Changeset 246024 in webkit

Timestamp:

Jun 2, 2019, 3:18:06 PM (7 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] Crash explicitly if StructureIDs are exhausted
​https://bugs.webkit.org/show_bug.cgi?id=198467

Reviewed by Sam Weinig.

When StructureIDTable::m_size reaches to s_maximumNumberOfStructures, newCapacity in resize function is also capped with s_maximumNumberOfStructures.
So m_size == newCapacity. In that case, the following code in resize function, makeFreeListFromRange(m_size, m_capacity - 1); starts executing the
wrong code.

Currently, this is safe. We immediately execute the wrong code in makeFreeListFromRange, and crash with zero division. But we should not rely on
this crash, and instead we should explicitly crash because we exhaust StructureIDs.

This patch inserts RELEASE_ASSERT for m_size < newCapacity status to ensure that resize is always extending the table.

In practice, this crash does not happen in Safari because Safari has memory footprint limit. To exhaust StructureIDs, we need to allocate massive
amount of Structures, and it exceeds the memory footprint limit and the process will be killed.

• runtime/StructureIDTable.cpp:

(JSC::StructureIDTable::resize):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/StructureIDTable.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-06-02  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] Crash explicitly if StructureIDs are exhausted
+        https://bugs.webkit.org/show_bug.cgi?id=198467
+
+        Reviewed by Sam Weinig.
+
+        When StructureIDTable::m_size reaches to s_maximumNumberOfStructures, newCapacity in resize function is also capped with s_maximumNumberOfStructures.
+        So m_size == newCapacity. In that case, the following code in resize function, `makeFreeListFromRange(m_size, m_capacity - 1);` starts executing the
+        wrong code.
+
+        Currently, this is safe. We immediately execute the wrong code in makeFreeListFromRange, and crash with zero division. But we should not rely on
+        this crash, and instead we should explicitly crash because we exhaust StructureIDs.
+
+        This patch inserts RELEASE_ASSERT for `m_size < newCapacity` status to ensure that resize is always extending the table.
+
+        In practice, this crash does not happen in Safari because Safari has memory footprint limit. To exhaust StructureIDs, we need to allocate massive
+        amount of Structures, and it exceeds the memory footprint limit and the process will be killed.
+
+        * runtime/StructureIDTable.cpp:
+        (JSC::StructureIDTable::resize):
+
 2019-06-02  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/runtime/StructureIDTable.cpp

@@ -103 +103 @@
         newCapacity = s_maximumNumberOfStructures;
 
+    // If m_size is already s_maximumNumberOfStructures, newCapacity becomes s_maximumNumberOfStructures in the above code.
+    // In that case, we should crash because of exhaust of StructureIDs.
+    RELEASE_ASSERT_WITH_MESSAGE(m_size < newCapacity, "Crash intentionally because of exhaust of StructureIDs.");
+
     // Create the new table.
     auto newTable = makeUniqueArray<StructureOrOffset>(newCapacity);