Chrome-V8 CVE-2021-30588

template <Phase T>
void VisitNode(Node* node, Truncation truncation,
SimplifiedLowering* lowering) {
tick_counter_->TickAndMaybeEnterSafepoint();

// Unconditionally eliminate unused pure nodes (only relevant if there's
// a pure operation in between two effectful ones, where the last one
// is unused).
// Note: We must not do this for constants, as they are cached and we
// would thus kill the cached {node} during lowering (i.e. replace all
// uses with Dead), but at that point some node lowering might have
// already taken the constant {node} from the cache (while it was not
// yet killed) and we would afterwards replace that use with Dead as well.
if (node->op()->ValueInputCount() > 0 &&
node->op()->HasProperty(Operator::kPure) && truncation.IsUnused()) {
return VisitUnused<T>(node); //调用的这个函数里面打了patch
}

if (lower<T>()) InsertUnreachableIfNecessary<T>(node); //这里打了patch，且InsertUnreachableIfNecessary里也打了patch，从SpeculativeToNumber变为unreachable就是在这个函数内

switch (node->opcode()) {
[ ... ]
case IrOpcode::kSpeculativeToNumber: {
NumberOperationParameters const& p =
NumberOperationParametersOf(node->op());
switch (p.hint()) {
case NumberOperationHint::kSignedSmall:
case NumberOperationHint::kSignedSmallInputs:
VisitUnop<T>(node,
CheckedUseInfoAsWord32FromHint(
p.hint(), kDistinguishZeros, p.feedback()),
MachineRepresentation::kWord32, Type::Signed32());
break;
case NumberOperationHint::kNumber:
case NumberOperationHint::kNumberOrBoolean:
case NumberOperationHint::kNumberOrOddball: //这里会将其换为float64
VisitUnop<T>(
node, CheckedUseInfoAsFloat64FromHint(p.hint(), p.feedback()),
MachineRepresentation::kFloat64);
break;
}
if (lower<T>()) DeferReplacement(node, node->InputAt(0));
return;
}

diff --git a/src/compiler/simplified-lowering.cc b/src/compiler/simplified-lowering.cc
index 23e0006..a71e627 100644
--- a/src/compiler/simplified-lowering.cc
+++ b/src/compiler/simplified-lowering.cc
@@ -1960,7 +1975,32 @@
return VisitUnused<T>(node);
}

- if (lower<T>()) InsertUnreachableIfNecessary<T>(node);
+ if (lower<T>()) {
+ // Kill non-effectful operations that have a None-type input and are thus
+ // dead code. Otherwise we might end up lowering the operation in a way,
+ // e.g. by replacing it with a constant, that cuts the dependency on a
+ // deopting operation (the producer of the None type), possibly resulting
+ // in a nonsense schedule.
+ if (node->op()->EffectOutputCount() == 0 &&
+ node->op()->ControlOutputCount() == 0 &&
+ node->opcode() != IrOpcode::kDeadValue &&
+ node->opcode() != IrOpcode::kStateValues &&
+ node->opcode() != IrOpcode::kFrameState &&
+ node->opcode() != IrOpcode::kPhi) {
+ for (int i = 0; i < node->op()->ValueInputCount(); i++) {
+ Node* input = node->InputAt(i);
+ if (TypeOf(input).IsNone()) {
+ MachineRepresentation rep = GetInfo(node)->representation();
+ DeferReplacement(
+ node,
+ graph()->NewNode(jsgraph_->common()->DeadValue(rep), input));
+ return;
+ }
+ }
+ } else {
+ InsertUnreachableIfNecessary<T>(node);
+ }
+ }

template <>
void RepresentationSelector::InsertUnreachableIfNecessary<LOWER>(Node* node) {
// If the node is effectful and it produces an impossible value, then we
// insert Unreachable node after it.
if (node->op()->ValueOutputCount() > 0 &&
node->op()->EffectOutputCount() > 0 &&
node->opcode() != IrOpcode::kUnreachable && TypeOf(node).IsNone()) {
Node* control = (node->op()->ControlOutputCount() == 0)
? NodeProperties::GetControlInput(node, 0)
: NodeProperties::FindSuccessfulControlProjection(node);

Node* unreachable =
graph()->NewNode(common()->Unreachable(), node, control);

// Insert unreachable node and replace all the effect uses of the {node}
// with the new unreachable node.
for (Edge edge : node->use_edges()) {
if (!NodeProperties::IsEffectEdge(edge)) continue;
// Make sure to not overwrite the unreachable node's input. That would
// create a cycle.
if (edge.from() == unreachable) continue;
// Avoid messing up the exceptional path.
if (edge.from()->opcode() == IrOpcode::kIfException) {
DCHECK(!node->op()->HasProperty(Operator::kNoThrow));
DCHECK_EQ(NodeProperties::GetControlInput(edge.from()), node);
continue;
}

edge.UpdateTo(unreachable);
}
}
}

// Propagates {Dead} control and {DeadValue} values through the graph and
// thereby removes dead code.
// We detect dead values based on types, replacing uses of nodes with
// {Type::None()} with {DeadValue}. A pure node (other than a phi) using
// {DeadValue} is replaced by {DeadValue}. When {DeadValue} hits the effect
// chain, a crashing {Unreachable} node is inserted and the rest of the effect
// chain is collapsed. We wait for the {EffectControlLinearizer} to connect
// {Unreachable} nodes to the graph end, since this is much easier if there is
// no floating control.
// {DeadValue} has an input, which has to have {Type::None()}. This input is
// important to maintain the dependency on the cause of the unreachable code.
// {Unreachable} has a value output and {Type::None()} so it can be used by
// {DeadValue}.
// {DeadValue} nodes track a {MachineRepresentation} so they can be lowered to a
// value-producing node. {DeadValue} has the runtime semantics of crashing and
// behaves like a constant of its representation so it can be used in gap moves.
// Since phi nodes are the only remaining use of {DeadValue}, this
// representation is only adjusted for uses by phi nodes.
// In contrast to {DeadValue}, {Dead} can never remain in th

// If the node is effectful and it produces an impossible value, then we
// insert Unreachable node after it.
if (node->op()->ValueOutputCount() > 0 &&
node->op()->EffectOutputCount() > 0 &&
node->opcode() != IrOpcode::kUnreachable && TypeOf(node).IsNone()) {

(function() {
function foo(a) {
let y = Math.min(Infinity ? [] : Infinity, -0) / 0;
if (a) y = 1.1;
return y ? 1 : 0;
}
%PrepareFunctionForOptimization(foo);
print(foo(false));
%OptimizeFunctionOnNextCall(foo);
print(foo(false));
})();

(function() {
function foo(a) {
let y = Math.min(Infinity ? [] : Infinity, -0) / 0;
console.log("hi");
if (a) y = 1.1;
return y ? 1 : 0;
}
%PrepareFunctionForOptimization(foo);
print(foo(false));
%OptimizeFunctionOnNextCall(foo);
print(foo(false));
})();

Node* EffectControlLinearizer::LowerDeadValue(Node* node) {
Node* input = NodeProperties::GetValueInput(node, 0);
if (input->opcode() != IrOpcode::kUnreachable) {
// There is no fundamental reason not to connect to end here, except it
// integrates into the way the graph is constructed in a simpler way at
// this point.
// TODO(jgruber): Connect to end here as well.
Node* unreachable = __ UnreachableWithoutConnectToEnd();
NodeProperties::ReplaceValueInput(node, unreachable, 0); //dead value上会插入unreachable
}
return gasm()->AddNode(node);
}

case IrOpcode::kNumberMin: {
// It is safe to use the feedback types for left and right hand side
// here, since we can only narrow those types and thus we can only
// promise a more specific truncation.
// For NumberMin we generally propagate whether the truncation
// identifies zeros to the inputs, and we choose to ignore minus
// zero in those cases.
Type const lhs_type = TypeOf(node->InputAt(0));
Type const rhs_type = TypeOf(node->InputAt(1));
[ ... ]
} else {
VisitBinop<T>(node,
UseInfo::TruncatingFloat64(truncation.identify_zeros()),
MachineRepresentation::kFloat64);
if (lower<T>()) {
// If the left hand side is not NaN, and the right hand side
// is not NaN (or -0 if the difference between the zeros is
// observed), we can do a simple floating point comparison here.
if (lhs_type.Is(Type::OrderedNumber()) &&
rhs_type.Is(truncation.IdentifiesZeroAndMinusZero()
? Type::OrderedNumber()
: Type::PlainNumber())) {
lowering->DoMin(node,
lowering->machine()->Float64LessThanOrEqual(),
MachineRepresentation::kFloat64);
} else {
ChangeOp(node, Float64Op(node));
}
}
}
return;
}

# 对应这里的判断
+ if (node->op()->EffectOutputCount() == 0 &&
+ node->op()->ControlOutputCount() == 0 &&
+ node->opcode() != IrOpcode::kDeadValue &&
+ node->opcode() != IrOpcode::kStateValues &&
+ node->opcode() != IrOpcode::kFrameState &&
+ node->opcode() != IrOpcode::kPhi) {