Skip to content

v6.x: backport V8 fixes for parser bugs - #12037

Closed
targos wants to merge 3 commits into
nodejs:v6.x-stagingfrom
targos:fix-v8-parser-crash
Closed

v6.x: backport V8 fixes for parser bugs#12037
targos wants to merge 3 commits into
nodejs:v6.x-stagingfrom
targos:fix-v8-parser-crash

Conversation

@targos

Copy link
Copy Markdown
Member

This PR includes three fixes related to spread syntax.
One of the bugs was introduced in 6.10.1 and can be easily encountered in projects using istanbul.

Refs: #11977

Checklist
  • make -j4 test (UNIX), or vcbuild test (Windows) passes
  • tests and/or benchmarks are included
  • commit message follows commit guidelines
Affected core subsystem(s)

V8

Original commit message:
Fix classifier related bug
R=adamk@chromium.org
BUG=chromium:621111
LOG=N
Review-Url: https://codereview.chromium.org/2086513002
Cr-Commit-Position: refs/heads/master@{nodejs#37150}
Fixes: nodejs#11977
Original commit message:
Fix bug with illegal spread as single arrow parameter
R=adamk@chromium.org
BUG=chromium:621496
LOG=N
Review-Url: https://codereview.chromium.org/2084703005
Cr-Commit-Position: refs/heads/master@{nodejs#37196}
Fixes: nodejs#12017
Original commit message:
Properly handle holes following spreads in array literals
Before this change, the spread desugaring would naively call
`%AppendElement($R, the_hole)` and in some cases $R would have
a non-holey elements kind, putting the array into the bad state
of exposing holes to author code.
This patch avoids calling %AppendElement with a hole, instead
simply incrementing $R.length when it sees a hole in the literal
(this is safe because $R is known to be an Array). The existing
logic for elements transitions takes care of giving the array a
holey ElementsKind.
BUG=chromium:644215
Review-Url: https://codereview.chromium.org/2321533003
Cr-Commit-Position: refs/heads/master@{nodejs#39294}
Fixes: nodejs#12018
@nodejs-github-botnodejs-github-bot added v6.x v8 engine Issues and PRs related to the V8 dependency. labels Mar 25, 2017
@targos

Copy link
Copy Markdown
MemberAuthor

@targos

Copy link
Copy Markdown
MemberAuthor

/cc @nodejs/v8

@bnoordhuisbnoordhuis left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good work. CI failure is that "no member named 'max_align_t'" build error on the clang 3.4.1 buildbot.

@MylesBorins

Copy link
Copy Markdown
Contributor

@bnoordhuis / @nodejs/build do we have to worry about that error?

I'll land tomorrow if not

@MylesBorinsMylesBorins left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Built locally and can confirm that it fixes the reported bug

rubber stamp LGTM

@bnoordhuis

Copy link
Copy Markdown
Member

do we have to worry about that error?

No, it's not caused by this PR.

MylesBorins pushed a commit that referenced this pull request Mar 28, 2017
Original commit message:
Fix classifier related bug
R=adamk@chromium.org
BUG=chromium:621111
LOG=N
Review-Url: https://codereview.chromium.org/2086513002
Cr-Commit-Position: refs/heads/master@{#37150}
Fixes: #11977
PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2017
Original commit message:
Fix bug with illegal spread as single arrow parameter
R=adamk@chromium.org
BUG=chromium:621496
LOG=N
Review-Url: https://codereview.chromium.org/2084703005
Cr-Commit-Position: refs/heads/master@{#37196}
Fixes: #12017
PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
MylesBorins pushed a commit that referenced this pull request Mar 28, 2017
Original commit message:
Properly handle holes following spreads in array literals
Before this change, the spread desugaring would naively call
`%AppendElement($R, the_hole)` and in some cases $R would have
a non-holey elements kind, putting the array into the bad state
of exposing holes to author code.
This patch avoids calling %AppendElement with a hole, instead
simply incrementing $R.length when it sees a hole in the literal
(this is safe because $R is known to be an Array). The existing
logic for elements transitions takes care of giving the array a
holey ElementsKind.
BUG=chromium:644215
Review-Url: https://codereview.chromium.org/2321533003
Cr-Commit-Position: refs/heads/master@{#39294}
Fixes: #12018
PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
@MylesBorins

Copy link
Copy Markdown
Contributor

landed in 0e9bd94...21944e8

@targos
targos deleted the fix-v8-parser-crash branch March 29, 2017 16:09
MylesBorins pushed a commit that referenced this pull request Mar 29, 2017
Original commit message:
Fix classifier related bug
R=adamk@chromium.org
BUG=chromium:621111
LOG=N
Review-Url: https://codereview.chromium.org/2086513002
Cr-Commit-Position: refs/heads/master@{#37150}
Fixes: #11977
PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
MylesBorins pushed a commit that referenced this pull request Mar 29, 2017
Original commit message:
Fix bug with illegal spread as single arrow parameter
R=adamk@chromium.org
BUG=chromium:621496
LOG=N
Review-Url: https://codereview.chromium.org/2084703005
Cr-Commit-Position: refs/heads/master@{#37196}
Fixes: #12017
PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
MylesBorins pushed a commit that referenced this pull request Mar 29, 2017
Original commit message:
Properly handle holes following spreads in array literals
Before this change, the spread desugaring would naively call
`%AppendElement($R, the_hole)` and in some cases $R would have
a non-holey elements kind, putting the array into the bad state
of exposing holes to author code.
This patch avoids calling %AppendElement with a hole, instead
simply incrementing $R.length when it sees a hole in the literal
(this is safe because $R is known to be an Array). The existing
logic for elements transitions takes care of giving the array a
holey ElementsKind.
BUG=chromium:644215
Review-Url: https://codereview.chromium.org/2321533003
Cr-Commit-Position: refs/heads/master@{#39294}
Fixes: #12018
PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
MylesBorins pushed a commit that referenced this pull request Mar 29, 2017
Original commit message:
Fix classifier related bug
R=adamk@chromium.org
BUG=chromium:621111
LOG=N
Review-Url: https://codereview.chromium.org/2086513002
Cr-Commit-Position: refs/heads/master@{#37150}
Fixes: #11977
PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
MylesBorins pushed a commit that referenced this pull request Mar 29, 2017
Original commit message:
Fix bug with illegal spread as single arrow parameter
R=adamk@chromium.org
BUG=chromium:621496
LOG=N
Review-Url: https://codereview.chromium.org/2084703005
Cr-Commit-Position: refs/heads/master@{#37196}
Fixes: #12017
PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
MylesBorins pushed a commit that referenced this pull request Mar 29, 2017
Original commit message:
Properly handle holes following spreads in array literals
Before this change, the spread desugaring would naively call
`%AppendElement($R, the_hole)` and in some cases $R would have
a non-holey elements kind, putting the array into the bad state
of exposing holes to author code.
This patch avoids calling %AppendElement with a hole, instead
simply incrementing $R.length when it sees a hole in the literal
(this is safe because $R is known to be an Array). The existing
logic for elements transitions takes care of giving the array a
holey ElementsKind.
BUG=chromium:644215
Review-Url: https://codereview.chromium.org/2321533003
Cr-Commit-Position: refs/heads/master@{#39294}
Fixes: #12018
PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>
@MylesBorinsMylesBorins mentioned this pull request Mar 29, 2017
MylesBorins added a commit that referenced this pull request Mar 29, 2017
This is a special LTS to fix a number of regressions that were found
on the 6.10.x release line.
This includes:
* a fix for memory leak in the crypto module that
was introduced in 6.10.1
* a fix for a regression introduced to the windows repl in 6.10.0
* a backported fix for V8 to stop a segfault that could occur
when using spread syntax
It also includes an upgrade to zlib 1.2.11 to fix a numberof low
severity CVEs that were present in zlib 1.2.8.
http://seclists.org/oss-sec/2016/q4/602
Notable changes
* crypto:
- fix memory leak if certificate is revoked (Tom Atkinson)
#12089
* deps:
- upgrade zlib to 1.2.11 (Sam Roberts)
#10980
- backport V8 fixes for spread syntax regression causing segfaults
(Michaël Zasso) #12037
* repl:
- Revert commit that broke REPL display on Windows (Myles Borins)
#12123
MylesBorins added a commit that referenced this pull request Apr 4, 2017
This is a special LTS to fix a number of regressions that were found
on the 6.10.x release line.
This includes:
* a fix for memory leak in the crypto module that
was introduced in 6.10.1
* a fix for a regression introduced to the windows repl in 6.10.0
* a backported fix for V8 to stop a segfault that could occur
when using spread syntax
It also includes an upgrade to zlib 1.2.11 to fix a numberof low
severity CVEs that were present in zlib 1.2.8.
http://seclists.org/oss-sec/2016/q4/602
Notable changes
* crypto:
- fix memory leak if certificate is revoked (Tom Atkinson)
#12089
* deps:
- upgrade zlib to 1.2.11 (Sam Roberts)
#10980
- backport V8 fixes for spread syntax regression causing segfaults
(Michaël Zasso) #12037
* repl:
- Revert commit that broke REPL display on Windows (Myles Borins)
#12123
MylesBorins added a commit to MylesBorins/node that referenced this pull request Apr 4, 2017
This is a special LTS to fix a number of regressions that were found
on the 6.10.x release line.
This includes:
* a fix for memory leak in the crypto module that
was introduced in 6.10.1
* a fix for a regression introduced to the windows repl in 6.10.0
* a backported fix for V8 to stop a segfault that could occur
when using spread syntax
It also includes an upgrade to zlib 1.2.11 to fix a numberof low
severity CVEs that were present in zlib 1.2.8.
http://seclists.org/oss-sec/2016/q4/602
Notable changes
* crypto:
- fix memory leak if certificate is revoked (Tom Atkinson)
nodejs#12089
* deps:
- upgrade zlib to 1.2.11 (Sam Roberts)
nodejs#10980
- backport V8 fixes for spread syntax regression causing segfaults
(Michaël Zasso) nodejs#12037
* repl:
- Revert commit that broke REPL display on Windows (Myles Borins)
nodejs#12123
imyller added a commit to imyller/meta-nodejs that referenced this pull request Apr 20, 2017
 This is a special LTS to fix a number of regressions that were found
on the 6.10.x release line.
This includes:
* a fix for memory leak in the crypto module that
was introduced in 6.10.1
* a fix for a regression introduced to the windows repl in 6.10.0
* a backported fix for V8 to stop a segfault that could occur
when using spread syntax
It also includes an upgrade to zlib 1.2.11 to fix a numberof low
severity CVEs that were present in zlib 1.2.8.
http://seclists.org/oss-sec/2016/q4/602
Notable changes
* crypto:
- fix memory leak if certificate is revoked (Tom Atkinson)
nodejs/node#12089
* deps:
- upgrade zlib to 1.2.11 (Sam Roberts)
nodejs/node#10980
- backport V8 fixes for spread syntax regression causing segfaults
(Michaël Zasso) nodejs/node#12037
* repl:
- Revert commit that broke REPL display on Windows (Myles Borins)
nodejs/node#12123
Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>
imyller added a commit to imyller/meta-nodejs that referenced this pull request Apr 20, 2017
 This is a special LTS to fix a number of regressions that were found
on the 6.10.x release line.
This includes:
* a fix for memory leak in the crypto module that
was introduced in 6.10.1
* a fix for a regression introduced to the windows repl in 6.10.0
* a backported fix for V8 to stop a segfault that could occur
when using spread syntax
It also includes an upgrade to zlib 1.2.11 to fix a numberof low
severity CVEs that were present in zlib 1.2.8.
http://seclists.org/oss-sec/2016/q4/602
Notable changes
* crypto:
- fix memory leak if certificate is revoked (Tom Atkinson)
nodejs/node#12089
* deps:
- upgrade zlib to 1.2.11 (Sam Roberts)
nodejs/node#10980
- backport V8 fixes for spread syntax regression causing segfaults
(Michaël Zasso) nodejs/node#12037
* repl:
- Revert commit that broke REPL display on Windows (Myles Borins)
nodejs/node#12123
Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v8 engineIssues and PRs related to the V8 dependency.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

@targos@MylesBorins@bnoordhuis@nodejs-github-bot