Dmitry Volyntsev [Fri, 21 Jan 2022 14:31:30 +0000 (14:31 +0000)]
Fixed recursive async function calls.
Previously, PromiseCapability record was stored (function->context)
directly in function object during a function invocation. This is
not correct, because PromiseCapability record should be linked to
current execution context. As a result, function->context is
overwritten with consecutive recursive calls which results in
use-after-free.
Dmitry Volyntsev [Wed, 19 Jan 2022 14:03:49 +0000 (14:03 +0000)]
Fixed Function.prototype.apply() with slow arrays.
Previously, the function had two issues:
* array->start was referenced without checking for fast array flag
* the created arguments list was not sanity-checked for its length,
which can be very large.
The fix is to remove micro-optimization for arrays and introduce limit
size for arguments list.
Dmitry Volyntsev [Wed, 19 Jan 2022 13:12:09 +0000 (13:12 +0000)]
Fixed type confusion bug while resolving promises.
Previously, the internal function njs_promise_perform_then() which
implements PerformPromiseThen() expects its first argument to always be
a promise instance. This assertion might be invalid because the
functions corresponding to Promise.prototype.then() and
Promise.resolve() incorrectly verified their arguments.
Specifically, the functions recognized their first argument as promise
if it was an object which was an Promise or had Promise object in its
prototype chain. The later condition is not correct because internal
slots are not inherited according to the spec.
Dmitry Volyntsev [Fri, 14 Jan 2022 14:40:27 +0000 (14:40 +0000)]
Fixed Array.prototype.reverse() when array is changed while iterating.
Previously, the flat array may be converted to a slow one as a
side-effect of a custom getter invocation for a proto array object.
The function erroneously assumed that the this array remains flat
while iterating.
The fix is to eliminate the micro-optimization which uses direct
pointers.
Dmitry Volyntsev [Thu, 13 Jan 2022 16:20:58 +0000 (16:20 +0000)]
Fixed Array.prototype.concat() when array is changed while iterating.
Previously, the flat array may be converted to a slow one as a
side-effect of a custom getter invocation for a proto array object.
The function erroneously assumed that the this array remains flat
while iterating.
The fix is to eliminate the micro-optimization which uses direct
pointers.
Dmitry Volyntsev [Thu, 13 Jan 2022 15:59:08 +0000 (15:59 +0000)]
Fixed Array.prototype.slice() when array is changed while iterating.
Previously, the flat array may be converted to a slow one as a
side-effect of a custom getter invocation for a proto array object.
The function erroneously assumed that the this array remains flat
while iterating.
The fix is to eliminate the micro-optimization which uses direct
pointers.
The problem is similar to the previous (9578cc729205) commit.
Dmitry Volyntsev [Wed, 12 Jan 2022 17:59:42 +0000 (17:59 +0000)]
Fixed Array.prototype.join() when array is changed while iterating.
Previously, the function used optimization for ordinary arrays with no
gaps (so called fast arrays). For a fast array code took elements
directly from internal flat C array. The direct pointer may become
invalid as side-effect of custom toString() method for an element.
Specifically, the pointer was passed directly to
njs_value_to_primitive() which attempts to call toString() followed by
valueOf(). When the array size is changed as a side-effect of
toString() and not a string value is returned by toString() the pointer
becomes invalid and is passed to valueOf() which causes use-after-free.
The fix is to eliminate the micro-optimization which uses direct pointers.
Dmitry Volyntsev [Tue, 11 Jan 2022 13:02:33 +0000 (13:02 +0000)]
Fixed fuzzing target bug introduced in 4d4657128baf (0.7.1).
Previously, njs_process_script() took vm pointer from console object,
but after 4d4657128baf the object is not initialized in
LLVMFuzzerTestOneInput().
Dmitry Volyntsev [Fri, 24 Dec 2021 15:48:11 +0000 (15:48 +0000)]
Building regexp backend as an external.
This allows not to build PCRE specific code as a part of libnjs.a thus
supporting nginx builds with flags like --with-pcre=PCRE_DIR. When
--no-pcre configure option is provided external code have to implement
methods declared in njs_regex.h.
Dmitry Volyntsev [Wed, 17 Nov 2021 17:01:07 +0000 (17:01 +0000)]
SSL: fixed reporting of the detected library version.
Previously, `openssl version` command was used to report the OpenSSL
version. Whereas, when provided with custom CFLAGS and LDFLAGS the
used library may differ from the system one.
The fix is to report OpenSSL version using the provided library.
Dmitry Volyntsev [Thu, 11 Nov 2021 14:26:41 +0000 (14:26 +0000)]
RegExp: improved source string treatment.
Previously, njs_regexp_pattern_create() in addition to a pattern
compilation made a string representation for a RegExp which was returned
by RegExp.prototype.toString() as is.
After 02444445df29 (0.6.0), RegExp.prototype.toString() was implemented
according to the spec, and since then it creates a RegExp string on the fly.
This patch removes the extra code which was left.
In addition, as a source string may not be a valid UTF-8 string (in
RegExp literals), RegExp.prototype.toString() now ensures that a
valid UTF-8 string is returned.