Changeset 202847 in webkit

Timestamp:

Jul 5, 2016 10:25:06 PM (8 years ago)

Author:

sbarati@apple.com

Message:

StackVisitor::unwindToMachineCodeBlockFrame() may unwind past a VM entry frame when catching an exception and the frame has inlined tail calls
​https://bugs.webkit.org/show_bug.cgi?id=159448
<rdar://problem/27084459>

Reviewed by Mark Lam.

Consider the following stack trace:
(machine) foo -> VM entry frame -> (machine) bar -> (inlined tailcall) baz

If an exception is thrown at 'baz', we will do exception unwinding,
which will eventually call unwindToMachineCodeBlockFrame() which will call
gotoNextFrame() on the 'baz' frame. The next logical frame for 'baz' is 'foo' because
'bar' tail called 'baz' even though there is a machine frame for 'bar' on the stack.
This is a bug. unwindToMachineCodeBlockFrame() should not care about the next
logical frame, it just wants to move StackVisitor's state to the current machine
frame. The bug here is that we would end up unwinding past the VM entry frame
which can have all kinds of terrible consequences.

This bug fixes unwindToMachineCodeBlockFrame() by having it not rely
on gotoNextFrame() and instead using its own mechanism for setting
the StackVisotor's state to the current machine frame.

• interpreter/StackVisitor.cpp:

(JSC::StackVisitor::unwindToMachineCodeBlockFrame):

• tests/stress/dont-unwind-past-vm-entry-frame.js: Added.

(let.p.new.Proxy):
(let.p.new.Proxy.apply):
(bar):
(let.good):
(getItem):
(start):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• interpreter/StackVisitor.cpp (modified) (1 diff)
• jit/JITExceptions.cpp (modified) (1 diff)
• tests/stress/dont-unwind-past-vm-entry-frame.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-07-05  Saam Barati  <sbarati@apple.com>
+
+        StackVisitor::unwindToMachineCodeBlockFrame() may unwind past a VM entry frame when catching an exception and the frame has inlined tail calls
+        https://bugs.webkit.org/show_bug.cgi?id=159448
+        <rdar://problem/27084459>
+
+        Reviewed by Mark Lam.
+
+        Consider the following stack trace:
+        (machine) foo -> VM entry frame -> (machine) bar -> (inlined tailcall) baz
+
+        If an exception is thrown at 'baz', we will do exception unwinding,
+        which will eventually call unwindToMachineCodeBlockFrame() which will call
+        gotoNextFrame() on the 'baz' frame. The next logical frame for 'baz' is 'foo' because
+        'bar' tail called 'baz' even though there is a machine frame for 'bar' on the stack.
+        This is a bug. unwindToMachineCodeBlockFrame() should not care about the next
+        logical frame, it just wants to move StackVisitor's state to the current machine
+        frame. The bug here is that we would end up unwinding past the VM entry frame
+        which can have all kinds of terrible consequences.
+
+        This bug fixes unwindToMachineCodeBlockFrame() by having it not rely
+        on gotoNextFrame() and instead using its own mechanism for setting
+        the StackVisotor's state to the current machine frame.
+
+        * interpreter/StackVisitor.cpp:
+        (JSC::StackVisitor::unwindToMachineCodeBlockFrame):
+        * tests/stress/dont-unwind-past-vm-entry-frame.js: Added.
+        (let.p.new.Proxy):
+        (let.p.new.Proxy.apply):
+        (bar):
+        (let.good):
+        (getItem):
+        (start):
+
 2016-07-05  Joseph Pecoraro  <pecoraro@apple.com>
 

trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp

@@ -82 +82 @@
 {
 #if ENABLE(DFG_JIT)
-    while (m_frame.isInlinedFrame())
-        gotoNextFrame();
+    if (m_frame.isInlinedFrame()) {
+        CodeOrigin codeOrigin = m_frame.inlineCallFrame()->directCaller;
+        while (codeOrigin.inlineCallFrame)
+            codeOrigin = codeOrigin.inlineCallFrame->directCaller;
+        readNonInlinedFrame(m_frame.callFrame(), &codeOrigin);
+    }
 #endif
 }

trunk/Source/JavaScriptCore/jit/JITExceptions.cpp

@@ -82 +82 @@
         catchRoutine = LLInt::getCodePtr(handleUncaughtException);
     
+    ASSERT(bitwise_cast<uintptr_t>(callFrame) < bitwise_cast<uintptr_t>(vm->topVMEntryFrame));
+
     vm->callFrameForCatch = callFrame;
     vm->targetMachinePCForThrow = catchRoutine;