v6.x: backport V8 fixes for parser bugs by targos · Pull Request #12037 · nodejs/node

added 3 commits

March 25, 2017 14:46
Original commit message:

    Properly handle holes following spreads in array literals

    Before this change, the spread desugaring would naively call
    `%AppendElement($R, the_hole)` and in some cases $R would have
    a non-holey elements kind, putting the array into the bad state
    of exposing holes to author code.

    This patch avoids calling %AppendElement with a hole, instead
    simply incrementing $R.length when it sees a hole in the literal
    (this is safe because $R is known to be an Array). The existing
    logic for elements transitions takes care of giving the array a
    holey ElementsKind.

    BUG=chromium:644215

    Review-Url: https://codereview.chromium.org/2321533003
    Cr-Commit-Position: refs/heads/master@{nodejs#39294}

Fixes: nodejs#12018

bnoordhuis

MylesBorins

MylesBorins pushed a commit that referenced this pull request

Mar 28, 2017

MylesBorins pushed a commit that referenced this pull request

Mar 28, 2017

MylesBorins pushed a commit that referenced this pull request

Mar 28, 2017
Original commit message:

    Properly handle holes following spreads in array literals

    Before this change, the spread desugaring would naively call
    `%AppendElement($R, the_hole)` and in some cases $R would have
    a non-holey elements kind, putting the array into the bad state
    of exposing holes to author code.

    This patch avoids calling %AppendElement with a hole, instead
    simply incrementing $R.length when it sees a hole in the literal
    (this is safe because $R is known to be an Array). The existing
    logic for elements transitions takes care of giving the array a
    holey ElementsKind.

    BUG=chromium:644215

    Review-Url: https://codereview.chromium.org/2321533003
    Cr-Commit-Position: refs/heads/master@{#39294}

Fixes: #12018

PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

This was referenced

Mar 28, 2017

@targos targos deleted the fix-v8-parser-crash branch

March 29, 2017 16:09

MylesBorins pushed a commit that referenced this pull request

Mar 29, 2017

MylesBorins pushed a commit that referenced this pull request

Mar 29, 2017

MylesBorins pushed a commit that referenced this pull request

Mar 29, 2017
Original commit message:

    Properly handle holes following spreads in array literals

    Before this change, the spread desugaring would naively call
    `%AppendElement($R, the_hole)` and in some cases $R would have
    a non-holey elements kind, putting the array into the bad state
    of exposing holes to author code.

    This patch avoids calling %AppendElement with a hole, instead
    simply incrementing $R.length when it sees a hole in the literal
    (this is safe because $R is known to be an Array). The existing
    logic for elements transitions takes care of giving the array a
    holey ElementsKind.

    BUG=chromium:644215

    Review-Url: https://codereview.chromium.org/2321533003
    Cr-Commit-Position: refs/heads/master@{#39294}

Fixes: #12018

PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

MylesBorins pushed a commit that referenced this pull request

Mar 29, 2017

MylesBorins pushed a commit that referenced this pull request

Mar 29, 2017

MylesBorins pushed a commit that referenced this pull request

Mar 29, 2017
Original commit message:

    Properly handle holes following spreads in array literals

    Before this change, the spread desugaring would naively call
    `%AppendElement($R, the_hole)` and in some cases $R would have
    a non-holey elements kind, putting the array into the bad state
    of exposing holes to author code.

    This patch avoids calling %AppendElement with a hole, instead
    simply incrementing $R.length when it sees a hole in the literal
    (this is safe because $R is known to be an Array). The existing
    logic for elements transitions takes care of giving the array a
    holey ElementsKind.

    BUG=chromium:644215

    Review-Url: https://codereview.chromium.org/2321533003
    Cr-Commit-Position: refs/heads/master@{#39294}

Fixes: #12018

PR-URL: #12037
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

MylesBorins added a commit that referenced this pull request

Mar 29, 2017
This is a special LTS to fix a number of regressions that were found
on the 6.10.x release line.

This includes:

 * a fix for memory leak in the crypto module that
   was introduced in 6.10.1
 * a fix for a regression introduced to the windows repl in 6.10.0
 * a backported fix for V8 to stop a segfault that could occur
   when using spread syntax

It also includes an upgrade to zlib 1.2.11 to fix a numberof low
severity CVEs that were present in zlib 1.2.8.

http://seclists.org/oss-sec/2016/q4/602

Notable changes

* crypto:
  - fix memory leak if certificate is revoked (Tom Atkinson)
    #12089
* deps:
  - upgrade zlib to 1.2.11 (Sam Roberts)
    #10980
  - backport V8 fixes for spread syntax regression causing segfaults
    (Michaël Zasso) #12037
* repl:
  - Revert commit that broke REPL display on Windows (Myles Borins)
    #12123

MylesBorins added a commit that referenced this pull request

Apr 4, 2017
This is a special LTS to fix a number of regressions that were found
on the 6.10.x release line.

This includes:

 * a fix for memory leak in the crypto module that
   was introduced in 6.10.1
 * a fix for a regression introduced to the windows repl in 6.10.0
 * a backported fix for V8 to stop a segfault that could occur
   when using spread syntax

It also includes an upgrade to zlib 1.2.11 to fix a numberof low
severity CVEs that were present in zlib 1.2.8.

http://seclists.org/oss-sec/2016/q4/602

Notable changes

* crypto:
  - fix memory leak if certificate is revoked (Tom Atkinson)
    #12089
* deps:
  - upgrade zlib to 1.2.11 (Sam Roberts)
    #10980
  - backport V8 fixes for spread syntax regression causing segfaults
    (Michaël Zasso) #12037
* repl:
  - Revert commit that broke REPL display on Windows (Myles Borins)
    #12123

MylesBorins added a commit to MylesBorins/node that referenced this pull request

Apr 4, 2017
This is a special LTS to fix a number of regressions that were found
on the 6.10.x release line.

This includes:

 * a fix for memory leak in the crypto module that
   was introduced in 6.10.1
 * a fix for a regression introduced to the windows repl in 6.10.0
 * a backported fix for V8 to stop a segfault that could occur
   when using spread syntax

It also includes an upgrade to zlib 1.2.11 to fix a numberof low
severity CVEs that were present in zlib 1.2.8.

http://seclists.org/oss-sec/2016/q4/602

Notable changes

* crypto:
  - fix memory leak if certificate is revoked (Tom Atkinson)
    nodejs#12089
* deps:
  - upgrade zlib to 1.2.11 (Sam Roberts)
    nodejs#10980
  - backport V8 fixes for spread syntax regression causing segfaults
    (Michaël Zasso) nodejs#12037
* repl:
  - Revert commit that broke REPL display on Windows (Myles Borins)
    nodejs#12123

imyller added a commit to imyller/meta-nodejs that referenced this pull request

Apr 20, 2017
    This is a special LTS to fix a number of regressions that were found
    on the 6.10.x release line.

    This includes:

     * a fix for memory leak in the crypto module that
       was introduced in 6.10.1
     * a fix for a regression introduced to the windows repl in 6.10.0
     * a backported fix for V8 to stop a segfault that could occur
       when using spread syntax

    It also includes an upgrade to zlib 1.2.11 to fix a numberof low
    severity CVEs that were present in zlib 1.2.8.

    http://seclists.org/oss-sec/2016/q4/602

    Notable changes

    * crypto:
      - fix memory leak if certificate is revoked (Tom Atkinson)
        nodejs/node#12089
    * deps:
      - upgrade zlib to 1.2.11 (Sam Roberts)
        nodejs/node#10980
      - backport V8 fixes for spread syntax regression causing segfaults
        (Michaël Zasso) nodejs/node#12037
    * repl:
      - Revert commit that broke REPL display on Windows (Myles Borins)
        nodejs/node#12123

Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>

imyller added a commit to imyller/meta-nodejs that referenced this pull request

Apr 20, 2017
    This is a special LTS to fix a number of regressions that were found
    on the 6.10.x release line.

    This includes:

     * a fix for memory leak in the crypto module that
       was introduced in 6.10.1
     * a fix for a regression introduced to the windows repl in 6.10.0
     * a backported fix for V8 to stop a segfault that could occur
       when using spread syntax

    It also includes an upgrade to zlib 1.2.11 to fix a numberof low
    severity CVEs that were present in zlib 1.2.8.

    http://seclists.org/oss-sec/2016/q4/602

    Notable changes

    * crypto:
      - fix memory leak if certificate is revoked (Tom Atkinson)
        nodejs/node#12089
    * deps:
      - upgrade zlib to 1.2.11 (Sam Roberts)
        nodejs/node#10980
      - backport V8 fixes for spread syntax regression causing segfaults
        (Michaël Zasso) nodejs/node#12037
    * repl:
      - Revert commit that broke REPL display on Windows (Myles Borins)
        nodejs/node#12123

Signed-off-by: Ilkka Myller <ilkka.myller@nodefield.com>