Title: [283632] trunk/Source/_javascript_Core
- Revision
- 283632
- Author
- [email protected]
- Date
- 2021-10-06 10:31:44 -0700 (Wed, 06 Oct 2021)
Log Message
Speculative fix for a null pointer dereference in ByteCodeParser::handlePutByVal.
https://bugs.webkit.org/show_bug.cgi?id=231252
rdar://83310320
Reviewed by Yusuke Suzuki.
We're seeing a null pointer dereference in ByteCodeParser::handlePutByVal().
Adding a null check here as a speculative fix to mitigate crashes while we
investigate further.
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::handlePutByVal):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (283631 => 283632)
--- trunk/Source/_javascript_Core/ChangeLog 2021-10-06 17:29:40 UTC (rev 283631)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-10-06 17:31:44 UTC (rev 283632)
@@ -1,3 +1,19 @@
+2021-10-06 Mark Lam <[email protected]>
+
+ Speculative fix for a null pointer dereference in ByteCodeParser::handlePutByVal.
+ https://bugs.webkit.org/show_bug.cgi?id=231252
+ rdar://83310320
+
+ Reviewed by Yusuke Suzuki.
+
+ We're seeing a null pointer dereference in ByteCodeParser::handlePutByVal().
+ Adding a null check here as a speculative fix to mitigate crashes while we
+ investigate further.
+
+ * dfg/DFGByteCodeParser.cpp:
+ (JSC::DFG::ByteCodeParser::parseBlock):
+ (JSC::DFG::ByteCodeParser::handlePutByVal):
+
2021-10-06 Saam Barati <[email protected]>
Run backwards propagation before we prune the graph after ForceOSRExit nodes in BytecodeParser
Modified: trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp (283631 => 283632)
--- trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2021-10-06 17:29:40 UTC (rev 283631)
+++ trunk/Source/_javascript_Core/dfg/DFGByteCodeParser.cpp 2021-10-06 17:31:44 UTC (rev 283632)
@@ -6483,7 +6483,9 @@
FrozenValue* frozen = m_graph.freezeStrong(symbol);
addToGraph(CheckIsConstant, OpInfo(frozen), property);
} else if (auto* string = property->dynamicCastConstant<JSString*>(*m_vm)) {
- if (auto* impl = string->tryGetValueImpl(); impl->isAtom() && !parseIndex(*const_cast<StringImpl*>(impl))) {
+ auto* impl = string->tryGetValueImpl();
+ ASSERT(impl); // FIXME: rdar://83902782
+ if (impl && impl->isAtom() && !parseIndex(*const_cast<StringImpl*>(impl))) {
uid = bitwise_cast<UniquedStringImpl*>(impl);
propertyCell = string;
m_graph.freezeStrong(string);
@@ -8877,7 +8879,9 @@
FrozenValue* frozen = m_graph.freezeStrong(symbol);
addToGraph(CheckIsConstant, OpInfo(frozen), property);
} else if (auto* string = property->dynamicCastConstant<JSString*>(*m_vm)) {
- if (auto* impl = string->tryGetValueImpl(); impl->isAtom() && !parseIndex(*const_cast<StringImpl*>(impl))) {
+ auto* impl = string->tryGetValueImpl();
+ ASSERT(impl); // FIXME: rdar://83902782
+ if (impl && impl->isAtom() && !parseIndex(*const_cast<StringImpl*>(impl))) {
uid = bitwise_cast<UniquedStringImpl*>(impl);
propertyCell = string;
m_graph.freezeStrong(string);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
