Changeset 161038 in webkit

Timestamp:

Dec 23, 2013, 4:49:45 PM (11 years ago)

Author:

mark.lam@apple.com

Message:

CStack:Fixed JSStack::disableErrorStackReserve() and JSStack::installTrapsAfterFrame().
​https://bugs.webkit.org/show_bug.cgi?id=126191.

Not yet reviewed.

1. JSStack::disableErrorStackReserve() was wrongly comparing m_end with m_useableTop. Fixed the comparison.
2. JSStack::installTrapsAfterFrame() was wrongly overwriting the top slot of the top frame. Fixed to start the trap words at the slot below the top slot in the top frame (as in at lower memory below the allocated stack memory above it).

• interpreter/JSStack.cpp:

(JSC::JSStack::disableErrorStackReserve):

• interpreter/JSStackInlines.h:

(JSC::JSStack::installTrapsAfterFrame):

Location:

branches/jsCStack/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• interpreter/JSStack.cpp (modified) (1 diff)
• interpreter/JSStackInlines.h (modified) (1 diff)

branches/jsCStack/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-12-23  Mark Lam  <mark.lam@apple.com>
+
+        CStack:Fixed JSStack::disableErrorStackReserve() and JSStack::installTrapsAfterFrame().
+        https://bugs.webkit.org/show_bug.cgi?id=126191.
+
+        Not yet reviewed.
+
+        1. JSStack::disableErrorStackReserve() was wrongly comparing m_end with m_useableTop.
+           Fixed the comparison.
+        2. JSStack::installTrapsAfterFrame() was wrongly overwriting the top slot of the top
+           frame. Fixed to start the trap words at the slot below the top slot in the top
+           frame (as in at lower memory below the allocated stack memory above it).
+
+        * interpreter/JSStack.cpp:
+        (JSC::JSStack::disableErrorStackReserve):
+        * interpreter/JSStackInlines.h:
+        (JSC::JSStack::installTrapsAfterFrame):
+
 2013-12-23  Mark Lam  <mark.lam@apple.com>
 

branches/jsCStack/Source/JavaScriptCore/interpreter/JSStack.cpp

@@ -161 +161 @@
     // enabled the reserve was not previously in use. Hence, it is safe to
     // shrink back to that m_useableTop.
-    if (m_end < m_useableTop) {
+    if (m_end + 1 < m_useableTop) {
         ASSERT(m_topCallFrame->topOfFrame() > m_useableTop);
         shrink(m_useableTop);

branches/jsCStack/Source/JavaScriptCore/interpreter/JSStackInlines.h

@@ -296 +296 @@
     // Lay the traps:
     int32_t* p = startOfTrap;
-    while (p > endOfTrap)
-        *p-- = 0xabadcafe; // A bad word to trigger a crash if deref'ed.
+    while (--p >= endOfTrap)
+        *p = 0xabadcafe; // A bad word to trigger a crash if deref'ed.
 }
 #endif // ENABLE(DEBUG_JSSTACK)