194800 2019-02-18 16:53:22 -0800 (CVE-2019-8559) Fix DFG doesGC() for CompareEq/Less/LessEq/Greater/GreaterEq and CompareStrictEq nodes. 2019-04-04 09:30:31 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam bugs.webkit.org commit-queue ews-watchlist fpizlo keith_miller mcatanzaro msaboff rmorisset saam tzagallo webkit-bug-importer ysuzuki oldest_to_newest 1507539 0 mark.lam 2019-02-18 16:53:22 -0800 Fix doesGC() for the CompareEq, CompareLess, CompareLessEq, CompareGreater, CompareGreaterEq, and CompareStrictEq. 1507540 1 webkit-bug-importer 2019-02-18 16:53:56 -0800 <rdar://problem/48183773> 1507542 2 362357 mark.lam 2019-02-18 17:02:03 -0800 Created attachment 362357 proposed patch. 1507543 3 ews-watchlist 2019-02-18 17:05:37 -0800 Attachment 362357 did not pass style-queue: ERROR: Source/JavaScriptCore/dfg/DFGDoesGC.cpp:410: Multi line control clauses should use braces. [whitespace/braces] [4] Total errors found: 1 in 2 files If any of these errors are false positives, please file a bug against check-webkit-style. 1507547 4 362357 ysuzuki 2019-02-18 17:14:57 -0800 Comment on attachment 362357 proposed patch. r=me 1507564 5 362357 mark.lam 2019-02-18 18:06:04 -0800 Comment on attachment 362357 proposed patch. Thanks for the review. Landing now. 1507570 6 362357 commit-queue 2019-02-18 18:32:15 -0800 Comment on attachment 362357 proposed patch. Clearing flags on attachment: 362357 Committed r241753: <https://trac.webkit.org/changeset/241753> 1507571 7 commit-queue 2019-02-18 18:32:17 -0800 All reviewed patches have been landed. Closing bug. 1508986 8 bugs.webkit.org 2019-02-22 07:18:38 -0800 Looks like somebody should request a CVE and up the importance of this bug. https://twitter.com/qwertyoruiopz/status/1098642526041444354 https://ghostbin.com/paste/c4dhv 362357 2019-02-18 17:02:03 -0800 2019-02-18 18:32:15 -0800 proposed patch. bug-194800.patch text/plain 3758 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjQxNzQ4KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI2IEBA CisyMDE5LTAyLTE4ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBG aXggREZHIGRvZXNHQygpIGZvciBDb21wYXJlRXEvTGVzcy9MZXNzRXEvR3JlYXRlci9HcmVhdGVy RXEgYW5kIENvbXBhcmVTdHJpY3RFcSBub2Rlcy4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTE5NDgwMAorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNDgx ODM3NzM+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg Rml4IGRvZXNHQygpIGZvciB0aGUgZm9sbG93aW5nIG5vZGVzOgorCisgICAgICAgICAgICBDb21w YXJlRXE6CisgICAgICAgICAgICBDb21wYXJlTGVzczoKKyAgICAgICAgICAgIENvbXBhcmVMZXNz RXE6CisgICAgICAgICAgICBDb21wYXJlR3JlYXRlcjoKKyAgICAgICAgICAgIENvbXBhcmVHcmVh dGVyRXE6CisgICAgICAgICAgICBDb21wYXJlU3RyaWN0RXE6CisgICAgICAgICAgICAgICAgT25s eSByZXR1cm4gZmFsc2UgKGkuZS4gZG9lcyBub3QgR0MpIGZvciBjaGlsZCBub2RlIHVzZSBraW5k cyB0aGF0IGhhdmUKKyAgICAgICAgICAgICAgICBiZWVuIHZldHRlZCB0byBub3QgZG8gYW55dGhp bmcgdGhhdCBjYW4gR0MuICBGb3IgYWxsIG90aGVyIHVzZSBraW5kcworICAgICAgICAgICAgICAg IChpbmNsdWRpbmcgU3RyaW5nVXNlIGFuZCBCaWdJbnRVc2UpLCB3ZSByZXR1cm4gdHJ1ZSAoaS5l LiBkb2VzIEdDKS4KKworICAgICAgICAqIGRmZy9ERkdEb2VzR0MuY3BwOgorICAgICAgICAoSlND OjpERkc6OmRvZXNHQyk6CisKIDIwMTktMDItMTggIFl1c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFw cGxlLmNvbT4KIAogICAgICAgICBbSlNDXSBBZGQgTGF6eUNsYXNzU3RydWN0dXJlOjpnZXRJbml0 aWFsaXplZE9uTWFpblRocmVhZApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdE b2VzR0MuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHRG9l c0dDLmNwcAkocmV2aXNpb24gMjQxNjUwKQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9E RkdEb2VzR0MuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMzMsMTQgKzEzMyw4IEBAIGJvb2wgZG9l c0dDKEdyYXBoJiBncmFwaCwgTm9kZSogbm9kZSkKICAgICBjYXNlIENoZWNrTm90RW1wdHk6CiAg ICAgY2FzZSBBc3NlcnROb3RFbXB0eToKICAgICBjYXNlIENoZWNrU3RyaW5nSWRlbnQ6Ci0gICAg Y2FzZSBDb21wYXJlTGVzczoKLSAgICBjYXNlIENvbXBhcmVMZXNzRXE6Ci0gICAgY2FzZSBDb21w YXJlR3JlYXRlcjoKLSAgICBjYXNlIENvbXBhcmVHcmVhdGVyRXE6CiAgICAgY2FzZSBDb21wYXJl QmVsb3c6CiAgICAgY2FzZSBDb21wYXJlQmVsb3dFcToKLSAgICBjYXNlIENvbXBhcmVFcToKLSAg ICBjYXNlIENvbXBhcmVTdHJpY3RFcToKICAgICBjYXNlIENvbXBhcmVFcVB0cjoKICAgICBjYXNl IFByb2ZpbGVUeXBlOgogICAgIGNhc2UgUHJvZmlsZUNvbnRyb2xGbG93OgpAQCAtNDA4LDYgKzQw Miw0NiBAQCBib29sIGRvZXNHQyhHcmFwaCYgZ3JhcGgsIE5vZGUqIG5vZGUpCiAgICAgICAgIEFT U0VSVChPcHRpb25zOjp1c2VQb2xsaW5nVHJhcHMoKSk7CiAgICAgICAgIHJldHVybiB0cnVlOwog CisgICAgY2FzZSBDb21wYXJlRXE6CisgICAgY2FzZSBDb21wYXJlTGVzczoKKyAgICBjYXNlIENv bXBhcmVMZXNzRXE6CisgICAgY2FzZSBDb21wYXJlR3JlYXRlcjoKKyAgICBjYXNlIENvbXBhcmVH cmVhdGVyRXE6CisgICAgICAgIGlmIChub2RlLT5pc0JpbmFyeVVzZUtpbmQoSW50MzJVc2UpCisj aWYgVVNFKEpTVkFMVUU2NCkKKyAgICAgICAgICAgIHx8IG5vZGUtPmlzQmluYXJ5VXNlS2luZChJ bnQ1MlJlcFVzZSkKKyNlbmRpZgorICAgICAgICAgICAgfHwgbm9kZS0+aXNCaW5hcnlVc2VLaW5k KERvdWJsZVJlcFVzZSkKKyAgICAgICAgICAgIHx8IG5vZGUtPmlzQmluYXJ5VXNlS2luZChTdHJp bmdJZGVudFVzZSkKKyAgICAgICAgICAgICkKKyAgICAgICAgICAgIHJldHVybiBmYWxzZTsKKyAg ICAgICAgaWYgKG5vZGUtPm9wKCkgPT0gQ29tcGFyZUVxKSB7CisgICAgICAgICAgICBpZiAobm9k ZS0+aXNCaW5hcnlVc2VLaW5kKEJvb2xlYW5Vc2UpCisgICAgICAgICAgICAgICAgfHwgbm9kZS0+ aXNCaW5hcnlVc2VLaW5kKFN5bWJvbFVzZSkKKyAgICAgICAgICAgICAgICB8fCBub2RlLT5pc0Jp bmFyeVVzZUtpbmQoT2JqZWN0VXNlKQorICAgICAgICAgICAgICAgIHx8IG5vZGUtPmlzQmluYXJ5 VXNlS2luZChPYmplY3RVc2UsIE9iamVjdE9yT3RoZXJVc2UpIHx8IG5vZGUtPmlzQmluYXJ5VXNl S2luZChPYmplY3RPck90aGVyVXNlLCBPYmplY3RVc2UpKQorICAgICAgICAgICAgICAgIHJldHVy biBmYWxzZTsKKyAgICAgICAgfQorICAgICAgICByZXR1cm4gdHJ1ZTsKKworICAgIGNhc2UgQ29t cGFyZVN0cmljdEVxOgorICAgICAgICBpZiAobm9kZS0+aXNCaW5hcnlVc2VLaW5kKEJvb2xlYW5V c2UpCisgICAgICAgICAgICB8fCBub2RlLT5pc0JpbmFyeVVzZUtpbmQoSW50MzJVc2UpCisjaWYg VVNFKEpTVkFMVUU2NCkKKyAgICAgICAgICAgIHx8IG5vZGUtPmlzQmluYXJ5VXNlS2luZChJbnQ1 MlJlcFVzZSkKKyNlbmRpZgorICAgICAgICAgICAgfHwgbm9kZS0+aXNCaW5hcnlVc2VLaW5kKERv dWJsZVJlcFVzZSkKKyAgICAgICAgICAgIHx8IG5vZGUtPmlzQmluYXJ5VXNlS2luZChTeW1ib2xV c2UpCisgICAgICAgICAgICB8fCBub2RlLT5pc0JpbmFyeVVzZUtpbmQoU3ltYm9sVXNlLCBVbnR5 cGVkVXNlKQorICAgICAgICAgICAgfHwgbm9kZS0+aXNCaW5hcnlVc2VLaW5kKFVudHlwZWRVc2Us IFN5bWJvbFVzZSkKKyAgICAgICAgICAgIHx8IG5vZGUtPmlzQmluYXJ5VXNlS2luZChTdHJpbmdJ ZGVudFVzZSkKKyAgICAgICAgICAgIHx8IG5vZGUtPmlzQmluYXJ5VXNlS2luZChPYmplY3RVc2Us IFVudHlwZWRVc2UpIHx8IG5vZGUtPmlzQmluYXJ5VXNlS2luZChVbnR5cGVkVXNlLCBPYmplY3RV c2UpCisgICAgICAgICAgICB8fCBub2RlLT5pc0JpbmFyeVVzZUtpbmQoT2JqZWN0VXNlKQorICAg ICAgICAgICAgfHwgbm9kZS0+aXNCaW5hcnlVc2VLaW5kKE1pc2NVc2UsIFVudHlwZWRVc2UpIHx8 IG5vZGUtPmlzQmluYXJ5VXNlS2luZChVbnR5cGVkVXNlLCBNaXNjVXNlKQorICAgICAgICAgICAg fHwgbm9kZS0+aXNCaW5hcnlVc2VLaW5kKFN0cmluZ0lkZW50VXNlLCBOb3RTdHJpbmdWYXJVc2Up IHx8IG5vZGUtPmlzQmluYXJ5VXNlS2luZChOb3RTdHJpbmdWYXJVc2UsIFN0cmluZ0lkZW50VXNl KSkKKyAgICAgICAgICAgIHJldHVybiBmYWxzZTsKKyAgICAgICAgcmV0dXJuIHRydWU7CisKICAg ICBjYXNlIEdldEluZGV4ZWRQcm9wZXJ0eVN0b3JhZ2U6CiAgICAgY2FzZSBHZXRCeVZhbDoKICAg ICAgICAgaWYgKG5vZGUtPmFycmF5TW9kZSgpLnR5cGUoKSA9PSBBcnJheTo6U3RyaW5nKQo=