Changeset 185770 in webkit

Timestamp:

Jun 19, 2015, 3:03:06 PM (11 years ago)

Author:

ggaren@apple.com

Message:

WebKit crash while loading nytimes at JavaScriptCore: JSC::ExecutableAllocator::allocate + 276
​https://bugs.webkit.org/show_bug.cgi?id=146163
<rdar://problem/20392986>

Reviewed by Michael Saboff.

There's no good way to test this in our test harness because we don't
have a way to simulate executable memory pressure, and doing so would
cause the cases that still use JITCompilationMustSucceed to crash.

Instead, I tested by manually forcing all regexp JIT compilation to
fail and running the JavaScriptCore tests.

• yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::compile): Allow compilation to fail. We can
fall back to the regexp interpreter if we need to.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• yarr/YarrJIT.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-06-19  Geoffrey Garen  <ggaren@apple.com>
+
+        WebKit crash while loading nytimes at JavaScriptCore: JSC::ExecutableAllocator::allocate + 276
+        https://bugs.webkit.org/show_bug.cgi?id=146163
+        <rdar://problem/20392986>
+
+        Reviewed by Michael Saboff.
+
+        There's no good way to test this in our test harness because we don't
+        have a way to simulate executable memory pressure, and doing so would
+        cause the cases that still use JITCompilationMustSucceed to crash.
+
+        Instead, I tested by manually forcing all regexp JIT compilation to
+        fail and running the JavaScriptCore tests.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::compile): Allow compilation to fail. We can
+        fall back to the regexp interpreter if we need to.
+
 2015-06-19  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

@@ -2644 +2644 @@
         initCallFrame();
 
-        // Compile the pattern to the internal 'YarrOp' representation.
         opCompileBody(m_pattern.m_body);
 
-        // If we encountered anything we can't handle in the JIT code
-        // (e.g. backreferences) then return early.
         if (m_shouldFallBack) {
             jitObject.setFallBack(true);
@@ -2657 +2654 @@
         backtrack();
 
-        // Link & finalize the code.
-        LinkBuffer linkBuffer(*vm, *this, REGEXP_CODE_ID);
+        LinkBuffer linkBuffer(*vm, *this, REGEXP_CODE_ID, JITCompilationCanFail);
+        if (linkBuffer.didFailToAllocate()) {
+            jitObject.setFallBack(true);
+            return;
+        }
+
         m_backtrackingState.linkDataLabels(linkBuffer);