200388 2019-08-02 03:43:10 -0700 [JSC] LazyJSValue should be robust for empty JSValue 2019-08-02 15:20:59 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Local Build All All RESOLVED FIXED InRadar P2 Normal --- 1 zhunkibatu ysuzuki ews-watchlist fpizlo keith_miller mark.lam msaboff saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1557922 0 zhunkibatu 2019-08-02 03:43:10 -0700 the following poc can trigger an null pointer deref in DFGCFGSimplificationPhase.cpp function foo(x) { switch (x) { case "a": case "a": case "a": for (let j = 0; j <100; j++) { let j=foo(j); } default: return 2; } } for (let i = 0; i <100000; i++) { foo("ab"); } 1558084 1 ap 2019-08-02 13:26:43 -0700 REproduces in shipping Safari. Thread 9 Crashed:: DFG Worklist Worker Thread 0 com.apple.JavaScriptCore 0x00007fff30522a78 JSC::DFG::LazyJSValue::strictEqual(JSC::DFG::LazyJSValue const&) const + 408 1 com.apple.JavaScriptCore 0x00007fff2febf028 JSC::DFG::CFGSimplificationPhase::run() + 2504 2 com.apple.JavaScriptCore 0x00007fff30471ca8 bool JSC::DFG::runPhase<JSC::DFG::CFGSimplificationPhase>(JSC::DFG::Graph&) + 72 3 com.apple.JavaScriptCore 0x00007fff305c2aa9 JSC::DFG::Plan::compileInThreadImpl() + 2633 4 com.apple.JavaScriptCore 0x00007fff305c17fe JSC::DFG::Plan::compileInThread(JSC::DFG::ThreadData*) + 382 5 com.apple.JavaScriptCore 0x00007fff3060fa8c JSC::DFG::Worklist::ThreadBody::work() + 300 6 com.apple.JavaScriptCore 0x00007fff2ffa2a00 WTF::Function<void ()>::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0>::call() + 304 7 com.apple.JavaScriptCore 0x00007fff2ffd57f2 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 194 8 com.apple.JavaScriptCore 0x00007fff2fdf4c39 WTF::wtfThreadEntryPoint(void*) + 9 9 libsystem_pthread.dylib 0x00007fff58cb62eb _pthread_body + 126 10 libsystem_pthread.dylib 0x00007fff58cb9249 _pthread_start + 66 11 libsystem_pthread.dylib 0x00007fff58cb540d thread_start + 13 1558085 2 webkit-bug-importer 2019-08-02 13:26:57 -0700 <rdar://problem/53876863> 1558147 3 375460 ysuzuki 2019-08-02 14:49:41 -0700 Created attachment 375460 Patch 1558159 4 ysuzuki 2019-08-02 15:20:59 -0700 Committed r248185: <https://trac.webkit.org/changeset/248185> 375460 2019-08-02 14:49:41 -0700 2019-08-02 15:05:43 -0700 Patch bug-200388-20190802144940.patch text/plain 6822 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ4MTgwCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCAx OGQxYTMxNmJmODgwZDE4OTMxZGEwNjYyZjdlMzA4M2M3MDZkMmM5Li45ZmY2NGVkNTMyNmZjYjJk MGIwNzhkZTA0OThjMDRlZjBjYjlmMDZlIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwyMiBAQAorMjAxOS0wOC0wMiAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29t PgorCisgICAgICAgIFtKU0NdIExhenlKU1ZhbHVlIHNob3VsZCBiZSByb2J1c3QgZm9yIGVtcHR5 IEpTVmFsdWUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTIwMDM4OAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IElmIHRoZSBTd2l0Y2ggREZHIG5vZGUgaXMgcHJlY2VkZWQgYnkgRm9yY2VPU1JFeGl0IG9yIHNv bWV0aGluZyB0aGF0IGludmFsaWRhdGVzIHRoZSBiYXNpYyBibG9jaywKKyAgICAgICAgaXQgY2Fu IHRha2UgYSBGcm96ZW5WYWx1ZSBhcyBhIGNoaWxkIHdoaWNoIGluY2x1ZGVzIGVtcHR5IHZhbHVl IGluc3RlYWQgb2Ygc3RyaW5nLCBudW1iZXIgZXRjLgorICAgICAgICBJZiB0aGlzIFN3aXRjaCBu b2RlIGlzIGtlcHQgYW5kIHdlIHJlYWNoZWQgdG8gREZHQ0ZHU2ltcGxpZmljYXRpb25QaGFzZSwg aXQgd2lsbCB1c2UgdGhpcyBGcm96ZW5WYWx1ZS4KKyAgICAgICAgSG93ZXZlciwgTGF6eUpTVmFs dWUgdXNpbmcgdGhpcyBGcm96ZW5WYWx1ZSBzdHJvbmdseSBhc3N1bWVzIHRoYXQgRnJvemVuVmFs dWUgaXMgbmV2ZXIgaG9sZGluZyBlbXB0eSB2YWx1ZS4KKyAgICAgICAgQnV0IHRoaXMgYXNzdW1w dGlvbiBpcyB3cm9uZy4gVGhpcyBwYXRjaCBtYWtlcyBMYXp5SlNWYWx1ZSByb2J1c3QgZm9yIGVt cHR5IHZhbHVlLgorCisgICAgICAgICogZGZnL0RGR0xhenlKU1ZhbHVlLmNwcDoKKyAgICAgICAg KEpTQzo6REZHOjpMYXp5SlNWYWx1ZTo6dHJ5R2V0U3RyaW5nSW1wbCBjb25zdCk6CisgICAgICAg IChKU0M6OkRGRzo6TGF6eUpTVmFsdWU6OnRyeUdldFN0cmluZyBjb25zdCk6CisgICAgICAgIChK U0M6OkRGRzo6TGF6eUpTVmFsdWU6OnN0cmljdEVxdWFsIGNvbnN0KToKKyAgICAgICAgKEpTQzo6 REZHOjpMYXp5SlNWYWx1ZTo6c3dpdGNoTG9va3VwVmFsdWUgY29uc3QpOgorCiAyMDE5LTA4LTAy ICBEZXZpbiBSb3Vzc28gIDxkcm91c3NvQGFwcGxlLmNvbT4KIAogICAgICAgICBXZWIgSW5zcGVj dG9yOiBTdG9yYWdlOiBkaXNhYmxlIHJlbGF0ZWQgYWdlbnRzIHdoZW4gdGhlIHRhYiBpcyBjbG9z ZWQKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHTGF6eUpTVmFsdWUu Y3BwIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdMYXp5SlNWYWx1ZS5jcHAKaW5kZXgg NTgzZWU1YjMxOThiOWRkN2YyNmNmNTRiM2E5YWY3MDNkZjcxNWY2Zi4uMjQ1OGM0NmQyMTAwZjFi OGVjYTVkMDJjMTU1NTNkNjU5NGY5MzBmNyAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRD b3JlL2RmZy9ERkdMYXp5SlNWYWx1ZS5jcHAKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2Rm Zy9ERkdMYXp5SlNWYWx1ZS5jcHAKQEAgLTEwMCw5ICsxMDAsMTEgQEAgY29uc3QgU3RyaW5nSW1w bCogTGF6eUpTVmFsdWU6OnRyeUdldFN0cmluZ0ltcGwoVk0mIHZtKSBjb25zdAogICAgICAgICAg ICAgcmV0dXJuIHN0cmluZy0+dHJ5R2V0VmFsdWVJbXBsKCk7CiAgICAgICAgIHJldHVybiBudWxs cHRyOwogCi0gICAgZGVmYXVsdDoKKyAgICBjYXNlIFNpbmdsZUNoYXJhY3RlclN0cmluZzoKICAg ICAgICAgcmV0dXJuIG51bGxwdHI7CiAgICAgfQorICAgIFJFTEVBU0VfQVNTRVJUX05PVF9SRUFD SEVEKCk7CisgICAgcmV0dXJuIG51bGxwdHI7CiB9CiAKIFN0cmluZyBMYXp5SlNWYWx1ZTo6dHJ5 R2V0U3RyaW5nKEdyYXBoJiBncmFwaCkgY29uc3QKQEAgLTExNCw3ICsxMTYsOCBAQCBTdHJpbmcg TGF6eUpTVmFsdWU6OnRyeUdldFN0cmluZyhHcmFwaCYgZ3JhcGgpIGNvbnN0CiAgICAgY2FzZSBT aW5nbGVDaGFyYWN0ZXJTdHJpbmc6CiAgICAgICAgIHJldHVybiBTdHJpbmcoJnUuY2hhcmFjdGVy LCAxKTsKIAotICAgIGRlZmF1bHQ6CisgICAgY2FzZSBLbm93blZhbHVlOgorICAgIGNhc2UgS25v d25TdHJpbmdJbXBsOgogICAgICAgICBpZiAoY29uc3QgU3RyaW5nSW1wbCogc3RyaW5nID0gdHJ5 R2V0U3RyaW5nSW1wbChncmFwaC5tX3ZtKSkgewogICAgICAgICAgICAgdW5zaWduZWQgZ2lub3Jt b3VzU3RyaW5nTGVuZ3RoID0gMTAwMDA7CiAgICAgICAgICAgICBpZiAoc3RyaW5nLT5sZW5ndGgo KSA+IGdpbm9ybW91c1N0cmluZ0xlbmd0aCkKQEAgLTEyOCw2ICsxMzEsOCBAQCBTdHJpbmcgTGF6 eUpTVmFsdWU6OnRyeUdldFN0cmluZyhHcmFwaCYgZ3JhcGgpIGNvbnN0CiAgICAgICAgIAogICAg ICAgICByZXR1cm4gU3RyaW5nKCk7CiAgICAgfQorICAgIFJFTEVBU0VfQVNTRVJUX05PVF9SRUFD SEVEKCk7CisgICAgcmV0dXJuIFN0cmluZygpOwogfQogCiBUcmlTdGF0ZSBMYXp5SlNWYWx1ZTo6 c3RyaWN0RXF1YWwoY29uc3QgTGF6eUpTVmFsdWUmIG90aGVyKSBjb25zdApAQCAtMTM1LDE0ICsx NDAsMjMgQEAgVHJpU3RhdGUgTGF6eUpTVmFsdWU6OnN0cmljdEVxdWFsKGNvbnN0IExhenlKU1Zh bHVlJiBvdGhlcikgY29uc3QKICAgICBzd2l0Y2ggKG1fa2luZCkgewogICAgIGNhc2UgS25vd25W YWx1ZToKICAgICAgICAgc3dpdGNoIChvdGhlci5tX2tpbmQpIHsKLSAgICAgICAgY2FzZSBLbm93 blZhbHVlOgorICAgICAgICBjYXNlIEtub3duVmFsdWU6IHsKKyAgICAgICAgICAgIGlmICghdmFs dWUoKS0+dmFsdWUoKSB8fCAhb3RoZXIudmFsdWUoKS0+dmFsdWUoKSkKKyAgICAgICAgICAgICAg ICByZXR1cm4gdmFsdWUoKS0+dmFsdWUoKSA9PSBvdGhlci52YWx1ZSgpLT52YWx1ZSgpID8gVHJ1 ZVRyaVN0YXRlIDogRmFsc2VUcmlTdGF0ZTsKICAgICAgICAgICAgIHJldHVybiBKU1ZhbHVlOjpw dXJlU3RyaWN0RXF1YWwodmFsdWUoKS0+dmFsdWUoKSwgb3RoZXIudmFsdWUoKS0+dmFsdWUoKSk7 Ci0gICAgICAgIGNhc2UgU2luZ2xlQ2hhcmFjdGVyU3RyaW5nOgorICAgICAgICB9CisgICAgICAg IGNhc2UgU2luZ2xlQ2hhcmFjdGVyU3RyaW5nOiB7CisgICAgICAgICAgICBpZiAoIXZhbHVlKCkt PnZhbHVlKCkpCisgICAgICAgICAgICAgICAgcmV0dXJuIEZhbHNlVHJpU3RhdGU7CiAgICAgICAg ICAgICByZXR1cm4gZXF1YWxUb1NpbmdsZUNoYXJhY3Rlcih2YWx1ZSgpLT52YWx1ZSgpLCBvdGhl ci5jaGFyYWN0ZXIoKSk7CisgICAgICAgIH0KICAgICAgICAgY2FzZSBLbm93blN0cmluZ0ltcGw6 Ci0gICAgICAgIGNhc2UgTmV3U3RyaW5nSW1wbDoKKyAgICAgICAgY2FzZSBOZXdTdHJpbmdJbXBs OiB7CisgICAgICAgICAgICBpZiAoIXZhbHVlKCktPnZhbHVlKCkpCisgICAgICAgICAgICAgICAg cmV0dXJuIEZhbHNlVHJpU3RhdGU7CiAgICAgICAgICAgICByZXR1cm4gZXF1YWxUb1N0cmluZ0lt cGwodmFsdWUoKS0+dmFsdWUoKSwgb3RoZXIuc3RyaW5nSW1wbCgpKTsKICAgICAgICAgfQorICAg ICAgICB9CiAgICAgICAgIGJyZWFrOwogICAgIGNhc2UgU2luZ2xlQ2hhcmFjdGVyU3RyaW5nOgog ICAgICAgICBzd2l0Y2ggKG90aGVyLm1fa2luZCkgewpAQCAtMTUzLDcgKzE2Nyw3IEBAIFRyaVN0 YXRlIExhenlKU1ZhbHVlOjpzdHJpY3RFcXVhbChjb25zdCBMYXp5SlNWYWx1ZSYgb3RoZXIpIGNv bnN0CiAgICAgICAgICAgICBpZiAob3RoZXIuc3RyaW5nSW1wbCgpLT5sZW5ndGgoKSAhPSAxKQog ICAgICAgICAgICAgICAgIHJldHVybiBGYWxzZVRyaVN0YXRlOwogICAgICAgICAgICAgcmV0dXJu IHRyaVN0YXRlKG90aGVyLnN0cmluZ0ltcGwoKS0+YXQoMCkgPT0gY2hhcmFjdGVyKCkpOwotICAg ICAgICBkZWZhdWx0OgorICAgICAgICBjYXNlIEtub3duVmFsdWU6CiAgICAgICAgICAgICByZXR1 cm4gb3RoZXIuc3RyaWN0RXF1YWwoKnRoaXMpOwogICAgICAgICB9CiAgICAgICAgIGJyZWFrOwpA QCAtMTYzLDcgKzE3Nyw4IEBAIFRyaVN0YXRlIExhenlKU1ZhbHVlOjpzdHJpY3RFcXVhbChjb25z dCBMYXp5SlNWYWx1ZSYgb3RoZXIpIGNvbnN0CiAgICAgICAgIGNhc2UgS25vd25TdHJpbmdJbXBs OgogICAgICAgICBjYXNlIE5ld1N0cmluZ0ltcGw6CiAgICAgICAgICAgICByZXR1cm4gdHJpU3Rh dGUoV1RGOjplcXVhbChzdHJpbmdJbXBsKCksIG90aGVyLnN0cmluZ0ltcGwoKSkpOwotICAgICAg ICBkZWZhdWx0OgorICAgICAgICBjYXNlIFNpbmdsZUNoYXJhY3RlclN0cmluZzoKKyAgICAgICAg Y2FzZSBLbm93blZhbHVlOgogICAgICAgICAgICAgcmV0dXJuIG90aGVyLnN0cmljdEVxdWFsKCp0 aGlzKTsKICAgICAgICAgfQogICAgICAgICBicmVhazsKQEAgLTE4MSw5ICsxOTYsMTMgQEAgdWlu dHB0cl90IExhenlKU1ZhbHVlOjpzd2l0Y2hMb29rdXBWYWx1ZShTd2l0Y2hLaW5kIGtpbmQpIGNv bnN0CiAgICAgY2FzZSBLbm93blZhbHVlOgogICAgICAgICBzd2l0Y2ggKGtpbmQpIHsKICAgICAg ICAgY2FzZSBTd2l0Y2hJbW06Ci0gICAgICAgICAgICByZXR1cm4gdmFsdWUoKS0+dmFsdWUoKS5h c0ludDMyKCk7CisgICAgICAgICAgICBpZiAodmFsdWUoKS0+dmFsdWUoKSkKKyAgICAgICAgICAg ICAgICByZXR1cm4gdmFsdWUoKS0+dmFsdWUoKS5hc0ludDMyKCk7CisgICAgICAgICAgICByZXR1 cm4gMDsKICAgICAgICAgY2FzZSBTd2l0Y2hDZWxsOgotICAgICAgICAgICAgcmV0dXJuIGJpdHdp c2VfY2FzdDx1aW50cHRyX3Q+KHZhbHVlKCktPnZhbHVlKCkuYXNDZWxsKCkpOworICAgICAgICAg ICAgaWYgKHZhbHVlKCktPnZhbHVlKCkpCisgICAgICAgICAgICAgICAgcmV0dXJuIGJpdHdpc2Vf Y2FzdDx1aW50cHRyX3Q+KHZhbHVlKCktPnZhbHVlKCkuYXNDZWxsKCkpOworICAgICAgICAgICAg cmV0dXJuIDA7CiAgICAgICAgIGRlZmF1bHQ6CiAgICAgICAgICAgICBSRUxFQVNFX0FTU0VSVF9O T1RfUkVBQ0hFRCgpOwogICAgICAgICAgICAgcmV0dXJuIDA7CkBAIC0xOTYsMTAgKzIxNSwxMyBA QCB1aW50cHRyX3QgTGF6eUpTVmFsdWU6OnN3aXRjaExvb2t1cFZhbHVlKFN3aXRjaEtpbmQga2lu ZCkgY29uc3QKICAgICAgICAgICAgIFJFTEVBU0VfQVNTRVJUX05PVF9SRUFDSEVEKCk7CiAgICAg ICAgICAgICByZXR1cm4gMDsKICAgICAgICAgfQotICAgIGRlZmF1bHQ6CisgICAgY2FzZSBLbm93 blN0cmluZ0ltcGw6CisgICAgY2FzZSBOZXdTdHJpbmdJbXBsOgogICAgICAgICBSRUxFQVNFX0FT U0VSVF9OT1RfUkVBQ0hFRCgpOwogICAgICAgICByZXR1cm4gMDsKICAgICB9CisgICAgUkVMRUFT RV9BU1NFUlRfTk9UX1JFQUNIRUQoKTsKKyAgICByZXR1cm4gMDsKIH0KIAogdm9pZCBMYXp5SlNW YWx1ZTo6ZW1pdChDQ2FsbEhlbHBlcnMmIGppdCwgSlNWYWx1ZVJlZ3MgcmVzdWx0KSBjb25zdApk aWZmIC0tZ2l0IGEvSlNUZXN0cy9DaGFuZ2VMb2cgYi9KU1Rlc3RzL0NoYW5nZUxvZwppbmRleCA1 YTk1NDc3Y2I5N2UxMDZmZWYxYzkzYTg3YTU1NGM5NjE5YzljM2EwLi5jZWFhNDM0YWI3OTI2YTI3 MTQ3ZjY4YWRiOWI2MzM2MzI4NGYxMTQ5IDEwMDY0NAotLS0gYS9KU1Rlc3RzL0NoYW5nZUxvZwor KysgYi9KU1Rlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEzIEBACisyMDE5LTA4LTAyICBZdXN1 a2UgU3V6dWtpICA8eXN1enVraUBhcHBsZS5jb20+CisKKyAgICAgICAgW0pTQ10gTGF6eUpTVmFs dWUgc2hvdWxkIGJlIHJvYnVzdCBmb3IgZW1wdHkgSlNWYWx1ZQorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjAwMzg4CisKKyAgICAgICAgUmV2aWV3ZWQg YnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBzdHJlc3Mvc3dpdGNoLWNvbnN0YW50LWNo aWxkLWJlY29tZXMtZW1wdHkuanM6IEFkZGVkLgorICAgICAgICAoZm9vKToKKwogMjAxOS0wOC0w MSAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29tPgogCiAgICAgICAgIEdldHRlclNl dHRlciB0eXBlIGNvbmZ1c2lvbiBkdXJpbmcgREZHIGNvbXBpbGF0aW9uCmRpZmYgLS1naXQgYS9K U1Rlc3RzL3N0cmVzcy9zd2l0Y2gtY29uc3RhbnQtY2hpbGQtYmVjb21lcy1lbXB0eS5qcyBiL0pT VGVzdHMvc3RyZXNzL3N3aXRjaC1jb25zdGFudC1jaGlsZC1iZWNvbWVzLWVtcHR5LmpzCm5ldyBm aWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAuLjczNmRmMTdlNDRkNzBhNDdlMGJjMGFkMjY3ZTcwZGMwNzUxNWVmZDIKLS0tIC9kZXYv bnVsbAorKysgYi9KU1Rlc3RzL3N0cmVzcy9zd2l0Y2gtY29uc3RhbnQtY2hpbGQtYmVjb21lcy1l bXB0eS5qcwpAQCAtMCwwICsxLDE3IEBACisvL0AgcnVuRGVmYXVsdCgiLS11c2VDb25jdXJyZW50 SklUPTAiKQorZnVuY3Rpb24gZm9vKHgpIHsKKyAgICBzd2l0Y2ggKHgpIHsKKyAgICBjYXNlICJh IjoKKyAgICBjYXNlICJhIjoKKyAgICBjYXNlICJhIjoKKyAgICAgICAgZm9yIChsZXQgaiA9IDA7 IGogPDEwMDsgaisrKSB7CisgICAgICAgICAgICBsZXQgaj1mb28oaik7CisgICAgICAgIH0KKyAg ICBkZWZhdWx0OgorICAgICAgICByZXR1cm4gMjsKKyAgICB9Cit9CisKK2ZvciAobGV0IGkgPSAw OyBpIDwxMDAwMDA7IGkrKykgeworICAgIGZvbygiYWIiKTsKK30K