Changeset 224784 in webkit


Ignore:
Timestamp:
Nov 13, 2017 2:58:04 PM (6 years ago)
Author:
mark.lam@apple.com
Message:

Add more overflow check book-keeping for MarkedArgumentBuffer.
​https://bugs.webkit.org/show_bug.cgi?id=179634
<rdar://problem/35492517>

Reviewed by Saam Barati.

JSTests:

  • stress/regress-179634.js: Added.

Source/JavaScriptCore:

  • runtime/ArgList.h:

(JSC::MarkedArgumentBuffer::overflowCheckNotNeeded):

  • runtime/JSJob.cpp:

(JSC::JSJobMicrotask::run):

  • runtime/ObjectConstructor.cpp:

(JSC::defineProperties):

  • runtime/ReflectObject.cpp:

(JSC::reflectObjectConstruct):

Source/WebKit:

  • WebProcess/Plugins/Netscape/NPJSObject.cpp:

(WebKit::NPJSObject::construct):
(WebKit::NPJSObject::invoke):

Source/WebKitLegacy/mac:

  • Plugins/Hosted/NetscapePluginInstanceProxy.mm:

(WebKit::NetscapePluginInstanceProxy::invoke):
(WebKit::NetscapePluginInstanceProxy::invokeDefault):
(WebKit::NetscapePluginInstanceProxy::construct):

Location:
trunk
Files:
1 added
10 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r224770 r224784  
     12017-11-13  Mark Lam  <mark.lam@apple.com>
     2
     3        Add more overflow check book-keeping for MarkedArgumentBuffer.
     4        https://bugs.webkit.org/show_bug.cgi?id=179634
     5        <rdar://problem/35492517>
     6
     7        Reviewed by Saam Barati.
     8
     9        * stress/regress-179634.js: Added.
     10
    1112017-11-13  Mark Lam  <mark.lam@apple.com>
    212

  • trunk/Source/JavaScriptCore/ChangeLog

    r224783 r224784  
     12017-11-13  Mark Lam  <mark.lam@apple.com>
     2
     3        Add more overflow check book-keeping for MarkedArgumentBuffer.
     4        https://bugs.webkit.org/show_bug.cgi?id=179634
     5        <rdar://problem/35492517>
     6
     7        Reviewed by Saam Barati.
     8
     9        * runtime/ArgList.h:
     10        (JSC::MarkedArgumentBuffer::overflowCheckNotNeeded):
     11        * runtime/JSJob.cpp:
     12        (JSC::JSJobMicrotask::run):
     13        * runtime/ObjectConstructor.cpp:
     14        (JSC::defineProperties):
     15        * runtime/ReflectObject.cpp:
     16        (JSC::reflectObjectConstruct):
     17
    1182017-11-13  Guillaume Emont  <guijemont@igalia.com>
    219

  • trunk/Source/JavaScriptCore/runtime/ArgList.h

    r224399 r224784  
    126126    }
    127127
     128    void overflowCheckNotNeeded() { clearNeedsOverflowCheck(); }
     129
    128130private:
    129131    void expandCapacity();

  • trunk/Source/JavaScriptCore/runtime/JSJob.cpp

    r224309 r224784  
    7474    for (unsigned index = 0, length = m_arguments->length(); index < length; ++index) {
    7575        JSValue arg = m_arguments->JSArray::get(exec, index);
    76         CLEAR_AND_RETURN_IF_EXCEPTION(scope, void());
     76        CLEAR_AND_RETURN_IF_EXCEPTION(scope, handlerArguments.overflowCheckNotNeeded());
    7777        handlerArguments.append(arg);
    7878    }

  • trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp

    r224487 r224784  
    549549        bool success = toPropertyDescriptor(exec, prop, descriptor);
    550550        EXCEPTION_ASSERT(!scope.exception() || !success);
    551         if (UNLIKELY(!success))
     551        if (UNLIKELY(!success)) {
     552            markBuffer.overflowCheckNotNeeded();
    552553            return jsNull();
     554        }
    553555        descriptors.append(descriptor);
    554556        // Ensure we mark all the values that we're accumulating

  • trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp

    r224309 r224784  
    121121        return false;
    122122    });
    123     RETURN_IF_EXCEPTION(scope, encodedJSValue());
     123    RETURN_IF_EXCEPTION(scope, (arguments.overflowCheckNotNeeded(), encodedJSValue()));
    124124    if (UNLIKELY(arguments.hasOverflowed())) {
    125125        throwOutOfMemoryError(exec, scope);

  • trunk/Source/WebKit/ChangeLog

    r224782 r224784  
     12017-11-13  Mark Lam  <mark.lam@apple.com>
     2
     3        Add more overflow check book-keeping for MarkedArgumentBuffer.
     4        https://bugs.webkit.org/show_bug.cgi?id=179634
     5        <rdar://problem/35492517>
     6
     7        Reviewed by Saam Barati.
     8
     9        * WebProcess/Plugins/Netscape/NPJSObject.cpp:
     10        (WebKit::NPJSObject::construct):
     11        (WebKit::NPJSObject::invoke):
     12
    1132017-11-13  Timothy Horton  <timothy_horton@apple.com>
    214

  • trunk/Source/WebKit/WebProcess/Plugins/Netscape/NPJSObject.cpp

    r222017 r224784  
    287287    for (uint32_t i = 0; i < argumentCount; ++i)
    288288        argumentList.append(m_objectMap->convertNPVariantToJSValue(exec, m_objectMap->globalObject(), arguments[i]));
     289    RELEASE_ASSERT(!argumentList.hasOverflowed());
    289290
    290291    JSValue value = JSC::construct(exec, m_jsObject.get(), constructType, constructData, argumentList);
    … …  
    311312    for (uint32_t i = 0; i < argumentCount; ++i)
    312313        argumentList.append(m_objectMap->convertNPVariantToJSValue(exec, globalObject, arguments[i]));
     314    RELEASE_ASSERT(!argumentList.hasOverflowed());
    313315
    314316    JSValue value = JSC::call(exec, function, callType, callData, m_jsObject.get(), argumentList);

  • trunk/Source/WebKitLegacy/mac/ChangeLog

    r224740 r224784  
     12017-11-13  Mark Lam  <mark.lam@apple.com>
     2
     3        Add more overflow check book-keeping for MarkedArgumentBuffer.
     4        https://bugs.webkit.org/show_bug.cgi?id=179634
     5        <rdar://problem/35492517>
     6
     7        Reviewed by Saam Barati.
     8
     9        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
     10        (WebKit::NetscapePluginInstanceProxy::invoke):
     11        (WebKit::NetscapePluginInstanceProxy::invokeDefault):
     12        (WebKit::NetscapePluginInstanceProxy::construct):
     13
    1142017-11-12  Darin Adler  <darin@apple.com>
    215

  • trunk/Source/WebKitLegacy/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm

    r223149 r224784  
    929929    MarkedArgumentBuffer argList;
    930930    demarshalValues(exec, argumentsData, argumentsLength, argList);
     931    RELEASE_ASSERT(!argList.hasOverflowed());
    931932
    932933    JSValue value = call(exec, function, callType, callData, object, argList);
    … …  
    964965    MarkedArgumentBuffer argList;
    965966    demarshalValues(exec, argumentsData, argumentsLength, argList);
     967    RELEASE_ASSERT(!argList.hasOverflowed());
    966968
    967969    JSValue value = call(exec, object, callType, callData, object, argList);
    … …  
    10001002    MarkedArgumentBuffer argList;
    10011003    demarshalValues(exec, argumentsData, argumentsLength, argList);
     1004    RELEASE_ASSERT(!argList.hasOverflowed());
    10021005
    10031006    JSValue value = JSC::construct(exec, object, constructType, constructData, argList);
Note: See TracChangeset for help on using the changeset viewer.