authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2022-07-27 16:11:07-07:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2022-07-27 16:11:07-07:00
logdfc7493dcb049788b92137ca09b8bd47cee23865
treedfd6c4da8bc1ff71e0ecc8a1d3a1ac29c433bc64
parent90f23e131eadae427c4253fb658002633263b82e
parent793db63746ca044927743ee94405dad2a3f02fb8
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

Merge pull request #12256 from Vexu/stage2

stage2 typeInfo UAF fix + more

5 files changed, 49 insertions(+), 10 deletions(-)

src/AstGen.zig+5-1
......@@ -751,6 +751,7 @@ fn expr(gz: *GenZir, scope: *Scope, rl: ResultLoc, node: Ast.Node.Index) InnerEr
751751 },
752752
753753 .unreachable_literal => {
754 try emitDbgNode(gz, node);
754755 _ = try gz.addAsIndex(.{
755756 .tag = .@"unreachable",
756757 .data = .{ .@"unreachable" = .{
......@@ -7443,7 +7444,6 @@ fn builtinCall(
74437444 .bool_to_int => return simpleUnOp(gz, scope, rl, node, bool_rl, params[0], .bool_to_int),
74447445 .embed_file => return simpleUnOp(gz, scope, rl, node, .{ .ty = .const_slice_u8_type }, params[0], .embed_file),
74457446 .error_name => return simpleUnOp(gz, scope, rl, node, .{ .ty = .anyerror_type }, params[0], .error_name),
7446 .panic => return simpleUnOp(gz, scope, rl, node, .{ .ty = .const_slice_u8_type }, params[0], if (gz.force_comptime) .panic_comptime else .panic),
74477447 .set_cold => return simpleUnOp(gz, scope, rl, node, bool_rl, params[0], .set_cold),
74487448 .set_runtime_safety => return simpleUnOp(gz, scope, rl, node, bool_rl, params[0], .set_runtime_safety),
74497449 .sqrt => return simpleUnOp(gz, scope, rl, node, .none, params[0], .sqrt),
......@@ -7476,6 +7476,10 @@ fn builtinCall(
74767476 .truncate => return typeCast(gz, scope, rl, node, params[0], params[1], .truncate),
74777477 // zig fmt: on
74787478
7479 .panic => {
7480 try emitDbgNode(gz, node);
7481 return simpleUnOp(gz, scope, rl, node, .{ .ty = .const_slice_u8_type }, params[0], if (gz.force_comptime) .panic_comptime else .panic);
7482 },
74797483 .error_to_int => {
74807484 const operand = try expr(gz, scope, .none, params[0]);
74817485 const result = try gz.addExtendedPayload(.error_to_int, Zir.Inst.UnNode{
src/Module.zig+10
......@@ -1220,6 +1220,7 @@ pub const Union = struct {
12201220 };
12211221 const node = owner_decl.relativeToNodeIndex(u.node_offset);
12221222 const node_tags = tree.nodes.items(.tag);
1223 var buf: [2]Ast.Node.Index = undefined;
12231224 switch (node_tags[node]) {
12241225 .container_decl,
12251226 .container_decl_trailing,
......@@ -1231,6 +1232,15 @@ pub const Union = struct {
12311232 .container_decl_arg,
12321233 .container_decl_arg_trailing,
12331234 => return queryFieldSrc(tree.*, query, file, tree.containerDeclArg(node)),
1235 .tagged_union,
1236 .tagged_union_trailing,
1237 => return queryFieldSrc(tree.*, query, file, tree.taggedUnion(node)),
1238 .tagged_union_two,
1239 .tagged_union_two_trailing,
1240 => return queryFieldSrc(tree.*, query, file, tree.taggedUnionTwo(&buf, node)),
1241 .tagged_union_enum_tag,
1242 .tagged_union_enum_tag_trailing,
1243 => return queryFieldSrc(tree.*, query, file, tree.taggedUnionEnumTag(node)),
12341244 else => unreachable,
12351245 }
12361246 }
src/Sema.zig+16-6
......@@ -5695,6 +5695,7 @@ fn analyzeCall(
56955695 sema.inst_map.clearRetainingCapacity();
56965696 const decl = sema.mod.declPtr(block.src_decl);
56975697 child_block.src_decl = block.src_decl;
5698 arg_i = 0;
56985699 try sema.analyzeInlineCallArg(
56995700 block,
57005701 &child_block,
......@@ -12864,7 +12865,7 @@ fn zirTypeInfo(sema: *Sema, block: *Block, inst: Zir.Inst.Index) CompileError!Ai
1286412865 else
1286512866 try Value.Tag.opt_payload.create(
1286612867 params_anon_decl.arena(),
12867 try Value.Tag.ty.create(params_anon_decl.arena(), param_ty),
12868 try Value.Tag.ty.create(params_anon_decl.arena(), try param_ty.copy(params_anon_decl.arena())),
1286812869 );
1286912870
1287012871 const param_fields = try params_anon_decl.arena().create([3]Value);
......@@ -15441,8 +15442,17 @@ fn zirReify(sema: *Sema, block: *Block, inst: Zir.Inst.Index) CompileError!Air.I
1544115442 const is_allowzero_val = struct_val[6];
1544215443 const sentinel_val = struct_val[7];
1544315444
15445 const abi_align = @intCast(u29, alignment_val.toUnsignedInt(target)); // TODO: Validate this value.
15446
1544415447 var buffer: Value.ToTypeBuffer = undefined;
15445 const child_ty = child_val.toType(&buffer);
15448 const unresolved_elem_ty = child_val.toType(&buffer);
15449 const elem_ty = if (abi_align == 0)
15450 unresolved_elem_ty
15451 else t: {
15452 const elem_ty = try sema.resolveTypeFields(block, src, unresolved_elem_ty);
15453 try sema.resolveTypeLayout(block, src, elem_ty);
15454 break :t elem_ty;
15455 };
1544615456
1544715457 const ptr_size = size_val.toEnum(std.builtin.Type.Pointer.Size);
1544815458
......@@ -15454,7 +15464,7 @@ fn zirReify(sema: *Sema, block: *Block, inst: Zir.Inst.Index) CompileError!Air.I
1545415464 const sentinel_ptr_val = sentinel_val.castTag(.opt_payload).?.data;
1545515465 const ptr_ty = try Type.ptr(sema.arena, mod, .{
1545615466 .@"addrspace" = .generic,
15457 .pointee_type = child_ty,
15467 .pointee_type = try elem_ty.copy(sema.arena),
1545815468 });
1545915469 actual_sentinel = (try sema.pointerDeref(block, src, sentinel_ptr_val, ptr_ty)).?;
1546015470 }
......@@ -15463,9 +15473,9 @@ fn zirReify(sema: *Sema, block: *Block, inst: Zir.Inst.Index) CompileError!Air.I
1546315473 .size = ptr_size,
1546415474 .mutable = !is_const_val.toBool(),
1546515475 .@"volatile" = is_volatile_val.toBool(),
15466 .@"align" = @intCast(u29, alignment_val.toUnsignedInt(target)), // TODO: Validate this value.
15476 .@"align" = abi_align,
1546715477 .@"addrspace" = address_space_val.toEnum(std.builtin.AddressSpace),
15468 .pointee_type = try child_ty.copy(sema.arena),
15478 .pointee_type = try elem_ty.copy(sema.arena),
1546915479 .@"allowzero" = is_allowzero_val.toBool(),
1547015480 .sentinel = actual_sentinel,
1547115481 });
......@@ -26626,7 +26636,7 @@ fn getBuiltinType(
2662626636) CompileError!Type {
2662726637 const ty_inst = try sema.getBuiltin(block, src, name);
2662826638 const result_ty = try sema.analyzeAsType(block, src, ty_inst);
26629 try sema.queueFullTypeResolution(result_ty);
26639 try sema.resolveTypeFully(block, src, result_ty); // Should not fail
2663026640 return result_ty;
2663126641}
2663226642
test/cases/fn_typeinfo_passed_to_comptime_fn.zig created+17
......@@ -0,0 +1,17 @@
1const std = @import("std");
2
3test {
4 try foo(@typeInfo(@TypeOf(someFn)));
5}
6
7fn someFn(arg: ?*c_int) f64 {
8 _ = arg;
9 return 8;
10}
11fn foo(comptime info: std.builtin.Type) !void {
12 try std.testing.expect(info.Fn.args[0].arg_type.? == ?*c_int);
13}
14
15// run
16// is_test=1
17//
test/standalone.zig+1-3
......@@ -60,9 +60,7 @@ pub fn addCases(cases: *tests.StandaloneContext) void {
6060 }
6161 // Try to build and run a PIE executable.
6262 if (builtin.os.tag == .linux) {
63 if (builtin.zig_backend == .stage1) { // https://github.com/ziglang/zig/issues/12223
64 cases.addBuildFile("test/standalone/pie/build.zig", .{});
65 }
63 cases.addBuildFile("test/standalone/pie/build.zig", .{});
6664 }
6765
6866 // Ensure the development tools are buildable.