Changeset 203990 in webkit

Timestamp:

Aug 1, 2016 3:20:49 PM (8 years ago)

Author:

fpizlo@apple.com

Message:

Rationalize varargs stack overflow checks
​https://bugs.webkit.org/show_bug.cgi?id=160425

Reviewed by Michael Saboff.

• ftl/FTLLink.cpp:

(JSC::FTL::link): AboveOrEqual 0 is a tautology. The code meant GreaterThanOrEqual, since the error code is -1.

• runtime/CommonSlowPaths.h:

(JSC::CommonSlowPaths::arityCheckFor): Use roundUpToMultipleOf(), which is almost certainly what we meant when we said %.

Location:

trunk

Files:

• JSTests/Changelog (modified) (1 diff)
• JSTests/stress/arity-check-ftl-throw-more-args.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/ftl/FTLLink.cpp (modified) (2 diffs)
• Source/JavaScriptCore/runtime/CommonSlowPaths.h (modified) (1 diff)

trunk/JSTests/Changelog

@@ +1 @@
+2016-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize varargs stack overflow checks
+        https://bugs.webkit.org/show_bug.cgi?id=160425
+
+        Reviewed by Michael Saboff.
+
+        * stress/arity-check-ftl-throw-more-args.js: Added.
+        (catch):
+
 2016-08-01  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-08-01  Filip Pizlo  <fpizlo@apple.com>
+
+        Rationalize varargs stack overflow checks
+        https://bugs.webkit.org/show_bug.cgi?id=160425
+
+        Reviewed by Michael Saboff.
+
+        * ftl/FTLLink.cpp:
+        (JSC::FTL::link): AboveOrEqual 0 is a tautology. The code meant GreaterThanOrEqual, since the error code is -1.
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::arityCheckFor): Use roundUpToMultipleOf(), which is almost certainly what we meant when we said %.
+
 2016-08-01  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ftl/FTLLink.cpp

@@ -141 +141 @@
         CCallHelpers::Call callArityCheck = jit.call();
 
-        auto noException = jit.branch32(CCallHelpers::AboveOrEqual, GPRInfo::returnValueGPR, CCallHelpers::TrustedImm32(0));
+        auto noException = jit.branch32(CCallHelpers::GreaterThanOrEqual, GPRInfo::returnValueGPR, CCallHelpers::TrustedImm32(0));
         jit.copyCalleeSavesToVMEntryFrameCalleeSavesBuffer();
         jit.move(CCallHelpers::TrustedImmPtr(jit.vm()), GPRInfo::argumentGPR0);
@@ -149 +149 @@
         noException.link(&jit);
 
-#if !ASSERT_DISABLED
-        jit.load64(vm.addressOfException(), GPRInfo::regT1);
-        jit.jitAssertIsNull(GPRInfo::regT1);
-#endif
+        if (!ASSERT_DISABLED) {
+            jit.load64(vm.addressOfException(), GPRInfo::regT1);
+            jit.jitAssertIsNull(GPRInfo::regT1);
+        }
 
         jit.move(GPRInfo::returnValueGPR, GPRInfo::argumentGPR0);

trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h

@@ -64 +64 @@
         newCodeBlock->numParameters() + CallFrame::headerSizeInRegisters);
     int paddedStackSpace = alignedFrameSizeForParameters - frameSize;
-
-    if (UNLIKELY(!vm.ensureStackCapacityFor(exec->registers() - paddedStackSpace % stackAlignmentRegisters())))
+    
+    Register* newStack = exec->registers() - WTF::roundUpToMultipleOf(stackAlignmentRegisters(), paddedStackSpace);
+
+    if (UNLIKELY(!vm.ensureStackCapacityFor(newStack)))
         return -1;
     return paddedStackSpace;