Skip to content

Commit f34b30d

Browse files
pandazyppandazyp
committed
[Feature] Check whether ctx/tid is valid between object and prop
throw error if obj's ctx or tid is incosistent [internal:] issue: f-5941886199 doc: https://xxxxxx [end_internal]
1 parent 07816d3 commit f34b30d

File tree

5 files changed

+112
-8
lines changed

5 files changed

+112
-8
lines changed

‎src/gc/allocator.cc

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2130,10 +2130,6 @@ static int chunk_call_munmap(mstate m, mchunkptr p, size_t size) {
21302130
return res;
21312131
}
21322132

2133-
#if defined(ANDROID) || defined(__ANDROID__)
2134-
pid_t gettid() { return syscall(SYS_gettid); }
2135-
#endif
2136-
21372133
static void* mmap_alloc(mstate m, size_t nb) {
21382134
size_t mmsize = mmap_align(nb + SIX_SIZE_T_SIZES + CHUNK_ALIGN_MASK);
21392135
if (m->footprint_limit != 0) {
@@ -2416,7 +2412,7 @@ static void* sys_alloc(mstate m, size_t nb) {
24162412
sprintf(id, "%d", getpid());
24172413
strcat(m->mem_name, id);
24182414
strcat(m->mem_name, "_");
2419-
sprintf(id, "%d", gettid());
2415+
sprintf(id, "%d", reinterpret_cast<int>(syscall(SYS_gettid)));
24202416
strcat(m->mem_name, id);
24212417
#endif
24222418
} else {
@@ -2849,7 +2845,8 @@ void* allocate(mstate gm, size_t bytes) {
28492845
}
28502846

28512847
void gcfree(mstate fm, void* mem) {
2852-
PRINT("gcfree, addr:%p, mstate:%p, tid:%d\n", mem, fm, gettid());
2848+
PRINT("gcfree, addr:%p, mstate:%p, tid:%d\n", mem, fm,
2849+
reinterpret_cast<int>(syscall(SYS_gettid)));
28532850
#ifdef ENABLE_GC_DEBUG_TOOLS
28542851
delete_cur_mems(fm->runtime, mem);
28552852
#endif

‎src/interpreter/quickjs/include/quickjs-inner.h

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -789,10 +789,11 @@ struct LEPUSContext {
789789

790790
PtrHandles *ptr_handles;
791791
NAPIHandleScope *napi_scope;
792+
struct FinalizationRegistryContext *fg_ctx = nullptr;
793+
uint64_t binary_version;
792794
bool gc_enable;
793795
bool is_lepusng;
794-
uint64_t binary_version;
795-
struct FinalizationRegistryContext *fg_ctx = nullptr;
796+
bool object_ctx_check;
796797
};
797798

798799
typedef union JSFloat64Union {
@@ -973,6 +974,12 @@ typedef struct LEPUSFunctionBytecode {
973974
// <Primjs begin>
974975
struct list_head gc_link;
975976
uint32_t function_id; // for lepusNG debugger encode
977+
#ifdef ENABLE_QUICKJS_DEBUGGER
978+
LEPUSContext *ctx;
979+
#if defined(ANDROID) || defined(__ANDROID__)
980+
pid_t tid;
981+
#endif
982+
#endif
976983
// <Primjs end>
977984
struct {
978985
/* debug info, move to separate structure to save memory? */
@@ -1346,6 +1353,12 @@ struct LEPUSObject {
13461353
JSRegExp regexp; /* JS_CLASS_REGEXP: 8/16 bytes */
13471354
LEPUSValue object_data; /* for JS_SetObjectData(): 8/16/16 bytes */
13481355
} u;
1356+
#ifdef ENABLE_QUICKJS_DEBUGGER
1357+
LEPUSContext *ctx;
1358+
#if defined(ANDROID) || defined(__ANDROID__)
1359+
pid_t tid;
1360+
#endif
1361+
#endif
13491362
/* byte sizes: 40/48/72 */
13501363
};
13511364

@@ -3201,4 +3214,12 @@ inline bool js_is_bytecode_function(LEPUSValue obj) {
32013214
bool emit_name_str(JSParseState *s, const uint8_t *start, const uint8_t *end);
32023215
void get_caller_string(JSFunctionDef *s);
32033216

3217+
void SetObjectCtxCheckStatus(LEPUSContext *ctx, bool enable);
3218+
3219+
#ifdef ENABLE_QUICKJS_DEBUGGER
3220+
QJS_HIDE pid_t get_tid();
3221+
QJS_HIDE bool CheckObjectCtx(LEPUSContext *ctx, LEPUSValue obj);
3222+
QJS_HIDE LEPUSValue JS_ThrowCtxError(LEPUSContext *ctx);
3223+
#endif
3224+
32043225
#endif // SRC_INTERPRETER_QUICKJS_INCLUDE_QUICKJS_INNER_H_

‎src/interpreter/quickjs/include/quickjs.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1603,6 +1603,8 @@ const char *LEPUS_GetStringUtf8(LEPUSContext *, const struct JSString *);
16031603
void LEPUS_SetFuncFileName(LEPUSContext *, LEPUSValue, const char *);
16041604

16051605
void InitLynxTraceEnv(void *(*)(const char *), void (*)(void *));
1606+
1607+
void SetObjectCtxCheckStatus(LEPUSContext *ctx, bool enable);
16061608
// <Primjs end>
16071609

16081610
#undef lepus_unlikely

‎src/interpreter/quickjs/source/quickjs.cc

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ extern "C" {
5656
#include <cstdlib>
5757
#if defined(ANDROID) || defined(__ANDROID__)
5858
#include <errno.h>
59+
#include <sys/syscall.h>
5960
#include <unistd.h>
6061
#endif
6162

@@ -4585,6 +4586,12 @@ QJS_HIDE LEPUSValue JS_NewObjectFromShape(LEPUSContext *ctx, JSShape *sh,
45854586
p->first_weak_ref = NULL;
45864587
p->u.opaque = NULL;
45874588
p->shape = sh;
4589+
#ifdef ENABLE_QUICKJS_DEBUGGER
4590+
p->ctx = ctx;
4591+
#if defined(ANDROID) || defined(__ANDROID__)
4592+
p->tid = get_tid();
4593+
#endif
4594+
#endif
45884595
p->prop = static_cast<JSProperty *>(
45894596
lepus_malloc(ctx, sizeof(JSProperty) * sh->prop_size));
45904597
if (unlikely(!p->prop)) {
@@ -8838,6 +8845,14 @@ int JS_SetPropertyInternalImpl(LEPUSContext *ctx, LEPUSValueConst this_obj,
88388845
}
88398846
}
88408847
p = LEPUS_VALUE_GET_OBJ(this_obj);
8848+
8849+
#ifdef ENABLE_QUICKJS_DEBUGGER
8850+
if (CheckObjectCtx(ctx, val)) {
8851+
JS_ThrowCtxError(ctx);
8852+
return -1;
8853+
}
8854+
#endif
8855+
88418856
retry:
88428857
prs = find_own_property(&pr, p, prop);
88438858
if (prs) {
@@ -18489,6 +18504,12 @@ QJS_STATIC inline LEPUSValue JS_CallInternalTI(LEPUSContext *caller_ctx,
1848918504
LEPUSValue this_obj,
1849018505
LEPUSValue new_target, int argc,
1849118506
LEPUSValue *argv, int flags) {
18507+
#ifdef ENABLE_QUICKJS_DEBUGGER
18508+
if (CheckObjectCtx(caller_ctx, func_obj)) {
18509+
return JS_ThrowCtxError(caller_ctx);
18510+
}
18511+
#endif
18512+
1849218513
#ifdef ENABLE_PRIMJS_SNAPSHOT
1849318514
if (caller_ctx->rt->use_primjs) {
1849418515
return entry(this_obj, new_target, func_obj, (address)caller_ctx, argc,
@@ -31525,6 +31546,12 @@ LEPUSValue js_create_function(LEPUSContext *ctx, JSFunctionDef *fd) {
3152531546
}
3152631547

3152731548
b->stack_size = stack_size;
31549+
#ifdef ENABLE_QUICKJS_DEBUGGER
31550+
b->ctx = ctx;
31551+
#if defined(ANDROID) || defined(__ANDROID__)
31552+
b->tid = get_tid();
31553+
#endif
31554+
#endif
3152831555

3152931556
if (fd->js_mode & JS_MODE_STRIP) {
3153031557
if (!is_gc) {
@@ -56074,3 +56101,46 @@ void InitLynxTraceEnv(void *(*begin)(const char *), void (*end)(void *ptr)) {
5607456101
lynx_trace.InitEndPtr(end);
5607556102
return;
5607656103
}
56104+
56105+
void SetObjectCtxCheckStatus(LEPUSContext *ctx, bool enable) {
56106+
ctx->object_ctx_check = enable;
56107+
return;
56108+
}
56109+
56110+
#ifdef ENABLE_QUICKJS_DEBUGGER
56111+
pid_t get_tid() {
56112+
#if defined(ANDROID) || defined(__ANDROID__)
56113+
return syscall(SYS_gettid);
56114+
#else
56115+
return 0;
56116+
#endif
56117+
}
56118+
56119+
bool CheckObjectCtx(LEPUSContext *ctx, LEPUSValue obj) {
56120+
if (ctx->object_ctx_check) {
56121+
bool inconsistent_ctx =
56122+
(LEPUS_VALUE_IS_OBJECT(obj) &&
56123+
(LEPUS_VALUE_GET_OBJ(obj)->ctx) != ctx) ||
56124+
(LEPUS_VALUE_IS_FUNCTION_BYTECODE(obj) &&
56125+
static_cast<LEPUSFunctionBytecode *>(LEPUS_VALUE_GET_PTR(obj))->ctx !=
56126+
ctx);
56127+
bool inconsistent_tid = false;
56128+
#if defined(ANDROID) || defined(__ANDROID__)
56129+
pid_t tid = get_tid();
56130+
inconsistent_tid =
56131+
(LEPUS_VALUE_IS_OBJECT(obj) &&
56132+
(LEPUS_VALUE_GET_OBJ(obj)->tid) != tid) ||
56133+
(LEPUS_VALUE_IS_FUNCTION_BYTECODE(obj) &&
56134+
static_cast<LEPUSFunctionBytecode *>(LEPUS_VALUE_GET_PTR(obj))->tid !=
56135+
tid);
56136+
#endif
56137+
return inconsistent_ctx || inconsistent_tid;
56138+
}
56139+
return false;
56140+
}
56141+
56142+
LEPUSValue JS_ThrowCtxError(LEPUSContext *ctx) {
56143+
return LEPUS_ThrowTypeError(
56144+
ctx, "The property's ctx or tid is inconsistent with this object.");
56145+
}
56146+
#endif

‎src/interpreter/quickjs/source/quickjs_gc.cc

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2691,6 +2691,12 @@ QJS_HIDE LEPUSValue JS_NewObjectFromShape_GC(LEPUSContext *ctx, JSShape *sh,
26912691
p->u.opaque = NULL;
26922692
p->shape = sh;
26932693
p->prop = NULL;
2694+
#ifdef ENABLE_QUICKJS_DEBUGGER
2695+
p->ctx = ctx;
2696+
#if defined(ANDROID) || defined(__ANDROID__)
2697+
p->tid = get_tid();
2698+
#endif
2699+
#endif
26942700

26952701
switch (class_id) {
26962702
case JS_CLASS_OBJECT:
@@ -4784,6 +4790,14 @@ int JS_SetPropertyInternalImpl_GC(LEPUSContext *ctx, LEPUSValueConst this_obj,
47844790
}
47854791
}
47864792
p = LEPUS_VALUE_GET_OBJ(this_obj);
4793+
4794+
#ifdef ENABLE_QUICKJS_DEBUGGER
4795+
if (CheckObjectCtx(ctx, val)) {
4796+
JS_ThrowCtxError(ctx);
4797+
return -1;
4798+
}
4799+
#endif
4800+
47874801
retry:
47884802
prs = find_own_property(&pr, p, prop);
47894803
if (prs) {

0 commit comments

Comments
 (0)