Add switch to turn off JIT #4
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Added a compile time switch to turn off the JIT With this switch the following get disabled: - Backend (Revived ENABLE_NATIVE_CODEGEN macro) - Dynamic profile info - Dynamic thunks - Background parser - Copy on access arrays - AsmJs (relies on certain datastructures/values defined in the backend) - SimdJs - Profiling interpreter - Added a mode to runtests to skip unit tests that are not applicable with the above disabled
|
Hi @digitalinfinity, I'm your friendly neighborhood Microsoft Pull Request Bot (You can call me MSBOT). Thanks for your contribution!
TTYL, MSBOT; |
Closed
Merged
leirocks
added a commit
to leirocks/ChakraCore
that referenced
this pull request
Feb 24, 2017
1. Pinned object fakeGlobalFuncForUndefer (as well as profileInfoList in test/debug build) reference to javascriptLibrary -- directly or indirectly, these are rely on ScriptContext::Close() to unpin. 2. javascriptLibrary has a reference to JsrtContext 3. JsrtContext is pinned while setting to current thread, and unpinned when getting out of current thread 4. if user code didn't explicited pin JsrtContext (in following POC), at this stage it should be disposed in next GC, and hence call ScriptContext::Close() 5. the disposal in chakra-core#4 didn't because JsrtContext is reachable through fakeGlobalFuncForUndefer->javascriptLibrary->JsrtContext(chakra-core#2), so the whole graph is leaked 6. when there's external call to JsDisposeRuntime, it will directly dispose JsrtContext, and then ScriptContext::Close, unpin fakeGlobalFuncForUndefer then everything is collectable the POC: ```c++ JsRuntimeHandle runtime; unsigned currentSourceContext = 0; JsCreateRuntime(JsRuntimeAttributeNone, nullptr, &runtime); auto runJob = [&](wstring script, int i) { { JsValueRef result; JsContextRef context; JsCreateContext(runtime, &context); JsSetCurrentContext(context); JsRunScript(script.c_str(), currentSourceContext++, L"", &result); JsSetCurrentContext(JS_INVALID_REFERENCE); context = nullptr; result = nullptr; } if (i % 5 == 0) { JsCollectGarbage(runtime); // JsrtContext in above scope should be collectible at this point, // but the Finalize/Dispose of JsrtContext didn't happen } }; for (int i = 0; i < 100; i++) { runJob(L"(()=>{return \'Hello world!\';})()", i); } printf("JsDisposeRuntime\n"); JsDisposeRuntime(runtime); // all JsrtContext will be collected at this point printf("After JsDisposeRuntime\n"); ``` The fix is, do not pin fakeGlobalFuncForUndefer and profileInfoList. However, there are a lot of code(mostly debugger related code) rely on the leak to do the cleanup. Most of the work is to make sure the cleanup working correctly (without either UAF or leak).
ghost
mentioned this pull request
This was referenced Dec 14, 2021
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add switch to turn off JIT
Added a compile time switch to turn off the JIT
With this switch the following get disabled: