231252 2021-10-05 14:06:20 -0700 Speculative fix for a null pointer dereference in ByteCodeParser::handlePutByVal. 2021-10-06 10:31:55 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam ews-watchlist keith_miller msaboff saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1800748 0 mark.lam 2021-10-05 14:06:20 -0700 We're seeing a null pointer dereference in ByteCodeParser::handlePutByVal(). Adding a null check here as a speculative fix to mitigate crashes while we investigate further. rdar://83310320 1800754 1 440265 mark.lam 2021-10-05 14:14:45 -0700 Created attachment 440265 proposed patch. 1800760 2 440265 ysuzuki 2021-10-05 14:20:57 -0700 Comment on attachment 440265 proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=440265&action=review r=me > Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:8881 > + auto* impl = string->tryGetValueImpl(); > + ASSERT(impl); // FIXME: rdar://83902782 > + if (impl && impl->isAtom() && !parseIndex(*const_cast<StringImpl*>(impl))) { Similar thing exists on op_put_private_name. Please change all of these things in DFG::ByteCodeParser. 1800771 3 440271 mark.lam 2021-10-05 14:35:04 -0700 Created attachment 440271 [fast-cq] patch for landing. Thanks for the review. 1801167 4 ews-feeder 2021-10-06 10:31:52 -0700 Committed r283632 (242583@main): <https://commits.webkit.org/242583@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 440271. 440265 2021-10-05 14:14:45 -0700 2021-10-05 14:40:41 -0700 proposed patch. bug-231252.patch text/plain 1947 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjgzNTY4KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDIxLTEwLTA1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBT cGVjdWxhdGl2ZSBmaXggZm9yIGEgbnVsbCBwb2ludGVyIGRlcmVmZXJlbmNlIGluIEJ5dGVDb2Rl UGFyc2VyOjpoYW5kbGVQdXRCeVZhbC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTIzMTI1MgorICAgICAgICByZGFyOi8vODMzMTAzMjAKKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXZSdyZSBzZWVpbmcgYSBu dWxsIHBvaW50ZXIgZGVyZWZlcmVuY2UgaW4gQnl0ZUNvZGVQYXJzZXI6OmhhbmRsZVB1dEJ5VmFs KCkuCisgICAgICAgIEFkZGluZyBhIG51bGwgY2hlY2sgaGVyZSBhcyBhIHNwZWN1bGF0aXZlIGZp eCB0byBtaXRpZ2F0ZSBjcmFzaGVzIHdoaWxlIHdlCisgICAgICAgIGludmVzdGlnYXRlIGZ1cnRo ZXIuCisKKyAgICAgICAgKiBkZmcvREZHQnl0ZUNvZGVQYXJzZXIuY3BwOgorICAgICAgICAoSlND OjpERkc6OkJ5dGVDb2RlUGFyc2VyOjpoYW5kbGVQdXRCeVZhbCk6CisKIDIwMjEtMTAtMDUgIE1h cmsgTGFtICA8bWFyay5sYW1AYXBwbGUuY29tPgogCiAgICAgICAgIENvZGVCbG9jayBzaG91bGQg bm90IGFkZC9yZW1vdmUgTG9vcEhpbnRFeGVjdXRpb25Db3VudGVycy4KSW5kZXg6IFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9kZmcvREZHQnl0ZUNvZGVQYXJzZXIuY3BwCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv dXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQnl0ZUNvZGVQYXJzZXIuY3BwCShyZXZpc2lvbiAy ODM1NjgpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNw cAkod29ya2luZyBjb3B5KQpAQCAtODg3Niw3ICs4ODc2LDkgQEAgdm9pZCBCeXRlQ29kZVBhcnNl cjo6aGFuZGxlUHV0QnlWYWwoQnl0ZQogICAgICAgICAgICAgICAgIEZyb3plblZhbHVlKiBmcm96 ZW4gPSBtX2dyYXBoLmZyZWV6ZVN0cm9uZyhzeW1ib2wpOwogICAgICAgICAgICAgICAgIGFkZFRv R3JhcGgoQ2hlY2tJc0NvbnN0YW50LCBPcEluZm8oZnJvemVuKSwgcHJvcGVydHkpOwogICAgICAg ICAgICAgfSBlbHNlIGlmIChhdXRvKiBzdHJpbmcgPSBwcm9wZXJ0eS0+ZHluYW1pY0Nhc3RDb25z dGFudDxKU1N0cmluZyo+KCptX3ZtKSkgewotICAgICAgICAgICAgICAgIGlmIChhdXRvKiBpbXBs ID0gc3RyaW5nLT50cnlHZXRWYWx1ZUltcGwoKTsgaW1wbC0+aXNBdG9tKCkgJiYgIXBhcnNlSW5k ZXgoKmNvbnN0X2Nhc3Q8U3RyaW5nSW1wbCo+KGltcGwpKSkgeworICAgICAgICAgICAgICAgIGF1 dG8qIGltcGwgPSBzdHJpbmctPnRyeUdldFZhbHVlSW1wbCgpOworICAgICAgICAgICAgICAgIEFT U0VSVChpbXBsKTsgLy8gRklYTUU6IHJkYXI6Ly84MzkwMjc4MgorICAgICAgICAgICAgICAgIGlm IChpbXBsICYmIGltcGwtPmlzQXRvbSgpICYmICFwYXJzZUluZGV4KCpjb25zdF9jYXN0PFN0cmlu Z0ltcGwqPihpbXBsKSkpIHsKICAgICAgICAgICAgICAgICAgICAgdWlkID0gYml0d2lzZV9jYXN0 PFVuaXF1ZWRTdHJpbmdJbXBsKj4oaW1wbCk7CiAgICAgICAgICAgICAgICAgICAgIHByb3BlcnR5 Q2VsbCA9IHN0cmluZzsKICAgICAgICAgICAgICAgICAgICAgbV9ncmFwaC5mcmVlemVTdHJvbmco c3RyaW5nKTsK 440271 2021-10-05 14:35:04 -0700 2021-10-06 10:31:53 -0700 [fast-cq] patch for landing. bug-231252.patch text/plain 2865 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjgzNTY5KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBA CisyMDIxLTEwLTA1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBT cGVjdWxhdGl2ZSBmaXggZm9yIGEgbnVsbCBwb2ludGVyIGRlcmVmZXJlbmNlIGluIEJ5dGVDb2Rl UGFyc2VyOjpoYW5kbGVQdXRCeVZhbC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTIzMTI1MgorICAgICAgICByZGFyOi8vODMzMTAzMjAKKworICAgICAg ICBSZXZpZXdlZCBieSBZdXN1a2UgU3V6dWtpLgorCisgICAgICAgIFdlJ3JlIHNlZWluZyBhIG51 bGwgcG9pbnRlciBkZXJlZmVyZW5jZSBpbiBCeXRlQ29kZVBhcnNlcjo6aGFuZGxlUHV0QnlWYWwo KS4KKyAgICAgICAgQWRkaW5nIGEgbnVsbCBjaGVjayBoZXJlIGFzIGEgc3BlY3VsYXRpdmUgZml4 IHRvIG1pdGlnYXRlIGNyYXNoZXMgd2hpbGUgd2UKKyAgICAgICAgaW52ZXN0aWdhdGUgZnVydGhl ci4KKworICAgICAgICAqIGRmZy9ERkdCeXRlQ29kZVBhcnNlci5jcHA6CisgICAgICAgIChKU0M6 OkRGRzo6Qnl0ZUNvZGVQYXJzZXI6OnBhcnNlQmxvY2spOgorICAgICAgICAoSlNDOjpERkc6OkJ5 dGVDb2RlUGFyc2VyOjpoYW5kbGVQdXRCeVZhbCk6CisKIDIwMjEtMTAtMDUgIE1hcmsgTGFtICA8 bWFyay5sYW1AYXBwbGUuY29tPgogCiAgICAgICAgIENvZGVCbG9jayBzaG91bGQgbm90IGFkZC9y ZW1vdmUgTG9vcEhpbnRFeGVjdXRpb25Db3VudGVycy4KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9kZmcvREZHQnl0ZUNvZGVQYXJzZXIuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZh U2NyaXB0Q29yZS9kZmcvREZHQnl0ZUNvZGVQYXJzZXIuY3BwCShyZXZpc2lvbiAyODM1NjgpCisr KyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0J5dGVDb2RlUGFyc2VyLmNwcAkod29ya2lu ZyBjb3B5KQpAQCAtNjQ4Miw3ICs2NDgyLDkgQEAgdm9pZCBCeXRlQ29kZVBhcnNlcjo6cGFyc2VC bG9jayh1bnNpZ25lZAogICAgICAgICAgICAgICAgICAgICAgICAgRnJvemVuVmFsdWUqIGZyb3pl biA9IG1fZ3JhcGguZnJlZXplU3Ryb25nKHN5bWJvbCk7CiAgICAgICAgICAgICAgICAgICAgICAg ICBhZGRUb0dyYXBoKENoZWNrSXNDb25zdGFudCwgT3BJbmZvKGZyb3plbiksIHByb3BlcnR5KTsK ICAgICAgICAgICAgICAgICAgICAgfSBlbHNlIGlmIChhdXRvKiBzdHJpbmcgPSBwcm9wZXJ0eS0+ ZHluYW1pY0Nhc3RDb25zdGFudDxKU1N0cmluZyo+KCptX3ZtKSkgewotICAgICAgICAgICAgICAg ICAgICAgICAgaWYgKGF1dG8qIGltcGwgPSBzdHJpbmctPnRyeUdldFZhbHVlSW1wbCgpOyBpbXBs LT5pc0F0b20oKSAmJiAhcGFyc2VJbmRleCgqY29uc3RfY2FzdDxTdHJpbmdJbXBsKj4oaW1wbCkp KSB7CisgICAgICAgICAgICAgICAgICAgICAgICBhdXRvKiBpbXBsID0gc3RyaW5nLT50cnlHZXRW YWx1ZUltcGwoKTsKKyAgICAgICAgICAgICAgICAgICAgICAgIEFTU0VSVChpbXBsKTsgLy8gRklY TUU6IHJkYXI6Ly84MzkwMjc4MgorICAgICAgICAgICAgICAgICAgICAgICAgaWYgKGltcGwgJiYg aW1wbC0+aXNBdG9tKCkgJiYgIXBhcnNlSW5kZXgoKmNvbnN0X2Nhc3Q8U3RyaW5nSW1wbCo+KGlt cGwpKSkgewogICAgICAgICAgICAgICAgICAgICAgICAgICAgIHVpZCA9IGJpdHdpc2VfY2FzdDxV bmlxdWVkU3RyaW5nSW1wbCo+KGltcGwpOwogICAgICAgICAgICAgICAgICAgICAgICAgICAgIHBy b3BlcnR5Q2VsbCA9IHN0cmluZzsKICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtX2dyYXBo LmZyZWV6ZVN0cm9uZyhzdHJpbmcpOwpAQCAtODg3Niw3ICs4ODc4LDkgQEAgdm9pZCBCeXRlQ29k ZVBhcnNlcjo6aGFuZGxlUHV0QnlWYWwoQnl0ZQogICAgICAgICAgICAgICAgIEZyb3plblZhbHVl KiBmcm96ZW4gPSBtX2dyYXBoLmZyZWV6ZVN0cm9uZyhzeW1ib2wpOwogICAgICAgICAgICAgICAg IGFkZFRvR3JhcGgoQ2hlY2tJc0NvbnN0YW50LCBPcEluZm8oZnJvemVuKSwgcHJvcGVydHkpOwog ICAgICAgICAgICAgfSBlbHNlIGlmIChhdXRvKiBzdHJpbmcgPSBwcm9wZXJ0eS0+ZHluYW1pY0Nh c3RDb25zdGFudDxKU1N0cmluZyo+KCptX3ZtKSkgewotICAgICAgICAgICAgICAgIGlmIChhdXRv KiBpbXBsID0gc3RyaW5nLT50cnlHZXRWYWx1ZUltcGwoKTsgaW1wbC0+aXNBdG9tKCkgJiYgIXBh cnNlSW5kZXgoKmNvbnN0X2Nhc3Q8U3RyaW5nSW1wbCo+KGltcGwpKSkgeworICAgICAgICAgICAg ICAgIGF1dG8qIGltcGwgPSBzdHJpbmctPnRyeUdldFZhbHVlSW1wbCgpOworICAgICAgICAgICAg ICAgIEFTU0VSVChpbXBsKTsgLy8gRklYTUU6IHJkYXI6Ly84MzkwMjc4MgorICAgICAgICAgICAg ICAgIGlmIChpbXBsICYmIGltcGwtPmlzQXRvbSgpICYmICFwYXJzZUluZGV4KCpjb25zdF9jYXN0 PFN0cmluZ0ltcGwqPihpbXBsKSkpIHsKICAgICAgICAgICAgICAgICAgICAgdWlkID0gYml0d2lz ZV9jYXN0PFVuaXF1ZWRTdHJpbmdJbXBsKj4oaW1wbCk7CiAgICAgICAgICAgICAgICAgICAgIHBy b3BlcnR5Q2VsbCA9IHN0cmluZzsKICAgICAgICAgICAgICAgICAgICAgbV9ncmFwaC5mcmVlemVT dHJvbmcoc3RyaW5nKTsK