Changeset 175967 in webkit

Timestamp:

Nov 11, 2014 12:36:11 PM (9 years ago)

Author:

commit-queue@webkit.org

Message:

Handle cases in StackVisitor::Frame::existingArguments() when lexicalEnvironment and/or unmodifiedArgumentsRegister is not set up yet
​https://bugs.webkit.org/show_bug.cgi?id=138543

Patch by Akos Kiss <​akiss@inf.u-szeged.hu> on 2014-11-11
Reviewed by Geoffrey Garen.

Exception fuzzing may may raise exceptions in places where they would be
otherwise impossible. Therefore, a callFrame may lack activation even if
the codeBlock signals need of activation. Also, even if codeBlock
signals the use of arguments, the unmodifiedArgumentsRegister may not be
initialized yet (neither locally nor in lexicalEnvironment).

If codeBlock()->needsActivation() is false, unmodifiedArgumentsRegister
is already checked for Undefined. This patch applies the same check when
the condition is true (and also checks whether
callFrame()->hasActivation()).

• interpreter/CallFrame.h:

(JSC::ExecState::hasActivation):
Moved to interpreter/CallFrameInlines.h.

• interpreter/CallFrameInlines.h:

(JSC::CallFrame::hasActivation):
Fixed to verify that the JSValue returned by uncheckedActivation() is a
cell.

• interpreter/StackVisitor.cpp:

(JSC::StackVisitor::Frame::existingArguments):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• interpreter/CallFrame.h (modified) (1 diff)
• interpreter/CallFrameInlines.h (modified) (1 diff)
• interpreter/StackVisitor.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-11-11  Akos Kiss  <akiss@inf.u-szeged.hu>
+
+        Handle cases in StackVisitor::Frame::existingArguments() when lexicalEnvironment and/or unmodifiedArgumentsRegister is not set up yet
+        https://bugs.webkit.org/show_bug.cgi?id=138543
+
+        Reviewed by Geoffrey Garen.
+
+        Exception fuzzing may may raise exceptions in places where they would be
+        otherwise impossible. Therefore, a callFrame may lack activation even if
+        the codeBlock signals need of activation. Also, even if codeBlock
+        signals the use of arguments, the unmodifiedArgumentsRegister may not be
+        initialized yet (neither locally nor in lexicalEnvironment).
+
+        If codeBlock()->needsActivation() is false, unmodifiedArgumentsRegister
+        is already checked for Undefined. This patch applies the same check when
+        the condition is true (and also checks whether
+        callFrame()->hasActivation()).
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::hasActivation):
+        Moved to interpreter/CallFrameInlines.h.
+        * interpreter/CallFrameInlines.h:
+        (JSC::CallFrame::hasActivation):
+        Fixed to verify that the JSValue returned by uncheckedActivation() is a
+        cell.
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::Frame::existingArguments):
+
 2014-11-11  Andreas Kling  <akling@apple.com>
 

trunk/Source/JavaScriptCore/interpreter/CallFrame.h

@@ -52 +52 @@
         }
 
-        bool hasActivation() const { return !!uncheckedActivation(); }
+        bool hasActivation() const;
         JSLexicalEnvironment* lexicalEnvironment() const;
         JSValue uncheckedActivation() const;

trunk/Source/JavaScriptCore/interpreter/CallFrameInlines.h

@@ -140 +140 @@
 }
 
+inline bool CallFrame::hasActivation() const
+{
+    JSValue activation = uncheckedActivation();
+    return !!activation && activation.isCell();
+}
+
 inline JSValue CallFrame::uncheckedActivation() const
 {

trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp

@@ -298 +298 @@
         reg = codeBlock()->argumentsRegister();
 
-    if (codeBlock()->needsActivation())
-        return jsCast<Arguments*>(callFrame()->lexicalEnvironment()->registerAt(unmodifiedArgumentsRegister(reg).offset()).get());
-    
-    JSValue result = callFrame()->r(unmodifiedArgumentsRegister(reg).offset()).jsValue();
-    if (!result || !result.isCell()) // Protect against Undefined in case we throw in op_enter.
+    // Care should be taken here since exception fuzzing may raise exceptions in
+    // places where they would be otherwise impossible. Therefore, callFrame may
+    // lack activation even if the codeBlock signals need of activation. Also,
+    // even if codeBlock signals the use of arguments, the
+    // unmodifiedArgumentsRegister may not be initialized yet (neither locally
+    // nor in lexicalEnvironment).
+    JSValue result = jsUndefined();
+    if (codeBlock()->needsActivation() && callFrame()->hasActivation())
+        result = callFrame()->lexicalEnvironment()->registerAt(unmodifiedArgumentsRegister(reg).offset()).get();
+    if (!result || !result.isCell()) // Try local unmodifiedArgumentsRegister if lexicalEnvironment is not present (generally possible) or has not set up registers yet (only possible if fuzzing exceptions).
+        result = callFrame()->r(unmodifiedArgumentsRegister(reg).offset()).jsValue();
+    if (!result || !result.isCell()) // Protect against the case when exception fuzzing throws when unmodifiedArgumentsRegister is not set up yet (e.g., in op_enter).
         return 0;
     return jsCast<Arguments*>(result);