Changeset 257907 in webkit


Ignore:
Timestamp:
Mar 4, 2020, 11:57:21 PM (5 years ago)
Author:
mark.lam@apple.com
Message:

Handle an out of memory error while constructing the BytecodeGenerator.
​https://bugs.webkit.org/show_bug.cgi?id=208622
<rdar://problem/59341136>

Reviewed by Saam Barati.

JSTests:

  • stress/out-of-memory-while-constructing-BytecodeGenerator.js: Added.

Source/JavaScriptCore:

Added the ability to handle out of memory errors encountered during the
construction of the BytecodeGenerator. Currently, we only use this for the
case where we fail to instantiate a ScopedArgumentsTable.

  • bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::generate):
(JSC::BytecodeGenerator::BytecodeGenerator):

  • bytecompiler/BytecodeGeneratorBase.h:
  • runtime/ScopedArgumentsTable.cpp:

(JSC::ScopedArgumentsTable::tryCreate):

  • runtime/ScopedArgumentsTable.h:
  • runtime/SymbolTable.h:

Source/WTF:

  • wtf/CagedUniquePtr.h:

(WTF::CagedUniquePtr::tryCreate):

Location:
trunk
Files:
1 added
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/JSTests/ChangeLog

    r257784 r257907  
     12020-03-04  Mark Lam  <mark.lam@apple.com>
     2
     3        Handle an out of memory error while constructing the BytecodeGenerator.
     4        https://bugs.webkit.org/show_bug.cgi?id=208622
     5        <rdar://problem/59341136>
     6
     7        Reviewed by Saam Barati.
     8
     9        * stress/out-of-memory-while-constructing-BytecodeGenerator.js: Added.
     10
    1112020-03-03  Yusuke Suzuki  <ysuzuki@apple.com>
    212

  • trunk/Source/JavaScriptCore/ChangeLog

    r257856 r257907  
     12020-03-04  Mark Lam  <mark.lam@apple.com>
     2
     3        Handle an out of memory error while constructing the BytecodeGenerator.
     4        https://bugs.webkit.org/show_bug.cgi?id=208622
     5        <rdar://problem/59341136>
     6
     7        Reviewed by Saam Barati.
     8
     9        Added the ability to handle out of memory errors encountered during the
     10        construction of the BytecodeGenerator.  Currently, we only use this for the
     11        case where we fail to instantiate a ScopedArgumentsTable.
     12
     13        * bytecompiler/BytecodeGenerator.cpp:
     14        (JSC::BytecodeGenerator::generate):
     15        (JSC::BytecodeGenerator::BytecodeGenerator):
     16        * bytecompiler/BytecodeGeneratorBase.h:
     17        * runtime/ScopedArgumentsTable.cpp:
     18        (JSC::ScopedArgumentsTable::tryCreate):
     19        * runtime/ScopedArgumentsTable.h:
     20        * runtime/SymbolTable.h:
     21
    1222020-03-04  Paulo Matos  <pmatos@igalia.com>
    223

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r256846 r257907  
    11/*
    2  * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2020 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
    44 * Copyright (C) 2012 Igalia, S.L.
    … …  
    158158ParserError BytecodeGenerator::generate()
    159159{
     160    if (UNLIKELY(m_outOfMemoryDuringConstruction))
     161        return ParserError(ParserError::OutOfMemory);
     162
    160163    m_codeBlock->setThisRegister(m_thisRegister.virtualRegister());
    161164
    … …  
    491494       
    492495        if (capturesAnyArgumentByName) {
    493             functionSymbolTable->setArgumentsLength(vm, parameters.size());
    494            
     496            bool success = functionSymbolTable->trySetArgumentsLength(vm, parameters.size());
     497            if (UNLIKELY(!success)) {
     498                m_outOfMemoryDuringConstruction = true;
     499                return;
     500            }
     501
    495502            // For each parameter, we have two possibilities:
    496503            // Either it's a binding node with no function overlap, in which case it gets a name

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGeneratorBase.h

    r252306 r257907  
    11/*
    2  * Copyright (C) 2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2019-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    8181    typename Traits::CodeBlock m_codeBlock;
    8282
     83    bool m_outOfMemoryDuringConstruction { false };
    8384    typename Traits::OpcodeID m_lastOpcodeID = Traits::opcodeForDisablingOptimizations;
    8485    InstructionStream::MutableRef m_lastInstruction { m_writer.ref() };

  • trunk/Source/JavaScriptCore/runtime/ScopedArgumentsTable.cpp

    r246368 r257907  
    11/*
    2  * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    6565}
    6666
     67ScopedArgumentsTable* ScopedArgumentsTable::tryCreate(VM& vm, uint32_t length)
     68{
     69    void* buffer = tryAllocateCell<ScopedArgumentsTable>(vm.heap);
     70    if (UNLIKELY(!buffer))
     71        return nullptr;
     72    ScopedArgumentsTable* result = new (NotNull, buffer) ScopedArgumentsTable(vm);
     73    result->finishCreation(vm);
     74
     75    result->m_length = length;
     76    result->m_arguments = ArgumentsPtr::tryCreate(length);
     77    if (UNLIKELY(!result->m_arguments))
     78        return nullptr;
     79    return result;
     80}
     81
    6782ScopedArgumentsTable* ScopedArgumentsTable::clone(VM& vm)
    6883{

  • trunk/Source/JavaScriptCore/runtime/ScopedArgumentsTable.h

    r253538 r257907  
    11/*
    2  * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    6161    static ScopedArgumentsTable* create(VM&);
    6262    static ScopedArgumentsTable* create(VM&, uint32_t length);
    63    
     63    static ScopedArgumentsTable* tryCreate(VM&, uint32_t length);
     64
    6465    static void destroy(JSCell*);
    6566

  • trunk/Source/JavaScriptCore/runtime/SymbolTable.h

    r253987 r257907  
    11/*
    2  * Copyright (C) 2007-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    636636    }
    637637   
    638     void setArgumentsLength(VM& vm, uint32_t length)
    639     {
    640         if (UNLIKELY(!m_arguments))
    641             m_arguments.set(vm, this, ScopedArgumentsTable::create(vm, length));
    642         else
     638    bool trySetArgumentsLength(VM& vm, uint32_t length)
     639    {
     640        if (UNLIKELY(!m_arguments)) {
     641            ScopedArgumentsTable* table = ScopedArgumentsTable::tryCreate(vm, length);
     642            if (UNLIKELY(!table))
     643                return false;
     644            m_arguments.set(vm, this, table);
     645        } else
    643646            m_arguments.set(vm, this, m_arguments->setLength(vm, length));
    644     }
    645    
     647        return true;
     648    }
     649
    646650    ScopeOffset argumentOffset(uint32_t i) const
    647651    {

  • trunk/Source/WTF/ChangeLog

    r257900 r257907  
     12020-03-04  Mark Lam  <mark.lam@apple.com>
     2
     3        Handle an out of memory error while constructing the BytecodeGenerator.
     4        https://bugs.webkit.org/show_bug.cgi?id=208622
     5        <rdar://problem/59341136>
     6
     7        Reviewed by Saam Barati.
     8
     9        * wtf/CagedUniquePtr.h:
     10        (WTF::CagedUniquePtr::tryCreate):
     11
    1122020-03-04  Brady Eidson  <beidson@apple.com>
    213

  • trunk/Source/WTF/wtf/CagedUniquePtr.h

    r246368 r257907  
    11/*
    2  * Copyright (C) 2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2017-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    5555        return CagedUniquePtr(result, length);
    5656    }
    57    
     57
     58    template<typename... Arguments>
     59    static CagedUniquePtr tryCreate(unsigned length, Arguments&&... arguments)
     60    {
     61        T* result = static_cast<T*>(Gigacage::tryMalloc(kind, sizeof(T) * length));
     62        if (!result)
     63            return { };
     64        while (length--)
     65            new (result + length) T(arguments...);
     66        return CagedUniquePtr(result, length);
     67    }
     68
    5869    CagedUniquePtr& operator=(CagedUniquePtr&& ptr)
    5970    {
Note: See TracChangeset for help on using the changeset viewer.