deps: update ChakraCore to chakra-core/ChakraCore@b2448404a3

meg-gupta · chakrabot · commit 2f4978abc223 · 2018-01-23T15:36:24.000-08:00
[1.8>1.9] [MERGE #4589 @meg-gupta] Fix JsBuiltIn initialization code to not read root property Merge pull request #4589 from meg-gupta:addCheckOnRootPropLd Also add assert so that in future we dont write js builtin code to access any root property Fixes OS#15467762 Reviewed-By: chakrabot <chakrabot@users.noreply.github.com>
diff --git a/deps/chakrashim/core/lib/Common/Exceptions/ReportError.h b/deps/chakrashim/core/lib/Common/Exceptions/ReportError.h
@@ -29,6 +29,7 @@ enum ErrorReason
     Fatal_Failed_API_Result = 21,
     Fatal_OutOfMemory = 22,
     Fatal_RecyclerVisitedHost_LargeHeapBlock = 23,
+    Fatal_JsBuiltIn_Error = 24,
 };
 
 extern "C" void ReportFatalException(
diff --git a/deps/chakrashim/core/lib/Common/Exceptions/Throw.cpp b/deps/chakrashim/core/lib/Common/Exceptions/Throw.cpp
@@ -82,6 +82,14 @@ namespace Js {
         RaiseException((DWORD)DBG_TERMINATE_PROCESS, EXCEPTION_NONCONTINUABLE, 0, NULL);
     }
 
+#ifdef ENABLE_JS_BUILTINS
+    void Throw::FatalJsBuiltInError()
+    {
+        AssertMsg(false, "Could not initialize JsBuiltIns!");
+        ReportFatalException(NULL, E_UNEXPECTED, Fatal_JsBuiltIn_Error, 0);
+    }
+#endif
+
 #if ENABLE_JS_REENTRANCY_CHECK
     void Throw::FatalJsReentrancyError()
     {
diff --git a/deps/chakrashim/core/lib/Common/Exceptions/Throw.h b/deps/chakrashim/core/lib/Common/Exceptions/Throw.h
@@ -25,7 +25,9 @@ namespace Js {
 #if ENABLE_JS_REENTRANCY_CHECK
         static void __declspec(noreturn) FatalJsReentrancyError();
 #endif
-
+#ifdef ENABLE_JS_BUILTINS
+        static void __declspec(noreturn) FatalJsBuiltInError();
+#endif
         static void CheckAndThrowOutOfMemory(BOOLEAN status);
 
         static bool ReportAssert(__in LPCSTR fileName, uint lineNumber, __in LPCSTR error, __in LPCSTR message);
diff --git a/deps/chakrashim/core/lib/Runtime/Base/FunctionBody.cpp b/deps/chakrashim/core/lib/Runtime/Base/FunctionBody.cpp
@@ -76,8 +76,12 @@ namespace Js
         m_functionNumber(functionNumber),
         m_defaultEntryPointInfo(nullptr),
         m_displayNameIsRecyclerAllocated(false),
-        m_tag11(true)
+        m_tag11(true),
+        m_isJsBuiltInCode(false)
     {
+#if DBG
+        m_isJsBuiltInInitCode = false;
+#endif
         PERF_COUNTER_INC(Code, TotalFunction);
     }
 
diff --git a/deps/chakrashim/core/lib/Runtime/Base/FunctionBody.h b/deps/chakrashim/core/lib/Runtime/Base/FunctionBody.h
@@ -1307,6 +1307,11 @@ namespace Js
         void SetIsJsBuiltInCode() { m_isJsBuiltInCode = true; }
         bool IsJsBuiltInCode() const { return m_isJsBuiltInCode; }
 
+#if DBG
+        void SetIsJsBuiltInInitCode() { m_isJsBuiltInInitCode = true; }
+        bool IsJsBuiltInInitCode() { return m_isJsBuiltInInitCode; }
+#endif
+
 #if DBG
         bool HasValidEntryPoint() const;
 #if defined(ENABLE_SCRIPT_PROFILING) || defined(ENABLE_SCRIPT_DEBUGGING)
@@ -1367,6 +1372,9 @@ namespace Js
         FieldWithBarrier(bool) m_isTopLevel : 1; // Indicates that this function is top-level function, currently being used in script profiler and debugger
         FieldWithBarrier(bool) m_isPublicLibraryCode: 1; // Indicates this function is public boundary library code that should be visible in JS stack
         FieldWithBarrier(bool) m_isJsBuiltInCode: 1; // Indicates this function comes from the JS Built In implementation
+#if DBG
+        FieldWithBarrier(bool) m_isJsBuiltInInitCode: 1;
+#endif
         FieldWithBarrier(bool) m_canBeDeferred : 1;
         FieldWithBarrier(bool) m_displayNameIsRecyclerAllocated : 1;
 
diff --git a/deps/chakrashim/core/lib/Runtime/Language/InterpreterStackFrame.cpp b/deps/chakrashim/core/lib/Runtime/Language/InterpreterStackFrame.cpp
@@ -8372,6 +8372,7 @@ const byte * InterpreterStackFrame::OP_ProfiledLoopBodyStart(uint loopId)
 
     Var InterpreterStackFrame::GetRootObject() const
     {
+        Assert(!this->GetFunctionBody()->IsJsBuiltInInitCode());
         Var rootObject = GetReg(Js::FunctionBody::RootObjectRegSlot);
         Assert(rootObject == this->GetFunctionBody()->LoadRootObject());
         return rootObject;
diff --git a/deps/chakrashim/core/lib/Runtime/Library/EngineInterfaceObjectBuiltIns.h b/deps/chakrashim/core/lib/Runtime/Library/EngineInterfaceObjectBuiltIns.h
@@ -10,6 +10,7 @@ GlobalBuiltInConstructor(String)
 GlobalBuiltInConstructor(Date)
 GlobalBuiltInConstructor(Error) /*This was added back in to allow assert errors*/
 GlobalBuiltInConstructor(Map)
+GlobalBuiltInConstructor(Symbol)
 
 GlobalBuiltIn(Math,Abs)
 GlobalBuiltIn(Math,Floor)
diff --git a/deps/chakrashim/core/lib/Runtime/Library/JavascriptFunction.cpp b/deps/chakrashim/core/lib/Runtime/Library/JavascriptFunction.cpp
@@ -33,12 +33,14 @@ namespace Js
         : DynamicObject(type), functionInfo(nullptr), constructorCache(&ConstructorCache::DefaultInstance)
     {
         Assert(this->constructorCache != nullptr);
+#if DBG
+        isJsBuiltInInitCode = false;
+#endif
     }
 
 
     JavascriptFunction::JavascriptFunction(DynamicType * type, FunctionInfo * functionInfo)
         : DynamicObject(type), functionInfo(functionInfo), constructorCache(&ConstructorCache::DefaultInstance)
-
     {
         Assert(this->constructorCache != nullptr);
         this->GetTypeHandler()->ClearHasOnlyWritableDataProperties(); // length is non-writable
@@ -50,11 +52,13 @@ namespace Js
             // GetScriptContext()->InvalidateStoreFieldCaches(PropertyIds::length);
             GetLibrary()->NoPrototypeChainsAreEnsuredToHaveOnlyWritableDataProperties();
         }
+#if DBG
+        isJsBuiltInInitCode = false;
+#endif
     }
 
     JavascriptFunction::JavascriptFunction(DynamicType * type, FunctionInfo * functionInfo, ConstructorCache* cache)
         : DynamicObject(type), functionInfo(functionInfo), constructorCache(cache)
-
     {
         Assert(this->constructorCache != nullptr);
         this->GetTypeHandler()->ClearHasOnlyWritableDataProperties(); // length is non-writable
@@ -66,6 +70,9 @@ namespace Js
             // GetScriptContext()->InvalidateStoreFieldCaches(PropertyIds::length);
             GetLibrary()->NoPrototypeChainsAreEnsuredToHaveOnlyWritableDataProperties();
         }
+#if DBG
+        isJsBuiltInInitCode = false;
+#endif
     }
 
     FunctionProxy *JavascriptFunction::GetFunctionProxy() const
diff --git a/deps/chakrashim/core/lib/Runtime/Library/JavascriptFunction.h b/deps/chakrashim/core/lib/Runtime/Library/JavascriptFunction.h
@@ -43,7 +43,9 @@ namespace Js
         Field(ConstructorCache*) constructorCache;
 
         Field(bool) isJsBuiltInCode;
-
+#if DBG
+        Field(bool) isJsBuiltInInitCode;
+#endif
     protected:
 
         Field(FunctionInfo *) functionInfo;  // Underlying function
diff --git a/deps/chakrashim/core/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js b/deps/chakrashim/core/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js
@@ -16,6 +16,7 @@
 
     var setPrototype = platform.builtInSetPrototype;
     var _objectDefineProperty = platform.builtInJavascriptObjectEntryDefineProperty;
+    var Symbol = platform.Symbol;
 
     // Object's getter and setter can get overriden on the prototype, in that case while setting the value attributes, we will end up with TypeError
     // So, we need to set the prototype of attributes to null
diff --git a/deps/chakrashim/core/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.bc.32b.h b/deps/chakrashim/core/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.bc.32b.h
diff --git a/deps/chakrashim/core/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.bc.64b.h b/deps/chakrashim/core/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.bc.64b.h
diff --git a/deps/chakrashim/core/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.nojit.bc.32b.h b/deps/chakrashim/core/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.nojit.bc.32b.h
diff --git a/deps/chakrashim/core/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.nojit.bc.64b.h b/deps/chakrashim/core/lib/Runtime/Library/JsBuiltIn/JsBuiltIn.js.nojit.bc.64b.h
diff --git a/deps/chakrashim/core/lib/Runtime/Library/JsBuiltInEngineInterfaceExtensionObject.cpp b/deps/chakrashim/core/lib/Runtime/Library/JsBuiltInEngineInterfaceExtensionObject.cpp

Original file line number	Diff line number	Diff line change
`@@ -82,6 +82,14 @@ namespace Js {`
`82`	`82`	`RaiseException((DWORD)DBG_TERMINATE_PROCESS, EXCEPTION_NONCONTINUABLE, 0, NULL);`
`83`	`83`	`}`
`84`	`84`
	`85`	`+#ifdef ENABLE_JS_BUILTINS`
	`86`	`+ void Throw::FatalJsBuiltInError()`
	`87`	`+ {`
	`88`	`+ AssertMsg(false, "Could not initialize JsBuiltIns!");`
	`89`	`+ ReportFatalException(NULL, E_UNEXPECTED, Fatal_JsBuiltIn_Error, 0);`
	`90`	`+ }`
	`91`	`+#endif`
	`92`	`+`
`85`	`93`	`#if ENABLE_JS_REENTRANCY_CHECK`
`86`	`94`	`void Throw::FatalJsReentrancyError()`
`87`	`95`	`{`
Original file line number	Diff line number	Diff line change
`@@ -76,8 +76,12 @@ namespace Js`
`76`	`76`	`m_functionNumber(functionNumber),`
`77`	`77`	`m_defaultEntryPointInfo(nullptr),`
`78`	`78`	`m_displayNameIsRecyclerAllocated(false),`
`79`		`- m_tag11(true)`
	`79`	`+ m_tag11(true),`
	`80`	`+ m_isJsBuiltInCode(false)`
`80`	`81`	`{`
	`82`	`+#if DBG`
	`83`	`+ m_isJsBuiltInInitCode = false;`
	`84`	`+#endif`
`81`	`85`	`PERF_COUNTER_INC(Code, TotalFunction);`
`82`	`86`	`}`
`83`	`87`
Original file line number	Diff line number	Diff line change
`@@ -8372,6 +8372,7 @@ const byte * InterpreterStackFrame::OP_ProfiledLoopBodyStart(uint loopId)`
`8372`	`8372`
`8373`	`8373`	`Var InterpreterStackFrame::GetRootObject() const`
`8374`	`8374`	`{`
	`8375`	`+ Assert(!this->GetFunctionBody()->IsJsBuiltInInitCode());`
`8375`	`8376`	`Var rootObject = GetReg(Js::FunctionBody::RootObjectRegSlot);`
`8376`	`8377`	`Assert(rootObject == this->GetFunctionBody()->LoadRootObject());`
`8377`	`8378`	`return rootObject;`
Original file line number	Diff line number	Diff line change
`@@ -33,12 +33,14 @@ namespace Js`
`33`	`33`	`: DynamicObject(type), functionInfo(nullptr), constructorCache(&ConstructorCache::DefaultInstance)`
`34`	`34`	`{`
`35`	`35`	`Assert(this->constructorCache != nullptr);`
	`36`	`+#if DBG`
	`37`	`+ isJsBuiltInInitCode = false;`
	`38`	`+#endif`
`36`	`39`	`}`
`37`	`40`
`38`	`41`
`39`	`42`	`JavascriptFunction::JavascriptFunction(DynamicType * type, FunctionInfo * functionInfo)`
`40`	`43`	`: DynamicObject(type), functionInfo(functionInfo), constructorCache(&ConstructorCache::DefaultInstance)`
`41`		`-`
`42`	`44`	`{`
`43`	`45`	`Assert(this->constructorCache != nullptr);`
`44`	`46`	`this->GetTypeHandler()->ClearHasOnlyWritableDataProperties(); // length is non-writable`
`@@ -50,11 +52,13 @@ namespace Js`
`50`	`52`	`// GetScriptContext()->InvalidateStoreFieldCaches(PropertyIds::length);`
`51`	`53`	`GetLibrary()->NoPrototypeChainsAreEnsuredToHaveOnlyWritableDataProperties();`
`52`	`54`	`}`
	`55`	`+#if DBG`
	`56`	`+ isJsBuiltInInitCode = false;`
	`57`	`+#endif`
`53`	`58`	`}`
`54`	`59`
`55`	`60`	`JavascriptFunction::JavascriptFunction(DynamicType * type, FunctionInfo * functionInfo, ConstructorCache* cache)`
`56`	`61`	`: DynamicObject(type), functionInfo(functionInfo), constructorCache(cache)`
`57`		`-`
`58`	`62`	`{`
`59`	`63`	`Assert(this->constructorCache != nullptr);`
`60`	`64`	`this->GetTypeHandler()->ClearHasOnlyWritableDataProperties(); // length is non-writable`
`@@ -66,6 +70,9 @@ namespace Js`
`66`	`70`	`// GetScriptContext()->InvalidateStoreFieldCaches(PropertyIds::length);`
`67`	`71`	`GetLibrary()->NoPrototypeChainsAreEnsuredToHaveOnlyWritableDataProperties();`
`68`	`72`	`}`
	`73`	`+#if DBG`
	`74`	`+ isJsBuiltInInitCode = false;`
	`75`	`+#endif`
`69`	`76`	`}`
`70`	`77`
`71`	`78`	`FunctionProxy *JavascriptFunction::GetFunctionProxy() const`