Diff
Modified: trunk/LayoutTests/ChangeLog (153499 => 153500)
--- trunk/LayoutTests/ChangeLog 2013-07-30 22:20:21 UTC (rev 153499)
+++ trunk/LayoutTests/ChangeLog 2013-07-30 22:41:54 UTC (rev 153500)
@@ -1,3 +1,16 @@
+2013-07-30 Mark Hahnenberg <[email protected]>
+
+ GetByVal on Arguments does the wrong size load when checking the Arguments object length
+ https://bugs.webkit.org/show_bug.cgi?id=119281
+
+ Reviewed by Geoffrey Garen.
+
+ * fast/js/dfg-strict-mode-arguments-get-beyond-length-expected.txt: Added.
+ * fast/js/dfg-strict-mode-arguments-get-beyond-length.html: Added.
+ * fast/js/script-tests/dfg-strict-mode-arguments-get-beyond-length.js: Added.
+ (foo):
+ (bar):
+
2013-07-30 Alexey Proskuryakov <[email protected]>
REGRESSION(r139282): Fix document leak when selection is created inside the document
Added: trunk/LayoutTests/fast/js/dfg-strict-mode-arguments-get-beyond-length-expected.txt (0 => 153500)
--- trunk/LayoutTests/fast/js/dfg-strict-mode-arguments-get-beyond-length-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-strict-mode-arguments-get-beyond-length-expected.txt 2013-07-30 22:41:54 UTC (rev 153500)
@@ -0,0 +1,4 @@
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/dfg-strict-mode-arguments-get-beyond-length.html (0 => 153500)
--- trunk/LayoutTests/fast/js/dfg-strict-mode-arguments-get-beyond-length.html (rev 0)
+++ trunk/LayoutTests/fast/js/dfg-strict-mode-arguments-get-beyond-length.html 2013-07-30 22:41:54 UTC (rev 153500)
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/script-tests/dfg-strict-mode-arguments-get-beyond-length.js (0 => 153500)
--- trunk/LayoutTests/fast/js/script-tests/dfg-strict-mode-arguments-get-beyond-length.js (rev 0)
+++ trunk/LayoutTests/fast/js/script-tests/dfg-strict-mode-arguments-get-beyond-length.js 2013-07-30 22:41:54 UTC (rev 153500)
@@ -0,0 +1,21 @@
+"use strict";
+
+function foo(args, i) {
+ return args[i];
+}
+
+function bar(i) {
+ return foo(arguments, i);
+}
+
+noInline(foo);
+noInline(bar);
+
+while (!dfgCompiled({f:foo}))
+ bar(0);
+
+for (var i = 1; i <= 1000; i++) {
+ var result = bar(i);
+ if (result !== undefined)
+ throw "Expected undefined at index " + i + ", got: " + result;
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (153499 => 153500)
--- trunk/Source/_javascript_Core/ChangeLog 2013-07-30 22:20:21 UTC (rev 153499)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-07-30 22:41:54 UTC (rev 153500)
@@ -1,3 +1,17 @@
+2013-07-30 Mark Hahnenberg <[email protected]>
+
+ GetByVal on Arguments does the wrong size load when checking the Arguments object length
+ https://bugs.webkit.org/show_bug.cgi?id=119281
+
+ Reviewed by Geoffrey Garen.
+
+ This leads to out of bounds accesses and subsequent crashes.
+
+ * dfg/DFGSpeculativeJIT.cpp:
+ (JSC::DFG::SpeculativeJIT::compileGetByValOnArguments):
+ * dfg/DFGSpeculativeJIT64.cpp:
+ (JSC::DFG::SpeculativeJIT::compile):
+
2013-07-30 Oliver Hunt <[email protected]>
Add an assertion to SpeculateCellOperand
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp (153499 => 153500)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-07-30 22:20:21 UTC (rev 153499)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT.cpp 2013-07-30 22:41:54 UTC (rev 153500)
@@ -4075,7 +4075,7 @@
// Two really lame checks.
speculationCheck(
Uncountable, JSValueSource(), 0,
- m_jit.branchPtr(
+ m_jit.branch32(
MacroAssembler::AboveOrEqual, propertyReg,
MacroAssembler::Address(baseReg, OBJECT_OFFSETOF(Arguments, m_numArguments))));
speculationCheck(
Modified: trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp (153499 => 153500)
--- trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2013-07-30 22:20:21 UTC (rev 153499)
+++ trunk/Source/_javascript_Core/dfg/DFGSpeculativeJIT64.cpp 2013-07-30 22:41:54 UTC (rev 153500)
@@ -2844,7 +2844,7 @@
// Two really lame checks.
speculationCheck(
Uncountable, JSValueSource(), 0,
- m_jit.branchPtr(
+ m_jit.branch32(
MacroAssembler::AboveOrEqual, propertyReg,
MacroAssembler::Address(baseReg, OBJECT_OFFSETOF(Arguments, m_numArguments))));
speculationCheck(
