Procházet zdrojové kódy

Fixes issue 5532: null pointer dereference in EmitBooleanExpression
Github issue: https://github.com/Microsoft/ChakraCore/issues/5532
Given a nested for loop that qualifies for loop inversion, the lack of a conditional in the outer loop causes a read access violation when the conditional’s ParseNode’s nop is read. The conditional is analyzed to perform a zero trip test which can skip the execution of the loop entirely. In the case where the outer loop lacks a conditional, the zero trip test will not pass. Therefore when the outer loop lacks a conditional skipping the inclusion of a zero trip test is valid and avoids the read access violation.

Wyatt Richter před 7 roky
rodič
revize
e80a56d381
1 změnil soubory, kde provedl 10 přidání a 6 odebrání
  1. 10 6
      lib/Runtime/ByteCode/ByteCodeEmitter.cpp

+ 10 - 6
lib/Runtime/ByteCode/ByteCodeEmitter.cpp

@@ -9259,12 +9259,16 @@ void ByteCodeGenerator::EmitInvertedLoop(ParseNodeLoop* outerLoop, ParseNodeFor*
     this->m_writer.Br(afterInvertedLoop);
     this->m_writer.MarkLabel(invertedLoopLabel);
 
-    // Emit a zero trip test for the original outer-loop
-    Js::ByteCodeLabel zeroTrip = this->m_writer.DefineLabel();
-    ParseNode* testNode = this->GetParser()->CopyPnode(outerLoop->AsParseNodeFor()->pnodeCond);
-    EmitBooleanExpression(testNode, zeroTrip, afterInvertedLoop, this, funcInfo, true, false);
-    this->m_writer.MarkLabel(zeroTrip);
-    funcInfo->ReleaseLoc(testNode);
+    // Emit a zero trip test for the original outer-loop if the outer-loop
+	// has a condition
+	if (outerLoop->AsParseNodeFor()->pnodeCond)
+	{
+		Js::ByteCodeLabel zeroTrip = this->m_writer.DefineLabel();
+		ParseNode* testNode = this->GetParser()->CopyPnode(outerLoop->AsParseNodeFor()->pnodeCond);
+		EmitBooleanExpression(testNode, zeroTrip, afterInvertedLoop, this, funcInfo, true, false);
+		this->m_writer.MarkLabel(zeroTrip);
+		funcInfo->ReleaseLoc(testNode);
+	}
 
     // emit inverted
     Emit(invertedLoop->pnodeInit, this, funcInfo, false);