27016 2009-07-06 18:01:05 -0700 Interpreter crashes due to invalid array indexes 2009-07-09 19:45:40 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) PC Linux RESOLVED FIXED P1 Major --- 1 zack oliver barraclough ggaren kenneth oliver tangshuo oldest_to_newest 130067 0 zack 2009-07-06 18:01:05 -0700 In gcc 4.3.3 when array subscripts are expressions which contain a mix of signed and unsigned operands the result will be unsigned. It's a cause of crashes in the interpreter. The attached patch fixes the crashes but it's possible that there are other codepaths which are similarly broken. A simple testcase to see if you can reproduce it with the compiler of your choice is: #define CRASH 0 int array[] = { -50, -40, -30, -20, -10, 0, 10, 20, 30, 40, 50 }; int main(int argc, char **) { int *ptr = array + 5; unsigned i = argc; int k = 3 * i; #if CRASH int num = ptr[i - k]; #else int num = ptr[(int)(i - k)]; #endif fprintf(stderr, "num is %d\n", num); } 130070 1 32337 zack 2009-07-06 18:02:08 -0700 Created attachment 32337 simple fix 130134 2 32361 oliver 2009-07-06 23:05:32 -0700 Created attachment 32361 fixeration! 130136 3 32361 darin 2009-07-06 23:50:45 -0700 Comment on attachment 32361 fixeration! Test case? Why int32_t instead of just int? r=me 130805 4 oliver 2009-07-09 19:44:50 -0700 Committed r45693 130807 5 oliver 2009-07-09 19:45:19 -0700 *** Bug 26116 has been marked as a duplicate of this bug. *** 130809 6 oliver 2009-07-09 19:45:40 -0700 *** Bug 26553 has been marked as a duplicate of this bug. *** 32337 2009-07-06 18:02:08 -0700 2009-07-06 23:05:32 -0700 simple fix interpreter.diff text/plain 1429 zack ZGlmZiAtLWdpdCBhL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0ludGVycHJldGVyLmNwcCBi L0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0ludGVycHJldGVyLmNwcAppbmRleCA0NzFlNDA5 Li5iMjlhNWIzIDEwMDY0NAotLS0gYS9KYXZhU2NyaXB0Q29yZS9pbnRlcnByZXRlci9JbnRlcnBy ZXRlci5jcHAKKysrIGIvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3Bw CkBAIC0zMTIxLDEwICszMTIxLDEwIEBAIEpTVmFsdWUgSW50ZXJwcmV0ZXI6OnByaXZhdGVFeGVj dXRlKEV4ZWN1dGlvbkZsYWcgZmxhZywgUmVnaXN0ZXJGaWxlKiByZWdpc3RlckZpCiAKICAgICAg ICAgICAgIC8vIEZpcnN0IHN0ZXAgaXMgdG8gY29weSB0aGUgImV4cGVjdGVkIiBwYXJhbWV0ZXJz IGZyb20gdGhlaXIgbm9ybWFsIGxvY2F0aW9uIHJlbGF0aXZlIHRvIHRoZSBjYWxsZnJhbWUKICAg ICAgICAgICAgIGZvciAoOyBpIDwgaW5wbGFjZUFyZ3M7IGkrKykKLSAgICAgICAgICAgICAgICBh cmdTdG9yZVtpXSA9IGNhbGxGcmFtZS0+cmVnaXN0ZXJzKClbaSAtIFJlZ2lzdGVyRmlsZTo6Q2Fs bEZyYW1lSGVhZGVyU2l6ZSAtIGV4cGVjdGVkUGFyYW1zXTsKKyAgICAgICAgICAgICAgICBhcmdT dG9yZVtpXSA9IGNhbGxGcmFtZS0+cmVnaXN0ZXJzKClbKGludDMyX3QpKGkgLSBSZWdpc3RlckZp bGU6OkNhbGxGcmFtZUhlYWRlclNpemUgLSBleHBlY3RlZFBhcmFtcyldOwogICAgICAgICAgICAg Ly8gVGhlbiB3ZSBjb3B5IGFueSBhZGRpdGlvbmFsIGFyZ3VtZW50cyB0aGF0IG1heSBiZSBmdXJ0 aGVyIHVwIHRoZSBzdGFjayAoJy0xJyB0byBhY2NvdW50IGZvciAndGhpcycpCiAgICAgICAgICAg ICBmb3IgKDsgaSA8IGFyZ0NvdW50OyBpKyspCi0gICAgICAgICAgICAgICAgYXJnU3RvcmVbaV0g PSBjYWxsRnJhbWUtPnJlZ2lzdGVycygpW2kgLSBSZWdpc3RlckZpbGU6OkNhbGxGcmFtZUhlYWRl clNpemUgLSBleHBlY3RlZFBhcmFtcyAtIGFyZ0NvdW50IC0gMV07CisgICAgICAgICAgICAgICAg YXJnU3RvcmVbaV0gPSBjYWxsRnJhbWUtPnJlZ2lzdGVycygpWyhpbnQzMl90KShpIC0gUmVnaXN0 ZXJGaWxlOjpDYWxsRnJhbWVIZWFkZXJTaXplIC0gZXhwZWN0ZWRQYXJhbXMgLSBhcmdDb3VudCAt IDEpXTsKICAgICAgICAgfSBlbHNlIGlmICghYXJndW1lbnRzLmlzVW5kZWZpbmVkT3JOdWxsKCkp IHsKICAgICAgICAgICAgIGlmICghYXJndW1lbnRzLmlzT2JqZWN0KCkpIHsKICAgICAgICAgICAg ICAgICBleGNlcHRpb25WYWx1ZSA9IGNyZWF0ZUludmFsaWRQYXJhbUVycm9yKGNhbGxGcmFtZSwg IkZ1bmN0aW9uLnByb3RvdHlwZS5hcHBseSIsIGFyZ3VtZW50cywgdlBDIC0gY2FsbEZyYW1lLT5j b2RlQmxvY2soKS0+aW5zdHJ1Y3Rpb25zKCkuYmVnaW4oKSwgY2FsbEZyYW1lLT5jb2RlQmxvY2so KSk7Cg== 32361 2009-07-06 23:05:32 -0700 2009-07-06 23:50:45 -0700 fixeration! 64bit-interpreter-fix.patch text/plain 2867 oliver ZGlmZiAtLWdpdCBhL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZyBiL0phdmFTY3JpcHRDb3JlL0No YW5nZUxvZwppbmRleCA1ZjNhMTc1Li5mZDkyMmIyIDEwMDY0NAotLS0gYS9KYXZhU2NyaXB0Q29y ZS9DaGFuZ2VMb2cKKysrIGIvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYg QEAKKzIwMDktMDctMDYgIE9saXZlciBIdW50ICA8b2xpdmVyQGFwcGxlLmNvbT4KKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBCdWcgMjcwMTYgLSBJbnRl cnByZXRlciBjcmFzaGVzIGR1ZSB0byBpbnZhbGlkIGFycmF5IGluZGV4ZXMKKyAgICAgICAgPGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yNzAxNj4KKworICAgICAgICBV bnNpZ25lZCB2cyBzaWduZWQgY29udmVyc2lvbnMgcmVzdWx0cyBpbiBpbmNvcnJlY3QgYmVoYXZp b3VyIGluCisgICAgICAgIDY0Yml0IGludGVycHJldGVyIGJ1aWxkcy4KKworICAgICAgICAqIGlu dGVycHJldGVyL0ludGVycHJldGVyLmNwcDoKKyAgICAgICAgKEpTQzo6SW50ZXJwcmV0ZXI6OnBy aXZhdGVFeGVjdXRlKToKKwogMjAwOS0wNy0wNiAgQWRhIENoYW4gIDxhZGFjaGFuQGFwcGxlLmNv bT4KIAogICAgICAgICBSZXZpZXdlZCBieSBEYXJpbiBBZGxlciBhbmQgTWFyayBSb3dlLgpkaWZm IC0tZ2l0IGEvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3BwIGIvSmF2 YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3BwCmluZGV4IDQ3MWU0MDkuLmJj N2U1NDAgMTAwNjQ0Ci0tLSBhL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0ludGVycHJldGVy LmNwcAorKysgYi9KYXZhU2NyaXB0Q29yZS9pbnRlcnByZXRlci9JbnRlcnByZXRlci5jcHAKQEAg LTMxMDUsMTggKzMxMDUsMTggQEAgSlNWYWx1ZSBJbnRlcnByZXRlcjo6cHJpdmF0ZUV4ZWN1dGUo RXhlY3V0aW9uRmxhZyBmbGFnLCBSZWdpc3RlckZpbGUqIHJlZ2lzdGVyRmkKICAgICAgICAgaW50 IGFyZ3NPZmZzZXQgPSAoKyt2UEMpLT51Lm9wZXJhbmQ7CiAgICAgICAgIAogICAgICAgICBKU1Zh bHVlIGFyZ3VtZW50cyA9IGNhbGxGcmFtZVthcmdzT2Zmc2V0XS5qc1ZhbHVlKCk7Ci0gICAgICAg IHVpbnQzMl90IGFyZ0NvdW50ID0gMDsKKyAgICAgICAgaW50MzJfdCBhcmdDb3VudCA9IDA7CiAg ICAgICAgIGlmICghYXJndW1lbnRzKSB7Ci0gICAgICAgICAgICBhcmdDb3VudCA9ICh1aW50MzJf dCkoY2FsbEZyYW1lW1JlZ2lzdGVyRmlsZTo6QXJndW1lbnRDb3VudF0udS5pKSAtIDE7CisgICAg ICAgICAgICBhcmdDb3VudCA9IGNhbGxGcmFtZVtSZWdpc3RlckZpbGU6OkFyZ3VtZW50Q291bnRd LnUuaSAtIDE7CiAgICAgICAgICAgICBpbnQzMl90IHNpemVEZWx0YSA9IGFyZ3NPZmZzZXQgKyBh cmdDb3VudCArIFJlZ2lzdGVyRmlsZTo6Q2FsbEZyYW1lSGVhZGVyU2l6ZTsKICAgICAgICAgICAg IFJlZ2lzdGVyKiBuZXdFbmQgPSBjYWxsRnJhbWUtPnJlZ2lzdGVycygpICsgc2l6ZURlbHRhOwog ICAgICAgICAgICAgaWYgKCFyZWdpc3RlckZpbGUtPmdyb3cobmV3RW5kKSB8fCAoKG5ld0VuZCAt IGNhbGxGcmFtZS0+cmVnaXN0ZXJzKCkpICE9IHNpemVEZWx0YSkpIHsKICAgICAgICAgICAgICAg ICBleGNlcHRpb25WYWx1ZSA9IGNyZWF0ZVN0YWNrT3ZlcmZsb3dFcnJvcihjYWxsRnJhbWUpOwog ICAgICAgICAgICAgICAgIGdvdG8gdm1fdGhyb3c7CiAgICAgICAgICAgICB9Ci0gICAgICAgICAg ICB1aW50MzJfdCBleHBlY3RlZFBhcmFtcyA9IGFzRnVuY3Rpb24oY2FsbEZyYW1lW1JlZ2lzdGVy RmlsZTo6Q2FsbGVlXS5qc1ZhbHVlKCkpLT5ib2R5KCktPnBhcmFtZXRlckNvdW50KCk7Ci0gICAg ICAgICAgICB1aW50MzJfdCBpbnBsYWNlQXJncyA9IG1pbihhcmdDb3VudCwgZXhwZWN0ZWRQYXJh bXMpOwotICAgICAgICAgICAgdWludDMyX3QgaSA9IDA7CisgICAgICAgICAgICBpbnQzMl90IGV4 cGVjdGVkUGFyYW1zID0gYXNGdW5jdGlvbihjYWxsRnJhbWVbUmVnaXN0ZXJGaWxlOjpDYWxsZWVd LmpzVmFsdWUoKSktPmJvZHkoKS0+cGFyYW1ldGVyQ291bnQoKTsKKyAgICAgICAgICAgIGludDMy X3QgaW5wbGFjZUFyZ3MgPSBtaW4oYXJnQ291bnQsIGV4cGVjdGVkUGFyYW1zKTsKKyAgICAgICAg ICAgIGludDMyX3QgaSA9IDA7CiAgICAgICAgICAgICBSZWdpc3RlciogYXJnU3RvcmUgPSBjYWxs RnJhbWUtPnJlZ2lzdGVycygpICsgYXJnc09mZnNldDsKIAogICAgICAgICAgICAgLy8gRmlyc3Qg c3RlcCBpcyB0byBjb3B5IHRoZSAiZXhwZWN0ZWQiIHBhcmFtZXRlcnMgZnJvbSB0aGVpciBub3Jt YWwgbG9jYXRpb24gcmVsYXRpdmUgdG8gdGhlIGNhbGxmcmFtZQpAQCAtMzE2MCw3ICszMTYwLDcg QEAgSlNWYWx1ZSBJbnRlcnByZXRlcjo6cHJpdmF0ZUV4ZWN1dGUoRXhlY3V0aW9uRmxhZyBmbGFn LCBSZWdpc3RlckZpbGUqIHJlZ2lzdGVyRmkKICAgICAgICAgICAgICAgICAgICAgZ290byB2bV90 aHJvdzsKICAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICAgUmVnaXN0ZXIqIGFyZ3NC dWZmZXIgPSBjYWxsRnJhbWUtPnJlZ2lzdGVycygpICsgYXJnc09mZnNldDsKLSAgICAgICAgICAg ICAgICBmb3IgKHVuc2lnbmVkIGkgPSAwOyBpIDwgYXJnQ291bnQ7ICsraSkgeworICAgICAgICAg ICAgICAgIGZvciAoaW50MzJfdCBpID0gMDsgaSA8IGFyZ0NvdW50OyArK2kpIHsKICAgICAgICAg ICAgICAgICAgICAgYXJnc0J1ZmZlcltpXSA9IGFzT2JqZWN0KGFyZ3VtZW50cyktPmdldChjYWxs RnJhbWUsIGkpOwogICAgICAgICAgICAgICAgICAgICBDSEVDS19GT1JfRVhDRVBUSU9OKCk7CiAg ICAgICAgICAgICAgICAgfQo=