webkit2gtk3/SOURCES/CVE-2023-23529.patch

56 lines
2.8 KiB
Diff
Raw Normal View History

2023-02-22 12:48:58 +00:00
From d44ded97d14cdb5ac2eb011203e5f4c45dfd94b9 Mon Sep 17 00:00:00 2001
From: Yusuke Suzuki <ysuzuki@apple.com>
Date: Wed, 8 Feb 2023 15:32:00 -0800
Subject: [PATCH] Cherry-pick 1b2eb138ef92. rdar://problem/105236768
[JSC] ToThis object folding should check if AbstractValue is always an object
https://bugs.webkit.org/show_bug.cgi?id=251944
rdar://105175786
Reviewed by Geoffrey Garen and Mark Lam.
ToThis can become Identity for strict mode if it is just primitive values or its object does not have toThis function overriding.
This is correct, but folding ToThis to Undefined etc. (not Identity) needs to check that an input only contains objects.
This patch adds appropriate checks to prevent from converting ToThis(GlobalObject | Int32) to Undefined for example.
* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::isToThisAnIdentity):
Canonical link: https://commits.webkit.org/259548.63@safari-7615-branch
---
.../JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
index ea7bcd6b7b31..ef3f6bbe376e 100644
--- a/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
+++ b/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
@@ -209,7 +209,8 @@ inline ToThisResult isToThisAnIdentity(VM& vm, ECMAMode ecmaMode, AbstractValue&
}
}
- if ((ecmaMode.isStrict() || (valueForNode.m_type && !(valueForNode.m_type & ~SpecObject))) && valueForNode.m_structure.isFinite()) {
+ bool onlyObjects = valueForNode.m_type && !(valueForNode.m_type & ~SpecObject);
+ if ((ecmaMode.isStrict() || onlyObjects) && valueForNode.m_structure.isFinite()) {
bool allStructuresAreJSScope = !valueForNode.m_structure.isClear();
bool overridesToThis = false;
valueForNode.m_structure.forEach([&](RegisteredStructure structure) {
@@ -226,9 +227,13 @@ inline ToThisResult isToThisAnIdentity(VM& vm, ECMAMode ecmaMode, AbstractValue&
// If all the structures are JSScope's ones, we know the details of JSScope::toThis() operation.
allStructuresAreJSScope &= structure->classInfo()->methodTable.toThis == JSScope::info()->methodTable.toThis;
});
+
+ // This is correct for strict mode even if this can have non objects, since the right semantics is Identity.
if (!overridesToThis)
return ToThisResult::Identity;
- if (allStructuresAreJSScope) {
+
+ // But this folding is available only if input is always an object.
+ if (onlyObjects && allStructuresAreJSScope) {
if (ecmaMode.isStrict())
return ToThisResult::Undefined;
return ToThisResult::GlobalThis;
--
2.39.1