Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(446)

Issue 2756663002: [csa] Bailout to the runtime for ToInteger conversion in Array.p.indexOf. (Closed)

Created:
3 years, 9 months ago by Benedikt Meurer
Modified:
3 years, 9 months ago
Reviewers:
Jarin
CC:
v8-reviews_googlegroups.com
Target Ref:
refs/pending/heads/master
Project:
v8
Visibility:
Public.

Description

[csa] Bailout to the runtime for ToInteger conversion in Array.p.indexOf. The fast-path for Array.prototype.indexOf first checks whether the receiver is a fast-mode JSArray (and there are no elements in the prototype chain in case of holey arrays), then loads the known JSArray::length, and afterwards calls ToInteger on the fromIndex. But this ToInteger(fromIndex) call can cause arbitrary side effects if the fromIndex is a JSReceiver, in particular it can invalidate the assumptions about the fast-mode of the receiver and the length. In the worst case this leads to OOB memory access. Quick-fix is to bailout to the runtime if the fromIndex is neither a Smi nor undefined, which represents the common cases. R=jarin@chromium.org BUG=chromium:702058 Review-Url: https://codereview.chromium.org/2756663002 Cr-Commit-Position: refs/heads/master@{#43843} Committed: https://chromium.googlesource.com/v8/v8/+/9224d5d1bc61c5054ff79b9c5c700052b85c56d3

Patch Set 1 #

Total comments: 2

Patch Set 2 : Update comment. #

Patch Set 3 : Also fix FastDoubleElementsAccessor::IndexOfValueImpl #

Unified diffs Side-by-side diffs Delta from patch set Stats (+46 lines, -21 lines) Patch
M src/builtins/builtins-array.cc View 1 1 chunk +14 lines, -19 lines 0 comments Download
M src/elements.cc View 1 2 1 chunk +2 lines, -2 lines 0 comments Download
A test/mjsunit/regress/regress-crbug-702058-1.js View 1 chunk +10 lines, -0 lines 0 comments Download
A test/mjsunit/regress/regress-crbug-702058-2.js View 1 chunk +10 lines, -0 lines 0 comments Download
A test/mjsunit/regress/regress-crbug-702058-3.js View 1 chunk +10 lines, -0 lines 0 comments Download

Messages

Total messages: 26 (16 generated)
Benedikt Meurer
3 years, 9 months ago (2017-03-16 05:44:48 UTC) #1
Benedikt Meurer
Hey Jaro, Here's a quickfix for an OOB access in Array.p.indexOf. Please take a look. ...
3 years, 9 months ago (2017-03-16 05:45:34 UTC) #4
Jarin
lgtm https://codereview.chromium.org/2756663002/diff/1/src/builtins/builtins-array.cc File src/builtins/builtins-array.cc (right): https://codereview.chromium.org/2756663002/diff/1/src/builtins/builtins-array.cc#newcode2054 src/builtins/builtins-array.cc:2054: Branch(TaggedIsSmi(start_from), &init_k_smi, &init_k_other); Please explain in a comment ...
3 years, 9 months ago (2017-03-16 05:55:02 UTC) #7
Benedikt Meurer
https://codereview.chromium.org/2756663002/diff/1/src/builtins/builtins-array.cc File src/builtins/builtins-array.cc (right): https://codereview.chromium.org/2756663002/diff/1/src/builtins/builtins-array.cc#newcode2054 src/builtins/builtins-array.cc:2054: Branch(TaggedIsSmi(start_from), &init_k_smi, &init_k_other); On 2017/03/16 05:55:02, Jarin wrote: > ...
3 years, 9 months ago (2017-03-16 05:55:31 UTC) #8
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2756663002/20001
3 years, 9 months ago (2017-03-16 05:55:47 UTC) #11
dcheng
On 2017/03/16 05:55:47, commit-bot: I haz the power wrote: > CQ is trying da patch. ...
3 years, 9 months ago (2017-03-16 06:03:47 UTC) #12
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2756663002/20001
3 years, 9 months ago (2017-03-16 06:08:11 UTC) #15
Benedikt Meurer
On 2017/03/16 06:03:47, dcheng wrote: > On 2017/03/16 05:55:47, commit-bot: I haz the power wrote: ...
3 years, 9 months ago (2017-03-16 06:08:13 UTC) #16
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2756663002/40001
3 years, 9 months ago (2017-03-16 06:43:51 UTC) #23
commit-bot: I haz the power
3 years, 9 months ago (2017-03-16 06:53:16 UTC) #26
Message was sent while issue was closed.
Committed patchset #3 (id:40001) as
https://chromium.googlesource.com/v8/v8/+/9224d5d1bc61c5054ff79b9c5c700052b85...

Powered by Google App Engine
This is Rietveld 408576698