Changeset 33293

Timestamp:

05/12/08 23:01:54 (6 months ago)

Author:

mrowe@apple.com

Message:

Bug 18736: SQUIRRELFISH: switch statements with no default have incorrect codegen
<https://bugs.webkit.org/show_bug.cgi?id=18736>

Reviewed by Geoff

Put a limit on the level of reentry recursion. 128 levels of re-entrant recursion
seems reasonable as it is greater than the old eval limit, and a long way short of
the reentry depth needed to overflow the stack.

Location:

branches/squirrelfish/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• VM/Machine.cpp (modified) (7 diffs)
• VM/Machine.h (modified) (2 diffs)

branches/squirrelfish/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 18736: SQUIRRELFISH: switch statements with no default have incorrect codegen
+        <https://bugs.webkit.org/show_bug.cgi?id=18736>
+
+        Put a limit on the level of reentry recursion.  128 levels of re-entrant recursion
+        seems reasonable as it is greater than the old eval limit, and a long way short of
+        the reentry depth needed to overflow the stack.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        * VM/Machine.h:
+
 2008-04-25  Geoffrey Garen  <ggaren@apple.com>
 

branches/squirrelfish/JavaScriptCore/VM/Machine.cpp

@@ -240 +240 @@
 
 Machine::Machine()
+    : m_reentryDepth(0)
 {
     privateExecute(InitializeAndReturn);
@@ -549 +550 @@
 JSValue* Machine::execute(ProgramNode* programNode, ExecState* exec, JSObject* thisObj, RegisterFileStack* registerFileStack, ScopeChainNode* scopeChain, JSValue** exception)
 {
+    if (m_reentryDepth >= MaxReentryDepth) {
+        *exception = createStackOverflowError(exec);
+        return 0;
+    }
+
     RegisterFile* registerFile = registerFileStack->pushRegisterFile();
     CodeBlock* codeBlock = &programNode->code(scopeChain);
@@ -561 +567 @@
     if (codeBlock->needsFullScopeChain)
         scopeChain = scopeChain->copy();
-
+    m_reentryDepth++;
     JSValue* result = privateExecute(Normal, exec, registerFile, r, scopeChain, codeBlock, exception);
-
+    m_reentryDepth--;
     registerFileStack->popRegisterFile();
     return result;
@@ -570 +576 @@
 JSValue* Machine::execute(FunctionBodyNode* functionBodyNode, ExecState* exec, FunctionImp* function, JSObject* thisObj, const List& args, RegisterFileStack* registerFileStack, ScopeChainNode* scopeChain, JSValue** exception)
 {
+    if (m_reentryDepth >= MaxReentryDepth) {
+        *exception = createStackOverflowError(exec);
+        return 0;
+    }
+
     RegisterFile* registerFile = registerFileStack->current();
 
@@ -606 +617 @@
     callFrame = (*registerBase) + callFrameOffset; // registerBase may have moved, recompute callFrame
     scopeChain = scopeChainForCall(newCodeBlock, scopeChain, function, callFrame, registerBase, r);            
-
+    m_reentryDepth++;
     JSValue* result = privateExecute(Normal, exec, registerFile, r, scopeChain, newCodeBlock, exception);
+    m_reentryDepth--;
     registerFile->shrink(oldSize);
     return result;
@@ -615 +627 @@
 JSValue* Machine::execute(EvalNode* evalNode, ExecState* exec, JSObject* thisObj, RegisterFile* registerFile, int registerOffset, ScopeChainNode* scopeChain, JSValue** exception, JSObject* variableObject)
 {
+    if (m_reentryDepth >= MaxReentryDepth) {
+        *exception = createStackOverflowError(exec);
+        return 0;
+    }
     EvalCodeBlock* codeBlock = &evalNode->code(scopeChain);
     
@@ -648 +664 @@
     if (codeBlock->needsFullScopeChain)
         scopeChain = scopeChain->copy();
-
+    m_reentryDepth++;
     JSValue* result = privateExecute(Normal, exec, registerFile, r, scopeChain, codeBlock, exception);
-    
+    m_reentryDepth--;
     registerFile->shrink(oldSize);
     

branches/squirrelfish/JavaScriptCore/VM/Machine.h

@@ -89 +89 @@
         
     private:
+        enum { MaxReentryDepth = 128 };
         typedef enum { Normal, InitializeAndReturn } ExecutionFlag;
 
@@ -101 +102 @@
         bool isGlobalCallFrame(Register** registerBase, const Register* r) { return (*registerBase) == r; }
 
+        int m_reentryDepth;
 #if HAVE(COMPUTED_GOTO)        
         Opcode m_opcodeTable[numOpcodeIDs]; // Maps OpcodeID => Opcode for compiling