {
     uint32_t bitset = ComputeBitsetForDynamicContext(variable);
     if (bitset == kFullCheckRequired) return nullptr;
@@ skipping 22 matching lines @@
     Variable* local = variable->local_if_not_shadowed();
     DCHECK(local->location() == VariableLocation::CONTEXT);  // Must be context.
     Node* fast = BuildVariableLoad(local, bailout_id, states, feedback, combine,
                                    typeof_mode);
     environment()->Push(fast);
     slow_block.Break();
     environment()->Pop();
     fast_block.EndBlock();
 
     // Slow case, because variable potentially shadowed. Perform dynamic lookup.
-    const Operator* op = javascript()->LoadDynamic(name, typeof_mode);
-    Node* slow = NewNode(op, BuildLoadFeedbackVector(), current_context());
+    const Operator* op =
+        javascript()->CallRuntime(typeof_mode == TypeofMode::NOT_INSIDE_TYPEOF
+                                      ? Runtime::kLoadLookupSlot
+                                      : Runtime::kLoadLookupSlotInsideTypeof);
+    Node* slow = NewNode(op, jsgraph()->Constant(name));

[Michael Starzinger, 2016/02/10 19:48:16]

nit: Use aforementioned helper.

[Benedikt Meurer, 2016/02/11 05:25:04]

Done.

     states.AddToNode(slow, bailout_id, combine);
     environment()->Push(slow);
     slow_block.EndBlock();
 
     return environment()->Pop();
   }
 
   return nullptr;
 }
 
@@ skipping 373 matching lines @@
     // Phi does not exist yet, introduce one.
     value = NewPhi(inputs, value, control);
     value->ReplaceInput(inputs - 1, other);
   }
   return value;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8