164834 2016-11-16 13:57:16 -0800 ExceptionFuzz functions should use its client's ThrowScope. 2016-11-16 15:18:21 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 mark.lam mark.lam commit-queue fpizlo ggaren jfbastien keith_miller msaboff saam ysuzuki oldest_to_newest 1252004 0 mark.lam 2016-11-16 13:57:16 -0800 This is because ExceptionFuzz's purpose is to throw exceptions from its client at exception check sites. Using the client's ThrowScope solves 2 problems: 1. If ExceptionFuzz makes its own ThrowScope, the simulated throw will be mis-attributed to ExceptionFuzz when it should be attributed to its client. 2. One way exception scope verification works is by having ThrowScopes assert that there are no unchecked simulated exceptions when the ThrowScope is instantiated. However, ExceptionFuzz necessarily works by inserting doExceptionFuzzingIfEnabled() between a ThrowScope that simulated a throw and an exception check. If we declare a ThrowScope in ExceptionFuzz's code, we will be instantiating a ThrowScope between the point where a simulated throw occurs and where the needed exception check can occur. Hence, having ExceptionFuzz instantiate its own ThrowScope will fail exception scope verification every time. Changing ExceptionFuzz to use its client's ThrowScope resolves both problems. 1252006 1 294973 mark.lam 2016-11-16 14:03:35 -0800 Created attachment 294973 proposed patch. 1252007 2 commit-queue 2016-11-16 14:04:52 -0800 Attachment 294973 did not pass style-queue: ERROR: Source/JavaScriptCore/ChangeLog:17: Please consider whether the use of security-sensitive phrasing could help someone exploit WebKit: fuzzing, fuzzing, fuzzing [changelog/unwantedsecurityterms] [3] Total errors found: 1 in 6 files If any of these errors are false positives, please file a bug against check-webkit-style. 1252011 3 294973 ggaren 2016-11-16 14:10:50 -0800 Comment on attachment 294973 proposed patch. r=me 1252032 4 294973 mark.lam 2016-11-16 14:52:32 -0800 Comment on attachment 294973 proposed patch. Thanks for the review. Landing via cq. 1252052 5 294973 commit-queue 2016-11-16 15:18:16 -0800 Comment on attachment 294973 proposed patch. Clearing flags on attachment: 294973 Committed r208819: <http://trac.webkit.org/changeset/208819> 1252053 6 commit-queue 2016-11-16 15:18:21 -0800 All reviewed patches have been landed. Closing bug. 294973 2016-11-16 14:03:35 -0800 2016-11-16 15:18:16 -0800 proposed patch. bug-164834.patch text/plain 7202 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjA4ODA5KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDM5IEBA CisyMDE2LTExLTE2ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBF eGNlcHRpb25GdXp6IGZ1bmN0aW9ucyBzaG91bGQgdXNlIGl0cyBjbGllbnQncyBUaHJvd1Njb3Bl LgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTY0ODM0 CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhpcyBp cyBiZWNhdXNlIEV4Y2VwdGlvbkZ1enoncyBwdXJwb3NlIGlzIHRvIHRocm93IGV4Y2VwdGlvbnMg ZnJvbSBpdHMgY2xpZW50IGF0CisgICAgICAgIGV4Y2VwdGlvbiBjaGVjayBzaXRlcy4gIFVzaW5n IHRoZSBjbGllbnQncyBUaHJvd1Njb3BlIHNvbHZlcyAyIHByb2JsZW1zOgorCisgICAgICAgIDEu IElmIEV4Y2VwdGlvbkZ1enogaW5zdGFudGlhdGVzIGl0cyBvd24gVGhyb3dTY29wZSwgdGhlIHNp bXVsYXRlZCB0aHJvdyB3aWxsIGJlCisgICAgICAgICAgIG1pcy1hdHRyaWJ1dGVkIHRvIEV4Y2Vw dGlvbkZ1enogd2hlbiBpdCBzaG91bGQgYmUgYXR0cmlidXRlZCB0byBpdHMgY2xpZW50LgorCisg ICAgICAgIDIuIE9uZSB3YXkgZXhjZXB0aW9uIHNjb3BlIHZlcmlmaWNhdGlvbiB3b3JrcyBpcyBi eSBoYXZpbmcgVGhyb3dTY29wZXMgYXNzZXJ0CisgICAgICAgICAgIHRoYXQgdGhlcmUgYXJlIG5v IHVuY2hlY2tlZCBzaW11bGF0ZWQgZXhjZXB0aW9ucyB3aGVuIHRoZSBUaHJvd1Njb3BlIGlzCisg ICAgICAgICAgIGluc3RhbnRpYXRlZC4gIEhvd2V2ZXIsIEV4Y2VwdGlvbkZ1enogbmVjZXNzYXJp bHkgd29ya3MgYnkgaW5zZXJ0aW5nCisgICAgICAgICAgIGRvRXhjZXB0aW9uRnV6emluZ0lmRW5h YmxlZCgpIGluIGJldHdlZW4gYSBUaHJvd1Njb3BlIHRoYXQgc2ltdWxhdGVkIGEgdGhyb3cKKyAg ICAgICAgICAgYW5kIGFuIGV4Y2VwdGlvbiBjaGVjay4gIElmIHdlIGRlY2xhcmUgYSBUaHJvd1Nj b3BlIGluIEV4Y2VwdGlvbkZ1enoncyBjb2RlLAorICAgICAgICAgICB3ZSB3aWxsIGJlIGluc3Rh bnRpYXRpbmcgdGhlIFRocm93U2NvcGUgYmV0d2VlbiB0aGUgcG9pbnQgd2hlcmUgYSBzaW11bGF0 ZWQKKyAgICAgICAgICAgdGhyb3cgb2NjdXJzIGFuZCB3aGVyZSB0aGUgbmVlZGVkIGV4Y2VwdGlv biBjaGVjayBjYW4gb2NjdXIuICBIZW5jZSwgaGF2aW5nCisgICAgICAgICAgIEV4Y2VwdGlvbkZ1 enogaW5zdGFudGlhdGUgaXRzIG93biBUaHJvd1Njb3BlIHdpbGwgZmFpbCBleGNlcHRpb24gc2Nv cGUKKyAgICAgICAgICAgdmVyaWZpY2F0aW9uIGV2ZXJ5IHRpbWUuCisKKyAgICAgICAgQ2hhbmdp bmcgRXhjZXB0aW9uRnV6eiB0byB1c2UgaXRzIGNsaWVudCdzIFRocm93U2NvcGUgcmVzb2x2ZXMg Ym90aCBwcm9ibGVtcy4KKworICAgICAgICBBbHNvIGZpeGVkIHRoZSBUSFJPVygpIG1hY3JvIGlu IENvbW1vblNsb3dQYXRocy5jcHAgdG8gdXNlIHRoZSBUaHJvd1Njb3BlIHRoYXQKKyAgICAgICAg YWxyZWFkeSBleGlzdHMgaW4gZXZlcnkgc2xvdyBwYXRoIGZ1bmN0aW9uIGluc3RlYWQgb2YgY3Jl YXRpbmcgYSBuZXcgb25lLgorCisgICAgICAgICogaml0L0pJVE9wZXJhdGlvbnMuY3BwOgorICAg ICAgICAqIGxsaW50L0xMSW50U2xvd1BhdGhzLmNwcDoKKyAgICAgICAgKiBydW50aW1lL0NvbW1v blNsb3dQYXRocy5jcHA6CisgICAgICAgICogcnVudGltZS9FeGNlcHRpb25GdXp6LmNwcDoKKyAg ICAgICAgKEpTQzo6ZG9FeGNlcHRpb25GdXp6aW5nKToKKyAgICAgICAgKiBydW50aW1lL0V4Y2Vw dGlvbkZ1enouaDoKKyAgICAgICAgKEpTQzo6ZG9FeGNlcHRpb25GdXp6aW5nSWZFbmFibGVkKToK KwogMjAxNi0xMS0xNiAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBsZS5jb20+CiAKICAgICAgICAg Rml4IGV4Y2VwdGlvbiBzY29wZSBjaGVja2luZyBpbiBKU0dsb2JhbE9iamVjdC5jcHAuCkluZGV4 OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVE9wZXJhdGlvbnMuY3BwCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUT3BlcmF0aW9ucy5jcHAJKHJldmlzaW9u IDIwODc5OSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUT3BlcmF0aW9ucy5jcHAJ KHdvcmtpbmcgY29weSkKQEAgLTIyNzEsOSArMjI3MSwxMSBAQCB2b2lkIEpJVF9PUEVSQVRJT04g b3BlcmF0aW9uRXhjZXB0aW9uRnV6CiB7CiAgICAgVk0qIHZtID0gJmV4ZWMtPnZtKCk7CiAgICAg TmF0aXZlQ2FsbEZyYW1lVHJhY2VyIHRyYWNlcih2bSwgZXhlYyk7CisgICAgYXV0byBzY29wZSA9 IERFQ0xBUkVfVEhST1dfU0NPUEUoKnZtKTsKKyAgICBVTlVTRURfUEFSQU0oc2NvcGUpOwogI2lm IENPTVBJTEVSKEdDQ19PUl9DTEFORykKICAgICB2b2lkKiByZXR1cm5QQyA9IF9fYnVpbHRpbl9y ZXR1cm5fYWRkcmVzcygwKTsKLSAgICBkb0V4Y2VwdGlvbkZ1enppbmcoZXhlYywgIkpJVE9wZXJh dGlvbnMiLCByZXR1cm5QQyk7CisgICAgZG9FeGNlcHRpb25GdXp6aW5nKGV4ZWMsIHNjb3BlLCAi SklUT3BlcmF0aW9ucyIsIHJldHVyblBDKTsKICNlbmRpZiAvLyBDT01QSUxFUihHQ0NfT1JfQ0xB TkcpCiB9CiAKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9MTEludFNsb3dQYXRo cy5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xMSW50U2xv d1BhdGhzLmNwcAkocmV2aXNpb24gMjA4Nzk5KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2xs aW50L0xMSW50U2xvd1BhdGhzLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTA4LDcgKzEwOCw3IEBA IG5hbWVzcGFjZSBKU0MgeyBuYW1lc3BhY2UgTExJbnQgewogICAgIH0gd2hpbGUgKGZhbHNlKQog CiAjZGVmaW5lIExMSU5UX0NIRUNLX0VYQ0VQVElPTigpIGRvIHsgICAgICAgICAgICAgICAgICAg IFwKLSAgICAgICAgZG9FeGNlcHRpb25GdXp6aW5nSWZFbmFibGVkKGV4ZWMsICJMTEludFNsb3dQ YXRocyIsIHBjKTsgICAgXAorICAgICAgICBkb0V4Y2VwdGlvbkZ1enppbmdJZkVuYWJsZWQoZXhl YywgdGhyb3dTY29wZSwgIkxMSW50U2xvd1BhdGhzIiwgcGMpOyAgICBcCiAgICAgICAgIGlmIChV TkxJS0VMWSh0aHJvd1Njb3BlLmV4Y2VwdGlvbigpKSkgeyAgICAgICAgIFwKICAgICAgICAgICAg IHBjID0gcmV0dXJuVG9UaHJvdyhleGVjKTsgICAgICAgICAgICAgICAgICAgXAogICAgICAgICAg ICAgTExJTlRfRU5EX0lNUEwoKTsgICAgICAgICAgICAgICAgICAgICAgICAgICBcCkBAIC0xNjks NyArMTY5LDcgQEAgbmFtZXNwYWNlIEpTQyB7IG5hbWVzcGFjZSBMTEludCB7CiAjZGVmaW5lIExM SU5UX0NBTExfQ0hFQ0tfRVhDRVBUSU9OKGV4ZWMsIGV4ZWNDYWxsZWUpIGRvIHsgICAgICAgICAg ICAgICBcCiAgICAgICAgIEV4ZWNTdGF0ZSogX19jY2VfZXhlYyA9IChleGVjKTsgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBcCiAgICAgICAgIEV4ZWNTdGF0ZSogX19jY2VfZXhlY0Nh bGxlZSA9IChleGVjQ2FsbGVlKTsgICAgICAgICAgICAgICAgICAgICBcCi0gICAgICAgIGRvRXhj ZXB0aW9uRnV6emluZ0lmRW5hYmxlZChfX2NjZV9leGVjLCAiTExJbnRTbG93UGF0aHMvY2FsbCIs IG51bGxwdHIpOyBcCisgICAgICAgIGRvRXhjZXB0aW9uRnV6emluZ0lmRW5hYmxlZChfX2NjZV9l eGVjLCB0aHJvd1Njb3BlLCAiTExJbnRTbG93UGF0aHMvY2FsbCIsIG51bGxwdHIpOyBcCiAgICAg ICAgIGlmIChVTkxJS0VMWSh0aHJvd1Njb3BlLmV4Y2VwdGlvbigpKSkgICAgICAgICAgICAgICAg ICAgICAgICAgICBcCiAgICAgICAgICAgICBMTElOVF9DQUxMX0VORF9JTVBMKDAsIGNhbGxUb1Ro cm93KF9fY2NlX2V4ZWNDYWxsZWUpKTsgICAgICBcCiAgICAgfSB3aGlsZSAoZmFsc2UpCkluZGV4 OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9Db21tb25TbG93UGF0aHMuY3BwCj09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0NvbW1vblNsb3dQYXRocy5j cHAJKHJldmlzaW9uIDIwODc5OSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0Nv bW1vblNsb3dQYXRocy5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTk2LDE0ICs5NiwxMyBAQCBuYW1l c3BhY2UgSlNDIHsKICNkZWZpbmUgRU5EX0lNUEwoKSBSRVRVUk5fVFdPKHBjLCBleGVjKQogCiAj ZGVmaW5lIFRIUk9XKGV4Y2VwdGlvblRvVGhyb3cpIGRvIHsgICAgICAgICAgICAgICAgICAgICAg ICBcCi0gICAgICAgIGF1dG8gc2NvcGUgPSBERUNMQVJFX1RIUk9XX1NDT1BFKHZtKTsgICAgICAg ICAgICAgICBcCi0gICAgICAgIHRocm93RXhjZXB0aW9uKGV4ZWMsIHNjb3BlLCBleGNlcHRpb25U b1Rocm93KTsgICAgICBcCisgICAgICAgIHRocm93RXhjZXB0aW9uKGV4ZWMsIHRocm93U2NvcGUs IGV4Y2VwdGlvblRvVGhyb3cpOyBcCiAgICAgICAgIFJFVFVSTl9UT19USFJPVyhleGVjLCBwYyk7 ICAgICAgICAgICAgICAgICAgICAgICAgICBcCiAgICAgICAgIEVORF9JTVBMKCk7ICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcCiAgICAgfSB3aGlsZSAoZmFsc2UpCiAK ICNkZWZpbmUgQ0hFQ0tfRVhDRVBUSU9OKCkgZG8geyAgICAgICAgICAgICAgICAgICAgXAotICAg ICAgICBkb0V4Y2VwdGlvbkZ1enppbmdJZkVuYWJsZWQoZXhlYywgIkNvbW1vblNsb3dQYXRocyIs IHBjKTsgICBcCisgICAgICAgIGRvRXhjZXB0aW9uRnV6emluZ0lmRW5hYmxlZChleGVjLCB0aHJv d1Njb3BlLCAiQ29tbW9uU2xvd1BhdGhzIiwgcGMpOyAgIFwKICAgICAgICAgaWYgKFVOTElLRUxZ KHRocm93U2NvcGUuZXhjZXB0aW9uKCkpKSB7ICAgXAogICAgICAgICAgICAgUkVUVVJOX1RPX1RI Uk9XKGV4ZWMsIHBjKTsgICAgICAgICAgICBcCiAgICAgICAgICAgICBFTkRfSU1QTCgpOyAgICAg ICAgICAgICAgICAgICAgICAgICAgIFwKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50 aW1lL0V4Y2VwdGlvbkZ1enouY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS9ydW50aW1lL0V4Y2VwdGlvbkZ1enouY3BwCShyZXZpc2lvbiAyMDg3OTkpCisrKyBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvcnVudGltZS9FeGNlcHRpb25GdXp6LmNwcAkod29ya2luZyBjb3B5KQpA QCAtMzYsMTAgKzM2LDkgQEAgc3RhdGljIHVuc2lnbmVkIHNfbnVtYmVyT2ZFeGNlcHRpb25GdXp6 QwogdW5zaWduZWQgbnVtYmVyT2ZFeGNlcHRpb25GdXp6Q2hlY2tzKCkgeyByZXR1cm4gc19udW1i ZXJPZkV4Y2VwdGlvbkZ1enpDaGVja3M7IH0KIAogLy8gQ2FsbCB0aGlzIG9ubHkgaWYgeW91IGtu b3cgdGhhdCBleGNlcHRpb24gZnV6emluZyBpcyBlbmFibGVkLgotdm9pZCBkb0V4Y2VwdGlvbkZ1 enppbmcoRXhlY1N0YXRlKiBleGVjLCBjb25zdCBjaGFyKiB3aGVyZSwgdm9pZCogcmV0dXJuUEMp Cit2b2lkIGRvRXhjZXB0aW9uRnV6emluZyhFeGVjU3RhdGUqIGV4ZWMsIFRocm93U2NvcGUmIHNj b3BlLCBjb25zdCBjaGFyKiB3aGVyZSwgdm9pZCogcmV0dXJuUEMpCiB7Ci0gICAgVk0mIHZtID0g ZXhlYy0+dm0oKTsKLSAgICBhdXRvIHNjb3BlID0gREVDTEFSRV9USFJPV19TQ09QRSh2bSk7Cisg ICAgVk0mIHZtID0gc2NvcGUudm0oKTsKICAgICBBU1NFUlQoT3B0aW9uczo6dXNlRXhjZXB0aW9u RnV6eigpKTsKIAogICAgIERlZmVyR0NGb3JBV2hpbGUgZGVmZXJHQyh2bS5oZWFwKTsKSW5kZXg6 IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0V4Y2VwdGlvbkZ1enouaAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9FeGNlcHRpb25GdXp6LmgJKHJldmlz aW9uIDIwODc5OSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0V4Y2VwdGlvbkZ1 enouaAkod29ya2luZyBjb3B5KQpAQCAtMzAsMTYgKzMwLDE3IEBACiBuYW1lc3BhY2UgSlNDIHsK IAogY2xhc3MgRXhlY1N0YXRlOworY2xhc3MgVGhyb3dTY29wZTsKIAogLy8gQ2FsbCB0aGlzIG9u bHkgaWYgeW91IGtub3cgdGhhdCBleGNlcHRpb24gZnV6emluZyBpcyBlbmFibGVkLgotdm9pZCBk b0V4Y2VwdGlvbkZ1enppbmcoRXhlY1N0YXRlKiBleGVjLCBjb25zdCBjaGFyKiB3aGVyZSwgdm9p ZCogcmV0dXJuUEMpOwordm9pZCBkb0V4Y2VwdGlvbkZ1enppbmcoRXhlY1N0YXRlKiwgVGhyb3dT Y29wZSYsIGNvbnN0IGNoYXIqIHdoZXJlLCB2b2lkKiByZXR1cm5QQyk7CiAKIC8vIFRoaXMgaXMg d2hhdCB5b3Ugc2hvdWxkIGNhbGwgaWYgeW91IGRvbid0IGtub3cgaWYgZnV6emluZyBpcyBlbmFi bGVkLgotQUxXQVlTX0lOTElORSB2b2lkIGRvRXhjZXB0aW9uRnV6emluZ0lmRW5hYmxlZChFeGVj U3RhdGUqIGV4ZWMsIGNvbnN0IGNoYXIqIHdoZXJlLCB2b2lkKiByZXR1cm5QQykKK0FMV0FZU19J TkxJTkUgdm9pZCBkb0V4Y2VwdGlvbkZ1enppbmdJZkVuYWJsZWQoRXhlY1N0YXRlKiBleGVjLCBU aHJvd1Njb3BlJiBzY29wZSwgY29uc3QgY2hhciogd2hlcmUsIHZvaWQqIHJldHVyblBDKQogewog ICAgIGlmIChMSUtFTFkoIU9wdGlvbnM6OnVzZUV4Y2VwdGlvbkZ1enooKSkpCiAgICAgICAgIHJl dHVybjsKLSAgICBkb0V4Y2VwdGlvbkZ1enppbmcoZXhlYywgd2hlcmUsIHJldHVyblBDKTsKKyAg ICBkb0V4Y2VwdGlvbkZ1enppbmcoZXhlYywgc2NvcGUsIHdoZXJlLCByZXR1cm5QQyk7CiB9CiAK IH0gLy8gbmFtZXNwYWNlIEpTQwo=