Changeset 242859 in webkit

Timestamp:

Mar 13, 2019, 1:24:45 AM (7 years ago)

Author:

bshafiei@apple.com

Message:

Cherry-pick r242667. rdar://problem/48839311

Stack overflow crash in JSC::JSObject::hasInstance.
​https://bugs.webkit.org/show_bug.cgi?id=195458
<rdar://problem/48710195>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/stack-overflow-in-custom-hasInstance.js: Added.

Source/JavaScriptCore:

• runtime/JSObject.cpp: (JSC::JSObject::hasInstance):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242667 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/stack-overflow-in-custom-hasInstance.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSObject.cpp (modified) (2 diffs)

branches/safari-607-branch/JSTests/ChangeLog

@@ +1 @@
+2019-03-13  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r242667. rdar://problem/48839311
+
+    Stack overflow crash in JSC::JSObject::hasInstance.
+    https://bugs.webkit.org/show_bug.cgi?id=195458
+    <rdar://problem/48710195>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * stress/stack-overflow-in-custom-hasInstance.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    * runtime/JSObject.cpp:
+    (JSC::JSObject::hasInstance):
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-08  Mark Lam  <mark.lam@apple.com>
+
+            Stack overflow crash in JSC::JSObject::hasInstance.
+            https://bugs.webkit.org/show_bug.cgi?id=195458
+            <rdar://problem/48710195>
+
+            Reviewed by Yusuke Suzuki.
+
+            * stress/stack-overflow-in-custom-hasInstance.js: Added.
+
 2019-03-13  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-03-13  Babak Shafiei  <bshafiei@apple.com>
+
+        Cherry-pick r242667. rdar://problem/48839311
+
+    Stack overflow crash in JSC::JSObject::hasInstance.
+    https://bugs.webkit.org/show_bug.cgi?id=195458
+    <rdar://problem/48710195>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * stress/stack-overflow-in-custom-hasInstance.js: Added.
+    
+    Source/JavaScriptCore:
+    
+    * runtime/JSObject.cpp:
+    (JSC::JSObject::hasInstance):
+    
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-03-08  Mark Lam  <mark.lam@apple.com>
+
+            Stack overflow crash in JSC::JSObject::hasInstance.
+            https://bugs.webkit.org/show_bug.cgi?id=195458
+            <rdar://problem/48710195>
+
+            Reviewed by Yusuke Suzuki.
+
+            * runtime/JSObject.cpp:
+            (JSC::JSObject::hasInstance):
+
 2019-03-13  Babak Shafiei  <bshafiei@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -47 +47 @@
 #include "SlotVisitorInlines.h"
 #include "TypeError.h"
+#include "VMInlines.h"
 #include <math.h>
 #include <wtf/Assertions.h>
@@ -2207 +2208 @@
         RELEASE_AND_RETURN(scope, defaultHasInstance(exec, value, prototype));
     }
-    if (info.implementsHasInstance())
+    if (info.implementsHasInstance()) {
+        if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+            throwStackOverflowError(exec, scope);
+            return false;
+        }
         RELEASE_AND_RETURN(scope, methodTable(vm)->customHasInstance(this, exec, value));
+    }
 
     throwException(exec, scope, createInvalidInstanceofParameterErrorNotFunction(exec, this));