Skip to content

Commit a12ed35

Browse files
nico-hartmannmibrunin
authored andcommitted
[Backport] Security bug 1198309
Cherry-pick of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/2827899: Merged: [TurboFan] Fix SpeculativeNumberEqual[Number] with undefined (cherry picked from commit 7c7cdec5373127ad24e75edb2d2d75b25d604850) Bug: chromium:1198309, v8:5660 No-Try: true No-Presubmit: true No-Tree-Checks: true Change-Id: I9cb5f66643c0c0ab9b18ca953cf85d2f6aa84b42 Reviewed-by: Georg Neis <[email protected]> Commit-Queue: Nico Hartmann <[email protected]> Cr-Original-Commit-Position: refs/heads/master@{#74038} Cr-Commit-Position: refs/branch-heads/9.0@{#45} Cr-Branched-From: bd0108b4c88e0d6f2350cb79b5f363fbd02f3eb7-refs/heads/9.0.257@{#1} Cr-Branched-From: 349bcc6a075411f1a7ce2d866c3dfeefc2efa39d-refs/heads/master@{#73001} Reviewed-by: Allan Sandfeld Jensen <[email protected]>
1 parent 19b53b4 commit a12ed35

File tree

2 files changed

+24
-12
lines changed

2 files changed

+24
-12
lines changed

chromium/v8/src/compiler/representation-change.cc

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,10 @@ Node* RepresentationChanger::GetRepresentationFor(
211211
return GetFloat32RepresentationFor(node, output_rep, output_type,
212212
use_info.truncation());
213213
case MachineRepresentation::kFloat64:
214-
DCHECK_NE(TypeCheckKind::kBigInt, use_info.type_check());
214+
DCHECK(use_info.type_check() == TypeCheckKind::kNone ||
215+
use_info.type_check() == TypeCheckKind::kNumber ||
216+
use_info.type_check() == TypeCheckKind::kNumberOrBoolean ||
217+
use_info.type_check() == TypeCheckKind::kNumberOrOddball);
215218
return GetFloat64RepresentationFor(node, output_rep, output_type,
216219
use_node, use_info);
217220
case MachineRepresentation::kBit:
@@ -727,15 +730,22 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
727730
}
728731
} else if (IsAnyTagged(output_rep)) {
729732
if (output_type.Is(Type::Undefined())) {
730-
if (use_info.type_check() == TypeCheckKind::kNumberOrBoolean) {
733+
if (use_info.type_check() == TypeCheckKind::kNumberOrOddball ||
734+
(use_info.type_check() == TypeCheckKind::kNone &&
735+
use_info.truncation().TruncatesOddballAndBigIntToNumber())) {
736+
return jsgraph()->Float64Constant(
737+
std::numeric_limits<double>::quiet_NaN());
738+
} else {
739+
DCHECK(use_info.type_check() == TypeCheckKind::kNone ||
740+
use_info.type_check() == TypeCheckKind::kNumber ||
741+
use_info.type_check() == TypeCheckKind::kNumberOrBoolean);
731742
Node* unreachable = InsertUnconditionalDeopt(
732-
use_node, DeoptimizeReason::kNotANumberOrBoolean);
743+
use_node, use_info.type_check() == TypeCheckKind::kNumber
744+
? DeoptimizeReason::kNotANumber
745+
: DeoptimizeReason::kNotANumberOrBoolean);
733746
return jsgraph()->graph()->NewNode(
734747
jsgraph()->common()->DeadValue(MachineRepresentation::kFloat64),
735748
unreachable);
736-
} else {
737-
return jsgraph()->Float64Constant(
738-
std::numeric_limits<double>::quiet_NaN());
739749
}
740750
} else if (output_rep == MachineRepresentation::kTaggedSigned) {
741751
node = InsertChangeTaggedSignedToInt32(node);
@@ -747,12 +757,13 @@ Node* RepresentationChanger::GetFloat64RepresentationFor(
747757
output_type.Is(Type::NumberOrHole())) {
748758
// JavaScript 'null' is an Oddball that results in +0 when truncated to
749759
// Number. In a context like -0 == null, which must evaluate to false,
750-
// this truncation must not happen. For this reason we restrict this case
751-
// to when either the user explicitly requested a float (and thus wants
752-
// +0 if null is the input) or we know from the types that the input can
753-
// only be Number | Hole. The latter is necessary to handle the operator
754-
// CheckFloat64Hole. We did not put in the type (Number | Oddball \ Null)
755-
// to discover more bugs related to this conversion via crashes.
760+
// this truncation must not happen. For this reason we restrict this
761+
// case to when either the user explicitly requested a float (and thus
762+
// wants +0 if null is the input) or we know from the types that the
763+
// input can only be Number | Hole. The latter is necessary to handle
764+
// the operator CheckFloat64Hole. We did not put in the type (Number |
765+
// Oddball \ Null) to discover more bugs related to this conversion via
766+
// crashes.
756767
op = simplified()->TruncateTaggedToFloat64();
757768
} else if (use_info.type_check() == TypeCheckKind::kNumber ||
758769
(use_info.type_check() == TypeCheckKind::kNumberOrOddball &&

chromium/v8/src/deoptimizer/deoptimize-reason.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ namespace internal {
4343
V(NotAJavaScriptObject, "not a JavaScript object") \
4444
V(NotAJavaScriptObjectOrNullOrUndefined, \
4545
"not a JavaScript object, Null or Undefined") \
46+
V(NotANumber, "not a Number") \
4647
V(NotANumberOrBoolean, "not a Number or Boolean") \
4748
V(NotANumberOrOddball, "not a Number or Oddball") \
4849
V(NotAnArrayIndex, "not an array index") \

0 commit comments

Comments
 (0)