Changeset 224309 in webkit


Ignore:
Timestamp:
Nov 1, 2017 6:54:43 PM (6 years ago)
Author:
mark.lam@apple.com
Message:

Add support to throw OOM if MarkedArgumentBuffer may overflow.
​https://bugs.webkit.org/show_bug.cgi?id=179092
<rdar://problem/35116160>

Reviewed by Saam Barati.

Source/JavaScriptCore:

The test for overflowing a MarkedArgumentBuffer will run for a ridiculously long
time, which renders it unsuitable for automated tests. Instead, I've run a
test manually to verify that an OutOfMemoryError will be thrown when an overflow
occurs.

The MarkedArgumentBuffer's destructor will now assert that the client has indeed
checked for an overflow after invoking methods that may result in an overflow i.e.
the destructor checks that MarkedArgumentBuffer::hasOverflowed() has been called.
This is only done on debug builds.

  • API/JSObjectRef.cpp:

(JSObjectMakeFunction):
(JSObjectMakeArray):
(JSObjectMakeDate):
(JSObjectMakeRegExp):
(JSObjectCallAsFunction):
(JSObjectCallAsConstructor):

  • dfg/DFGOperations.cpp:
  • inspector/InjectedScriptManager.cpp:

(Inspector::InjectedScriptManager::createInjectedScript):

  • inspector/JSJavaScriptCallFrame.cpp:

(Inspector::JSJavaScriptCallFrame::scopeChain const):

  • interpreter/Interpreter.cpp:

(JSC::Interpreter::executeProgram):

  • jsc.cpp:

(functionDollarAgentReceiveBroadcast):

  • runtime/ArgList.cpp:

(JSC::MarkedArgumentBuffer::slowEnsureCapacity):
(JSC::MarkedArgumentBuffer::expandCapacity):
(JSC::MarkedArgumentBuffer::slowAppend):

  • runtime/ArgList.h:

(JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
(JSC::MarkedArgumentBuffer::appendWithAction):
(JSC::MarkedArgumentBuffer::append):
(JSC::MarkedArgumentBuffer::appendWithCrashOnOverflow):
(JSC::MarkedArgumentBuffer::hasOverflowed):
(JSC::MarkedArgumentBuffer::setNeedsOverflowCheck):
(JSC::MarkedArgumentBuffer::clearNeedsOverflowCheck):

  • runtime/ArrayPrototype.cpp:
  • runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

  • runtime/GetterSetter.cpp:

(JSC::callSetter):

  • runtime/IteratorOperations.cpp:

(JSC::iteratorNext):
(JSC::iteratorClose):

  • runtime/JSBoundFunction.cpp:

(JSC::boundThisNoArgsFunctionCall):
(JSC::boundFunctionCall):
(JSC::boundThisNoArgsFunctionConstruct):
(JSC::boundFunctionConstruct):

  • runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayViewFromIterator):

  • runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::genericTypedArrayViewProtoFuncSlice):
(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):

  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::haveABadTime):

  • runtime/JSInternalPromise.cpp:

(JSC::JSInternalPromise::then):

  • runtime/JSJob.cpp:

(JSC::JSJobMicrotask::run):

  • runtime/JSMapIterator.cpp:

(JSC::JSMapIterator::createPair):

  • runtime/JSModuleLoader.cpp:

(JSC::JSModuleLoader::provideFetch):
(JSC::JSModuleLoader::loadAndEvaluateModule):
(JSC::JSModuleLoader::loadModule):
(JSC::JSModuleLoader::linkAndEvaluateModule):
(JSC::JSModuleLoader::requestImportModule):

  • runtime/JSONObject.cpp:

(JSC::Stringifier::toJSONImpl):
(JSC::Stringifier::appendStringifiedValue):
(JSC::Walker::callReviver):

  • runtime/JSObject.cpp:

(JSC::ordinarySetSlow):
(JSC::callToPrimitiveFunction):
(JSC::JSObject::hasInstance):

  • runtime/JSPromise.cpp:

(JSC::JSPromise::initialize):
(JSC::JSPromise::resolve):

  • runtime/JSPromiseDeferred.cpp:

(JSC::newPromiseCapability):
(JSC::callFunction):

  • runtime/JSSetIterator.cpp:

(JSC::JSSetIterator::createPair):

  • runtime/LiteralParser.cpp:

(JSC::LiteralParser<CharType>::parse):

  • runtime/MapConstructor.cpp:

(JSC::constructMap):

  • runtime/ObjectConstructor.cpp:

(JSC::defineProperties):

  • runtime/ProxyObject.cpp:

(JSC::performProxyGet):
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::performPut):
(JSC::performProxyCall):
(JSC::performProxyConstruct):
(JSC::ProxyObject::performDelete):
(JSC::ProxyObject::performPreventExtensions):
(JSC::ProxyObject::performIsExtensible):
(JSC::ProxyObject::performDefineOwnProperty):
(JSC::ProxyObject::performGetOwnPropertyNames):
(JSC::ProxyObject::performSetPrototype):
(JSC::ProxyObject::performGetPrototype):

  • runtime/ReflectObject.cpp:

(JSC::reflectObjectConstruct):

  • runtime/SetConstructor.cpp:

(JSC::constructSet):

  • runtime/StringPrototype.cpp:

(JSC::replaceUsingRegExpSearch):
(JSC::replaceUsingStringSearch):

  • runtime/WeakMapConstructor.cpp:

(JSC::constructWeakMap):

  • runtime/WeakSetConstructor.cpp:

(JSC::constructWeakSet):

  • wasm/js/WasmToJS.cpp:

(JSC::Wasm::wasmToJS):

Source/WebCore:

No new tests. The test for overflowing a MarkedArgumentBuffer will run for a
ridiculously long time, which renders it unsuitable for automated tests.

  • Modules/plugins/QuickTimePluginReplacement.mm:

(WebCore::QuickTimePluginReplacement::installReplacement):

  • bindings/js/JSCustomElementInterface.cpp:

(WebCore::constructCustomElementSynchronously):
(WebCore::JSCustomElementInterface::upgradeElement):
(WebCore::JSCustomElementInterface::invokeCallback):

  • bindings/js/JSCustomXPathNSResolver.cpp:

(WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):

  • bindings/js/JSDOMBuiltinConstructorBase.cpp:

(WebCore::JSDOMBuiltinConstructorBase::callFunctionWithCurrentArguments):

  • bindings/js/JSDOMConvertSequences.h:

(WebCore::JSConverter<IDLSequence<T>>::convert):
(WebCore::JSConverter<IDLFrozenArray<T>>::convert):

  • bindings/js/JSDOMConvertWebGL.cpp:

(WebCore::convertToJSValue):

  • bindings/js/JSDOMIterator.h:

(WebCore::jsPair):
(WebCore::iteratorForEach):

  • bindings/js/JSDOMMapLike.cpp:

(WebCore::forwardFunctionCallToBackingMap):
(WebCore::forwardForEachCallToBackingMap):

  • bindings/js/JSDOMPromiseDeferred.cpp:

(WebCore::DeferredPromise::callFunction):
(WebCore::createRejectedPromiseWithTypeError):

  • bindings/js/JSErrorHandler.cpp:

(WebCore::JSErrorHandler::handleEvent):

  • bindings/js/JSEventListener.cpp:

(WebCore::JSEventListener::handleEvent):

  • bindings/js/JSLazyEventListener.cpp:

(WebCore::JSLazyEventListener::initializeJSFunction const):

  • bindings/js/JSPluginElementFunctions.cpp:

(WebCore::callPlugin):

  • bindings/js/JSReadableStreamPrivateConstructors.cpp:

(WebCore::constructJSReadableStreamReaderGeneric):

  • bindings/js/ReadableStream.cpp:

(WebCore::ReadableStream::create):
(WebCore::ReadableStream::pipeTo):
(WebCore::ReadableStream::tee):
(WebCore::ReadableStream::lock):
(WebCore::checkReadableStream):

  • bindings/js/ReadableStreamDefaultController.cpp:

(WebCore::ReadableStreamDefaultController::invoke):

  • bindings/js/ScheduledAction.cpp:

(WebCore::ScheduledAction::executeFunctionInContext):

  • bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::recordObject):
(WebCore::CloneSerializer::serialize):
(WebCore::CloneDeserializer::readTerminal):
(WebCore::CloneDeserializer::deserialize):

  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateCallbackImplementationContent):

  • bindings/scripts/test/JS/JSTestCallbackFunction.cpp:

(WebCore::JSTestCallbackFunction::handleEvent):

  • bindings/scripts/test/JS/JSTestCallbackFunctionRethrow.cpp:

(WebCore::JSTestCallbackFunctionRethrow::handleEvent):

  • bindings/scripts/test/JS/JSTestCallbackFunctionWithThisObject.cpp:

(WebCore::JSTestCallbackFunctionWithThisObject::handleEvent):

  • bindings/scripts/test/JS/JSTestCallbackFunctionWithTypedefs.cpp:

(WebCore::JSTestCallbackFunctionWithTypedefs::handleEvent):

  • bindings/scripts/test/JS/JSTestCallbackInterface.cpp:

(WebCore::JSTestCallbackInterface::callbackWithNoParam):
(WebCore::JSTestCallbackInterface::callbackWithArrayParam):
(WebCore::JSTestCallbackInterface::callbackWithSerializedScriptValueParam):
(WebCore::JSTestCallbackInterface::callbackWithStringList):
(WebCore::JSTestCallbackInterface::callbackWithBoolean):
(WebCore::JSTestCallbackInterface::callbackRequiresThisToPass):
(WebCore::JSTestCallbackInterface::callbackWithAReturnValue):
(WebCore::JSTestCallbackInterface::callbackThatRethrowsExceptions):
(WebCore::JSTestCallbackInterface::callbackThatSkipsInvokeCheck):
(WebCore::JSTestCallbackInterface::callbackWithThisObject):

  • bindings/scripts/test/JS/JSTestVoidCallbackFunction.cpp:

(WebCore::JSTestVoidCallbackFunction::handleEvent):

  • bridge/NP_jsobject.cpp:
  • bridge/objc/WebScriptObject.mm:

(-[WebScriptObject callWebScriptMethod:withArguments:]):

  • html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::updateCaptionContainer):
(WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
(WebCore::HTMLMediaElement::updateMediaControlsAfterPresentationModeChange):
(WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):

  • html/HTMLPlugInImageElement.cpp:

(WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):

  • testing/Internals.cpp:

(WebCore::Internals::cloneArrayBuffer):

Location:
trunk/Source
Files:
67 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/API/JSObjectRef.cpp

    r223746 r224309  
    152152        args.append(jsString(exec, parameterNames[i]->string()));
    153153    args.append(jsString(exec, body->string()));
     154    if (UNLIKELY(args.hasOverflowed())) {
     155        auto throwScope = DECLARE_THROW_SCOPE(vm);
     156        throwOutOfMemoryError(exec, throwScope);
     157        handleExceptionIfNeeded(scope, exec, exception);
     158        return 0;
     159    }
    154160
    155161    auto sourceURLString = sourceURL ? sourceURL->string() : String();
    … …  
    176182        for (size_t i = 0; i < argumentCount; ++i)
    177183            argList.append(toJS(exec, arguments[i]));
     184        if (UNLIKELY(argList.hasOverflowed())) {
     185            auto throwScope = DECLARE_THROW_SCOPE(vm);
     186            throwOutOfMemoryError(exec, throwScope);
     187            handleExceptionIfNeeded(scope, exec, exception);
     188            return 0;
     189        }
    178190
    179191        result = constructArray(exec, static_cast<ArrayAllocationProfile*>(0), argList);
    … …  
    201213    for (size_t i = 0; i < argumentCount; ++i)
    202214        argList.append(toJS(exec, arguments[i]));
     215    if (UNLIKELY(argList.hasOverflowed())) {
     216        auto throwScope = DECLARE_THROW_SCOPE(vm);
     217        throwOutOfMemoryError(exec, throwScope);
     218        handleExceptionIfNeeded(scope, exec, exception);
     219        return 0;
     220    }
    203221
    204222    JSObject* result = constructDate(exec, exec->lexicalGlobalObject(), JSValue(), argList);
    … …  
    244262    for (size_t i = 0; i < argumentCount; ++i)
    245263        argList.append(toJS(exec, arguments[i]));
     264    if (UNLIKELY(argList.hasOverflowed())) {
     265        auto throwScope = DECLARE_THROW_SCOPE(vm);
     266        throwOutOfMemoryError(exec, throwScope);
     267        handleExceptionIfNeeded(scope, exec, exception);
     268        return 0;
     269    }
    246270
    247271    JSObject* result = constructRegExp(exec, exec->lexicalGlobalObject(), argList);
    … …  
    582606    for (size_t i = 0; i < argumentCount; i++)
    583607        argList.append(toJS(exec, arguments[i]));
     608    if (UNLIKELY(argList.hasOverflowed())) {
     609        auto throwScope = DECLARE_THROW_SCOPE(vm);
     610        throwOutOfMemoryError(exec, throwScope);
     611        handleExceptionIfNeeded(scope, exec, exception);
     612        return 0;
     613    }
    584614
    585615    CallData callData;
    … …  
    623653    for (size_t i = 0; i < argumentCount; i++)
    624654        argList.append(toJS(exec, arguments[i]));
     655    if (UNLIKELY(argList.hasOverflowed())) {
     656        auto throwScope = DECLARE_THROW_SCOPE(vm);
     657        throwOutOfMemoryError(exec, throwScope);
     658        handleExceptionIfNeeded(scope, exec, exception);
     659        return 0;
     660    }
    625661
    626662    JSObjectRef result = toRef(profiledConstruct(exec, ProfilingReason::API, jsObject, constructType, constructData, argList));

  • trunk/Source/JavaScriptCore/ChangeLog

    r224302 r224309  
     12017-11-01  Mark Lam  <mark.lam@apple.com>
     2
     3        Add support to throw OOM if MarkedArgumentBuffer may overflow.
     4        https://bugs.webkit.org/show_bug.cgi?id=179092
     5        <rdar://problem/35116160>
     6
     7        Reviewed by Saam Barati.
     8
     9        The test for overflowing a MarkedArgumentBuffer will run for a ridiculously long
     10        time, which renders it unsuitable for automated tests.  Instead, I've run a
     11        test manually to verify that an OutOfMemoryError will be thrown when an overflow
     12        occurs.
     13
     14        The MarkedArgumentBuffer's destructor will now assert that the client has indeed
     15        checked for an overflow after invoking methods that may result in an overflow i.e.
     16        the destructor checks that MarkedArgumentBuffer::hasOverflowed() has been called.
     17        This is only done on debug builds.
     18
     19        * API/JSObjectRef.cpp:
     20        (JSObjectMakeFunction):
     21        (JSObjectMakeArray):
     22        (JSObjectMakeDate):
     23        (JSObjectMakeRegExp):
     24        (JSObjectCallAsFunction):
     25        (JSObjectCallAsConstructor):
     26        * dfg/DFGOperations.cpp:
     27        * inspector/InjectedScriptManager.cpp:
     28        (Inspector::InjectedScriptManager::createInjectedScript):
     29        * inspector/JSJavaScriptCallFrame.cpp:
     30        (Inspector::JSJavaScriptCallFrame::scopeChain const):
     31        * interpreter/Interpreter.cpp:
     32        (JSC::Interpreter::executeProgram):
     33        * jsc.cpp:
     34        (functionDollarAgentReceiveBroadcast):
     35        * runtime/ArgList.cpp:
     36        (JSC::MarkedArgumentBuffer::slowEnsureCapacity):
     37        (JSC::MarkedArgumentBuffer::expandCapacity):
     38        (JSC::MarkedArgumentBuffer::slowAppend):
     39        * runtime/ArgList.h:
     40        (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
     41        (JSC::MarkedArgumentBuffer::appendWithAction):
     42        (JSC::MarkedArgumentBuffer::append):
     43        (JSC::MarkedArgumentBuffer::appendWithCrashOnOverflow):
     44        (JSC::MarkedArgumentBuffer::hasOverflowed):
     45        (JSC::MarkedArgumentBuffer::setNeedsOverflowCheck):
     46        (JSC::MarkedArgumentBuffer::clearNeedsOverflowCheck):
     47        * runtime/ArrayPrototype.cpp:
     48        * runtime/CommonSlowPaths.cpp:
     49        (JSC::SLOW_PATH_DECL):
     50        * runtime/GetterSetter.cpp:
     51        (JSC::callSetter):
     52        * runtime/IteratorOperations.cpp:
     53        (JSC::iteratorNext):
     54        (JSC::iteratorClose):
     55        * runtime/JSBoundFunction.cpp:
     56        (JSC::boundThisNoArgsFunctionCall):
     57        (JSC::boundFunctionCall):
     58        (JSC::boundThisNoArgsFunctionConstruct):
     59        (JSC::boundFunctionConstruct):
     60        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
     61        (JSC::constructGenericTypedArrayViewFromIterator):
     62        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
     63        (JSC::genericTypedArrayViewProtoFuncSlice):
     64        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
     65        * runtime/JSGlobalObject.cpp:
     66        (JSC::JSGlobalObject::haveABadTime):
     67        * runtime/JSInternalPromise.cpp:
     68        (JSC::JSInternalPromise::then):
     69        * runtime/JSJob.cpp:
     70        (JSC::JSJobMicrotask::run):
     71        * runtime/JSMapIterator.cpp:
     72        (JSC::JSMapIterator::createPair):
     73        * runtime/JSModuleLoader.cpp:
     74        (JSC::JSModuleLoader::provideFetch):
     75        (JSC::JSModuleLoader::loadAndEvaluateModule):
     76        (JSC::JSModuleLoader::loadModule):
     77        (JSC::JSModuleLoader::linkAndEvaluateModule):
     78        (JSC::JSModuleLoader::requestImportModule):
     79        * runtime/JSONObject.cpp:
     80        (JSC::Stringifier::toJSONImpl):
     81        (JSC::Stringifier::appendStringifiedValue):
     82        (JSC::Walker::callReviver):
     83        * runtime/JSObject.cpp:
     84        (JSC::ordinarySetSlow):
     85        (JSC::callToPrimitiveFunction):
     86        (JSC::JSObject::hasInstance):
     87        * runtime/JSPromise.cpp:
     88        (JSC::JSPromise::initialize):
     89        (JSC::JSPromise::resolve):
     90        * runtime/JSPromiseDeferred.cpp:
     91        (JSC::newPromiseCapability):
     92        (JSC::callFunction):
     93        * runtime/JSSetIterator.cpp:
     94        (JSC::JSSetIterator::createPair):
     95        * runtime/LiteralParser.cpp:
     96        (JSC::LiteralParser<CharType>::parse):
     97        * runtime/MapConstructor.cpp:
     98        (JSC::constructMap):
     99        * runtime/ObjectConstructor.cpp:
     100        (JSC::defineProperties):
     101        * runtime/ProxyObject.cpp:
     102        (JSC::performProxyGet):
     103        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
     104        (JSC::ProxyObject::performHasProperty):
     105        (JSC::ProxyObject::performPut):
     106        (JSC::performProxyCall):
     107        (JSC::performProxyConstruct):
     108        (JSC::ProxyObject::performDelete):
     109        (JSC::ProxyObject::performPreventExtensions):
     110        (JSC::ProxyObject::performIsExtensible):
     111        (JSC::ProxyObject::performDefineOwnProperty):
     112        (JSC::ProxyObject::performGetOwnPropertyNames):
     113        (JSC::ProxyObject::performSetPrototype):
     114        (JSC::ProxyObject::performGetPrototype):
     115        * runtime/ReflectObject.cpp:
     116        (JSC::reflectObjectConstruct):
     117        * runtime/SetConstructor.cpp:
     118        (JSC::constructSet):
     119        * runtime/StringPrototype.cpp:
     120        (JSC::replaceUsingRegExpSearch):
     121        (JSC::replaceUsingStringSearch):
     122        * runtime/WeakMapConstructor.cpp:
     123        (JSC::constructWeakMap):
     124        * runtime/WeakSetConstructor.cpp:
     125        (JSC::constructWeakSet):
     126        * wasm/js/WasmToJS.cpp:
     127        (JSC::Wasm::wasmToJS):
     128
    11292017-11-01  Michael Saboff  <msaboff@apple.com>
    2130

  • trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

    r224280 r224309  
    24072407        MarkedArgumentBuffer arguments;
    24082408        arguments.append(iterable);
     2409        ASSERT(!arguments.hasOverflowed());
    24092410        JSValue arrayResult = call(exec, iterationFunction, callType, callData, jsNull(), arguments);
    24102411        RETURN_IF_EXCEPTION(throwScope, nullptr);

  • trunk/Source/JavaScriptCore/inspector/InjectedScriptManager.cpp

    r218794 r224309  
    11/*
    2  * Copyright (C) 2007, 2008, 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007-2017 Apple Inc. All rights reserved.
    33 * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
    44 * Copyright (C) 2012 Google Inc. All rights reserved.
    … …  
    159159    args.append(globalThisValue);
    160160    args.append(jsNumber(id));
     161    ASSERT(!args.hasOverflowed());
    161162
    162163    JSValue result = JSC::call(scriptState, functionValue, callType, callData, globalThisValue, args);

  • trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp

    r221822 r224309  
    11/*
    2  * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    181181JSValue JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
    182182{
     183    VM& vm = exec->vm();
     184    auto scope = DECLARE_THROW_SCOPE(vm);
     185
    183186    if (!impl().scopeChain())
    184187        return jsNull();
    … …  
    196199        ++iter;
    197200    } while (iter != end);
     201    if (UNLIKELY(list.hasOverflowed())) {
     202        throwOutOfMemoryError(exec, scope);
     203        return { };
     204    }
    198205
    199206    return constructArray(exec, nullptr, globalObject(), list);

  • trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

    r224272 r224309  
    863863                MarkedArgumentBuffer jsonArg;
    864864                jsonArg.append(JSONPValue);
     865                ASSERT(!jsonArg.hasOverflowed());
    865866                JSValue thisValue = JSONPPath.size() == 1 ? jsUndefined(): baseObject;
    866867                JSONPValue = JSC::call(callFrame, function, callType, callData, thisValue, jsonArg);

  • trunk/Source/JavaScriptCore/jsc.cpp

    r223746 r224309  
    29122912    args.append(jsBuffer);
    29132913    args.append(jsNumber(message->index()));
     2914    if (UNLIKELY(args.hasOverflowed()))
     2915        return JSValue::encode(throwOutOfMemoryError(exec, scope));
    29142916    scope.release();
    29152917    return JSValue::encode(call(exec, callback, callType, callData, jsNull(), args));

  • trunk/Source/JavaScriptCore/runtime/ArgList.cpp

    r212692 r224309  
    6666void MarkedArgumentBuffer::slowEnsureCapacity(size_t requestedCapacity)
    6767{
    68     int newCapacity = Checked<int>(requestedCapacity).unsafeGet();
    69     expandCapacity(newCapacity);
     68    setNeedsOverflowCheck();
     69    auto checkedNewCapacity = Checked<int, RecordOverflow>(requestedCapacity);
     70    if (UNLIKELY(checkedNewCapacity.hasOverflowed()))
     71        return this->overflowed();
     72    expandCapacity(checkedNewCapacity.unsafeGet());
    7073}
    7174
    7275void MarkedArgumentBuffer::expandCapacity()
    7376{
    74     int newCapacity = (Checked<int>(m_capacity) * 2).unsafeGet();
    75     expandCapacity(newCapacity);
     77    setNeedsOverflowCheck();
     78    auto checkedNewCapacity = Checked<int, RecordOverflow>(m_capacity) * 2;
     79    if (UNLIKELY(checkedNewCapacity.hasOverflowed()))
     80        return this->overflowed();
     81    expandCapacity(checkedNewCapacity.unsafeGet());
    7682}
    7783
    7884void MarkedArgumentBuffer::expandCapacity(int newCapacity)
    7985{
     86    setNeedsOverflowCheck();
    8087    ASSERT(m_capacity < newCapacity);
    81     size_t size = (Checked<size_t>(newCapacity) * sizeof(EncodedJSValue)).unsafeGet();
    82     EncodedJSValue* newBuffer = static_cast<EncodedJSValue*>(fastMalloc(size));
     88    auto checkedSize = Checked<size_t, RecordOverflow>(newCapacity) * sizeof(EncodedJSValue);
     89    if (UNLIKELY(checkedSize.hasOverflowed()))
     90        return this->overflowed();
     91    EncodedJSValue* newBuffer = static_cast<EncodedJSValue*>(fastMalloc(checkedSize.unsafeGet()));
    8392    for (int i = 0; i < m_size; ++i) {
    8493        newBuffer[i] = m_buffer[i];
    … …  
    98107    if (m_size == m_capacity)
    99108        expandCapacity();
     109    if (UNLIKELY(Base::hasOverflowed())) {
     110        ASSERT(m_needsOverflowCheck);
     111        return;
     112    }
    100113
    101114    slotFor(m_size) = JSValue::encode(v);

  • trunk/Source/JavaScriptCore/runtime/ArgList.h

    r212692 r224309  
    2323
    2424#include "CallFrame.h"
     25#include <wtf/CheckedArithmetic.h>
    2526#include <wtf/ForbidHeapAllocation.h>
    2627#include <wtf/HashSet.h>
    … …  
    2829namespace JSC {
    2930
    30 class MarkedArgumentBuffer {
     31class MarkedArgumentBuffer : public RecordOverflow {
    3132    WTF_MAKE_NONCOPYABLE(MarkedArgumentBuffer);
    3233    WTF_FORBID_HEAP_ALLOCATION;
    … …  
    3536
    3637private:
     38    using Base = RecordOverflow;
    3739    static const size_t inlineCapacity = 8;
    3840    typedef HashSet<MarkedArgumentBuffer*> ListSet;
    … …  
    5153    ~MarkedArgumentBuffer()
    5254    {
     55        ASSERT(!m_needsOverflowCheck);
    5356        if (m_markSet)
    5457            m_markSet->remove(this);
    … …  
    7477    }
    7578
    76     void append(JSValue v)
     79    enum OverflowCheckAction {
     80        CrashOnOverflow,
     81        WillCheckLater
     82    };
     83    template<OverflowCheckAction action>
     84    void appendWithAction(JSValue v)
    7785    {
    7886        ASSERT(m_size <= m_capacity);
    79         if (m_size == m_capacity || mallocBase())
    80             return slowAppend(v);
     87        if (m_size == m_capacity || mallocBase()) {
     88            slowAppend(v);
     89            if (action == CrashOnOverflow)
     90                RELEASE_ASSERT(!hasOverflowed());
     91            return;
     92        }
    8193
    8294        slotFor(m_size) = JSValue::encode(v);
    8395        ++m_size;
    8496    }
     97    void append(JSValue v) { appendWithAction<WillCheckLater>(v); }
     98    void appendWithCrashOnOverflow(JSValue v) { appendWithAction<CrashOnOverflow>(v); }
    8599
    86100    void removeLast()
    … …  
    104118    }
    105119
     120    bool hasOverflowed()
     121    {
     122        clearNeedsOverflowCheck();
     123        return Base::hasOverflowed();
     124    }
     125
    106126private:
    107127    void expandCapacity();
    … …  
    112132
    113133    JS_EXPORT_PRIVATE void slowAppend(JSValue);
    114        
     134
    115135    EncodedJSValue& slotFor(int item) const
    116136    {
    … …  
    124144        return &slotFor(0);
    125145    }
    126        
     146
     147#if ASSERT_DISABLED
     148    void setNeedsOverflowCheck() { }
     149    void clearNeedsOverflowCheck() { }
     150#else
     151    void setNeedsOverflowCheck() { m_needsOverflowCheck = true; }
     152    void clearNeedsOverflowCheck() { m_needsOverflowCheck = false; }
     153
     154    bool m_needsOverflowCheck { false };
     155#endif
    127156    int m_size;
    128157    int m_capacity;

  • trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

    r223834 r224309  
    255255    MarkedArgumentBuffer args;
    256256    args.append(jsNumber(length));
     257    ASSERT(!args.hasOverflowed());
    257258    JSObject* newObject = construct(exec, constructor, args, "Species construction did not get a valid constructor");
    258259    RETURN_IF_EXCEPTION(scope, exceptionResult());

  • trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

    r224280 r224309  
    10961096        MarkedArgumentBuffer arguments;
    10971097        arguments.append(iterable);
     1098        ASSERT(!arguments.hasOverflowed());
    10981099        JSValue arrayResult = call(exec, iterationFunction, callType, callData, jsNull(), arguments);
    10991100        CHECK_EXCEPTION();

  • trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp

    r217108 r224309  
    22 *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
    33 *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
    4  *  Copyright (C) 2004, 2007-2009, 2014, 2016 Apple Inc. All rights reserved.
     4 *  Copyright (C) 2004-2017 Apple Inc. All rights reserved.
    55 *
    66 *  This library is free software; you can redistribute it and/or
    … …  
    102102    MarkedArgumentBuffer args;
    103103    args.append(value);
     104    ASSERT(!args.hasOverflowed());
    104105
    105106    CallData callData;

  • trunk/Source/JavaScriptCore/runtime/IteratorOperations.cpp

    r223125 r224309  
    5353    if (!argument.isEmpty())
    5454        nextFunctionArguments.append(argument);
     55    ASSERT(!nextFunctionArguments.hasOverflowed());
    5556    JSValue result = call(exec, nextFunction, nextFunctionCallType, nextFunctionCallData, iterator, nextFunctionArguments);
    5657    RETURN_IF_EXCEPTION(scope, JSValue());
    … …  
    118119
    119120    MarkedArgumentBuffer returnFunctionArguments;
     121    ASSERT(!returnFunctionArguments.hasOverflowed());
    120122    JSValue innerResult = call(exec, returnFunction, returnFunctionCallType, returnFunctionCallData, iterationRecord.iterator, returnFunctionArguments);
    121123

  • trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp

    r223125 r224309  
    4242    for (unsigned i = 0; i < exec->argumentCount(); ++i)
    4343        args.append(exec->uncheckedArgument(i));
     44    RELEASE_ASSERT(!args.hasOverflowed());
    4445
    4546    JSFunction* targetFunction = jsCast<JSFunction*>(boundFunction->targetFunction());
    … …  
    5758EncodedJSValue JSC_HOST_CALL boundFunctionCall(ExecState* exec)
    5859{
     60    VM& vm = exec->vm();
     61    auto scope = DECLARE_THROW_SCOPE(vm);
    5962    JSBoundFunction* boundFunction = jsCast<JSBoundFunction*>(exec->jsCallee());
    6063
    … …  
    6871    for (unsigned i = 0; i < exec->argumentCount(); ++i)
    6972        args.append(exec->uncheckedArgument(i));
     73    if (UNLIKELY(args.hasOverflowed())) {
     74        throwOutOfMemoryError(exec, scope);
     75        return encodedJSValue();
     76    }
    7077
    7178    JSObject* targetFunction = boundFunction->targetFunction();
    … …  
    7380    CallType callType = getCallData(targetFunction, callData);
    7481    ASSERT(callType != CallType::None);
     82    scope.release();
    7583    return JSValue::encode(call(exec, targetFunction, callType, callData, boundFunction->boundThis(), args));
    7684}
    … …  
    8391    for (unsigned i = 0; i < exec->argumentCount(); ++i)
    8492        args.append(exec->uncheckedArgument(i));
     93    RELEASE_ASSERT(!args.hasOverflowed());
    8594
    8695    JSFunction* targetFunction = jsCast<JSFunction*>(boundFunction->targetFunction());
    … …  
    93102EncodedJSValue JSC_HOST_CALL boundFunctionConstruct(ExecState* exec)
    94103{
     104    VM& vm = exec->vm();
     105    auto scope = DECLARE_THROW_SCOPE(vm);
    95106    JSBoundFunction* boundFunction = jsCast<JSBoundFunction*>(exec->jsCallee());
    96107
    … …  
    104115    for (unsigned i = 0; i < exec->argumentCount(); ++i)
    105116        args.append(exec->uncheckedArgument(i));
     117    if (UNLIKELY(args.hasOverflowed())) {
     118        throwOutOfMemoryError(exec, scope);
     119        return encodedJSValue();
     120    }
    106121
    107122    JSObject* targetFunction = boundFunction->targetFunction();
    … …  
    109124    ConstructType constructType = getConstructData(targetFunction, constructData);
    110125    ASSERT(constructType != ConstructType::None);
     126    scope.release();
    111127    return JSValue::encode(construct(exec, targetFunction, constructType, constructData, args));
    112128}

  • trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h

    r222617 r224309  
    11/*
    2  * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    8686    forEachInIterable(*exec, iterable, iteratorMethod, [&] (VM&, ExecState&, JSValue value) {
    8787        storage.append(value);
     88        if (UNLIKELY(storage.hasOverflowed())) {
     89            throwOutOfMemoryError(exec, scope);
     90            return;
     91        }
    8892    });
    8993    RETURN_IF_EXCEPTION(scope, nullptr);

  • trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h

    r218794 r224309  
    450450    MarkedArgumentBuffer args;
    451451    args.append(jsNumber(length));
     452    ASSERT(!args.hasOverflowed());
    452453
    453454    JSArrayBufferView* result = speciesConstruct(exec, thisObject, args, [&]() {
    … …  
    564565    args.append(jsNumber(newByteOffset));
    565566    args.append(jsNumber(length));
     567    ASSERT(!args.hasOverflowed());
    566568
    567569    JSObject* result = construct(exec, species, args, "species is not a constructor");

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

    r223746 r224309  
    12161216        vm.heap.objectSpace().forEachLiveCell(iterationScope, finder);
    12171217    }
     1218    RELEASE_ASSERT(!foundObjects.hasOverflowed());
    12181219    while (!foundObjects.isEmpty()) {
    12191220        JSObject* object = asObject(foundObjects.last());

  • trunk/Source/JavaScriptCore/runtime/JSInternalPromise.cpp

    r221849 r224309  
    11/*
    2  * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    6565    arguments.append(onFulfilled ? onFulfilled : jsUndefined());
    6666    arguments.append(onRejected ? onRejected : jsUndefined());
     67    ASSERT(!arguments.hasOverflowed());
    6768
    6869    scope.release();

  • trunk/Source/JavaScriptCore/runtime/JSJob.cpp

    r221849 r224309  
    11/*
    2  * Copyright (C) 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    7777        handlerArguments.append(arg);
    7878    }
     79    if (UNLIKELY(handlerArguments.hasOverflowed()))
     80        return;
    7981    profiledCall(exec, ProfilingReason::Microtask, m_job.get(), handlerCallType, handlerCallData, jsUndefined(), handlerArguments);
    8082    scope.clearException();

  • trunk/Source/JavaScriptCore/runtime/JSMapIterator.cpp

    r221110 r224309  
    11/*
    2  * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple, Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    5555    args.append(key);
    5656    args.append(value);
     57    ASSERT(!args.hasOverflowed());
    5758    JSGlobalObject* globalObject = callFrame->jsCallee()->globalObject();
    5859    return constructArray(callFrame, 0, globalObject, args);

  • trunk/Source/JavaScriptCore/runtime/JSModuleLoader.cpp

    r223777 r224309  
    11/*
    2  * Copyright (C) 2015 Apple Inc. All Rights Reserved.
     2 * Copyright (C) 2015-2017 Apple Inc. All Rights Reserved.
    33 * Copyright (C) 2016 Yusuke Suzuki <utatane.tea@gmail.com>.
    44 *
    … …  
    9595    arguments.append(key);
    9696    arguments.append(JSSourceCode::create(vm, WTFMove(source)));
     97    ASSERT(!arguments.hasOverflowed());
    9798
    9899    scope.release();
    … …  
    115116    arguments.append(parameters);
    116117    arguments.append(scriptFetcher);
     118    ASSERT(!arguments.hasOverflowed());
    117119
    118120    scope.release();
    … …  
    135137    arguments.append(parameters);
    136138    arguments.append(scriptFetcher);
     139    ASSERT(!arguments.hasOverflowed());
    137140
    138141    scope.release();
    … …  
    154157    arguments.append(moduleKey);
    155158    arguments.append(scriptFetcher);
     159    ASSERT(!arguments.hasOverflowed());
    156160
    157161    scope.release();
    … …  
    174178    arguments.append(parameters);
    175179    arguments.append(scriptFetcher);
     180    ASSERT(!arguments.hasOverflowed());
    176181
    177182    scope.release();

  • trunk/Source/JavaScriptCore/runtime/JSONObject.cpp

    r223731 r224309  
    314314    MarkedArgumentBuffer args;
    315315    args.append(propertyName.value(m_exec));
     316    ASSERT(!args.hasOverflowed());
    316317    return call(m_exec, asObject(toJSONFunction), callType, callData, value, args);
    317318}
    … …  
    331332        args.append(propertyName.value(m_exec));
    332333        args.append(value);
     334        ASSERT(!args.hasOverflowed());
    333335        value = call(m_exec, m_replacer.get(), m_replacerCallType, m_replacerCallData, holder.object(), args);
    334336        RETURN_IF_EXCEPTION(scope, StringifyFailed);
    … …  
    610612        args.append(property);
    611613        args.append(unfiltered);
     614        ASSERT(!args.hasOverflowed());
    612615        return call(m_exec, m_function.get(), m_callType, m_callData, thisObj, args);
    613616    }

  • trunk/Source/JavaScriptCore/runtime/JSObject.cpp

    r223746 r224309  
    741741    MarkedArgumentBuffer args;
    742742    args.append(value);
     743    ASSERT(!args.hasOverflowed());
    743744
    744745    CallData callData;
    … …  
    19391940        callArgs.append(hintString);
    19401941    }
     1942    ASSERT(!callArgs.hasOverflowed());
    19411943
    19421944    JSValue result = call(exec, function, callType, callData, const_cast<JSObject*>(object), callArgs);
    … …  
    20532055        MarkedArgumentBuffer args;
    20542056        args.append(value);
     2057        ASSERT(!args.hasOverflowed());
    20552058        JSValue result = call(exec, hasInstanceValue, callType, callData, this, args);
    20562059        RETURN_IF_EXCEPTION(scope, false);

  • trunk/Source/JavaScriptCore/runtime/JSPromise.cpp

    r217108 r224309  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    7171    MarkedArgumentBuffer arguments;
    7272    arguments.append(executor);
     73    ASSERT(!arguments.hasOverflowed());
    7374    call(exec, initializePromise, callType, callData, this, arguments);
    7475}
    … …  
    106107    MarkedArgumentBuffer arguments;
    107108    arguments.append(value);
     109    ASSERT(!arguments.hasOverflowed());
    108110    auto result = call(exec, promiseResolveFunction, callType, callData, globalObject.promiseConstructor(), arguments);
    109111    RETURN_IF_EXCEPTION(scope, nullptr);

  • trunk/Source/JavaScriptCore/runtime/JSPromiseDeferred.cpp

    r221849 r224309  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    4949    MarkedArgumentBuffer arguments;
    5050    arguments.append(promiseConstructor);
     51    ASSERT(!arguments.hasOverflowed());
    5152    return call(exec, newPromiseCapabilityFunction, callType, callData, jsUndefined(), arguments);
    5253}
    … …  
    9798    MarkedArgumentBuffer arguments;
    9899    arguments.append(value);
     100    ASSERT(!arguments.hasOverflowed());
    99101
    100102    call(exec, function, callType, callData, jsUndefined(), arguments);

  • trunk/Source/JavaScriptCore/runtime/JSSetIterator.cpp

    r221110 r224309  
    11/*
    2  * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple, Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    5555    args.append(key);
    5656    args.append(value);
     57    ASSERT(!args.hasOverflowed());
    5758    JSGlobalObject* globalObject = callFrame->jsCallee()->globalObject();
    5859    return constructArray(callFrame, 0, globalObject, args);

  • trunk/Source/JavaScriptCore/runtime/LiteralParser.cpp

    r221849 r224309  
    11/*
    2  * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2009-2017 Apple Inc. All rights reserved.
    33 * Copyright (C) 2012 Mathias Bynens (mathias@qiwi.be)
    44 *
    … …  
    594594                JSArray* array = constructEmptyArray(m_exec, 0);
    595595                RETURN_IF_EXCEPTION(scope, JSValue());
    596                 objectStack.append(array);
     596                objectStack.appendWithCrashOnOverflow(array);
    597597            }
    598598            doParseArrayStartExpression:
    … …  
    635635            case StartParseObject: {
    636636                JSObject* object = constructEmptyObject(m_exec);
    637                 objectStack.append(object);
     637                objectStack.appendWithCrashOnOverflow(object);
    638638
    639639                TokenType type = m_lexer.next();

  • trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp

    r222473 r224309  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    106106        arguments.append(key);
    107107        arguments.append(value);
     108        ASSERT(!arguments.hasOverflowed());
    108109        scope.release();
    109110        call(exec, adderFunction, adderFunctionCallType, adderFunctionCallData, map, arguments);

  • trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp

    r223594 r224309  
    570570        }
    571571    }
     572    RELEASE_ASSERT(!markBuffer.hasOverflowed());
    572573    for (size_t i = 0; i < numProperties; i++) {
    573574        auto& propertyName = propertyNames[i];

  • trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp

    r222617 r224309  
    11/*
    2  * Copyright (C) 2016 Apple Inc. All Rights Reserved.
     2 * Copyright (C) 2016-2017 Apple Inc. All Rights Reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    166166    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
    167167    arguments.append(receiver);
     168    ASSERT(!arguments.hasOverflowed());
    168169    JSValue trapResult = call(exec, getHandler, callType, callData, handler, arguments);
    169170    RETURN_IF_EXCEPTION(scope, { });
    … …  
    238239    arguments.append(target);
    239240    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
     241    ASSERT(!arguments.hasOverflowed());
    240242    JSValue trapResult = call(exec, getOwnPropertyDescriptorMethod, callType, callData, handler, arguments);
    241243    RETURN_IF_EXCEPTION(scope, false);
    … …  
    346348    arguments.append(target);
    347349    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
     350    ASSERT(!arguments.hasOverflowed());
    348351    JSValue trapResult = call(exec, hasMethod, callType, callData, handler, arguments);
    349352    RETURN_IF_EXCEPTION(scope, false);
    … …  
    453456    arguments.append(putValue);
    454457    arguments.append(thisValue);
     458    ASSERT(!arguments.hasOverflowed());
    455459    JSValue trapResult = call(exec, setMethod, callType, callData, handler, arguments);
    456460    RETURN_IF_EXCEPTION(scope, false);
    … …  
    547551    arguments.append(exec->thisValue());
    548552    arguments.append(argArray);
     553    ASSERT(!arguments.hasOverflowed());
    549554    scope.release();
    550555    return JSValue::encode(call(exec, applyMethod, callType, callData, handler, arguments));
    … …  
    599604    arguments.append(argArray);
    600605    arguments.append(exec->newTarget());
     606    ASSERT(!arguments.hasOverflowed());
    601607    JSValue result = call(exec, constructMethod, callType, callData, handler, arguments);
    602608    RETURN_IF_EXCEPTION(scope, encodedJSValue());
    … …  
    656662    arguments.append(target);
    657663    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
     664    ASSERT(!arguments.hasOverflowed());
    658665    JSValue trapResult = call(exec, deletePropertyMethod, callType, callData, handler, arguments);
    659666    RETURN_IF_EXCEPTION(scope, false);
    … …  
    729736    MarkedArgumentBuffer arguments;
    730737    arguments.append(target);
     738    ASSERT(!arguments.hasOverflowed());
    731739    JSValue trapResult = call(exec, preventExtensionsMethod, callType, callData, handler, arguments);
    732740    RETURN_IF_EXCEPTION(scope, false);
    … …  
    783791    MarkedArgumentBuffer arguments;
    784792    arguments.append(target);
     793    ASSERT(!arguments.hasOverflowed());
    785794    JSValue trapResult = call(exec, isExtensibleMethod, callType, callData, handler, arguments);
    786795    RETURN_IF_EXCEPTION(scope, false);
    … …  
    853862    arguments.append(identifierToSafePublicJSValue(vm, Identifier::fromUid(&vm, propertyName.uid())));
    854863    arguments.append(descriptorObject);
     864    ASSERT(!arguments.hasOverflowed());
    855865    JSValue trapResult = call(exec, definePropertyMethod, callType, callData, handler, arguments);
    856866    RETURN_IF_EXCEPTION(scope, false);
    … …  
    937947    MarkedArgumentBuffer arguments;
    938948    arguments.append(target);
     949    ASSERT(!arguments.hasOverflowed());
    939950    JSValue arrayLikeObject = call(exec, ownKeysMethod, callType, callData, handler, arguments);
    940951    RETURN_IF_EXCEPTION(scope, void());
    … …  
    10881099    arguments.append(target);
    10891100    arguments.append(prototype);
     1101    ASSERT(!arguments.hasOverflowed());
    10901102    JSValue trapResult = call(exec, setPrototypeOfMethod, callType, callData, handler, arguments);
    10911103    RETURN_IF_EXCEPTION(scope, false);
    … …  
    11511163    MarkedArgumentBuffer arguments;
    11521164    arguments.append(target);
     1165    ASSERT(!arguments.hasOverflowed());
    11531166    JSValue trapResult = call(exec, getPrototypeOfMethod, callType, callData, handler, arguments);
    11541167    RETURN_IF_EXCEPTION(scope, { });

  • trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp

    r223594 r224309  
    122122    });
    123123    RETURN_IF_EXCEPTION(scope, encodedJSValue());
     124    if (UNLIKELY(arguments.hasOverflowed())) {
     125        throwOutOfMemoryError(exec, scope);
     126        return encodedJSValue();
     127    }
    124128
    125129    scope.release();

  • trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp

    r222473 r224309  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    9393        MarkedArgumentBuffer arguments;
    9494        arguments.append(nextValue);
     95        ASSERT(!arguments.hasOverflowed());
    9596        call(exec, adderFunction, adderFunctionCallType, adderFunctionCallData, set, arguments);
    9697    });

  • trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp

    r224276 r224309  
    720720                if (hasNamedCaptures)
    721721                    args.append(groups);
     722                if (UNLIKELY(args.hasOverflowed())) {
     723                    throwOutOfMemoryError(exec, scope);
     724                    return encodedJSValue();
     725                }
    722726
    723727                JSValue replacement = call(exec, replaceValue, callType, callData, jsUndefined(), args);
    … …  
    836840        args.append(jsNumber(matchStart));
    837841        args.append(jsString);
     842        ASSERT(!args.hasOverflowed());
    838843        replaceValue = call(exec, replaceValue, callType, callData, jsUndefined(), args);
    839844        RETURN_IF_EXCEPTION(scope, encodedJSValue());

  • trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp

    r222473 r224309  
    11/*
    2  * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
     2 * Copyright (C) 2013-2017 Apple, Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    9191        arguments.append(key);
    9292        arguments.append(value);
     93        ASSERT(!arguments.hasOverflowed());
    9394        scope.release();
    9495        call(exec, adderFunction, adderFunctionCallType, adderFunctionCallData, weakMap, arguments);

  • trunk/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp

    r222473 r224309  
    11/*
    2  * Copyright (C) 2015-2016 Apple, Inc. All rights reserved.
     2 * Copyright (C) 2015-2017 Apple, Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    7878        MarkedArgumentBuffer arguments;
    7979        arguments.append(nextValue);
     80        ASSERT(!arguments.hasOverflowed());
    8081        call(exec, adderFunction, adderFunctionCallType, adderFunctionCallData, weakSet, arguments);
    8182    });

  • trunk/Source/JavaScriptCore/wasm/js/WasmToJS.cpp

    r224020 r224309  
    248248                    args.append(arg);
    249249                }
     250                if (UNLIKELY(args.hasOverflowed())) {
     251                    throwOutOfMemoryError(exec, throwScope);
     252                    return 0;
     253                }
    250254
    251255                CallData callData;

  • trunk/Source/WebCore/ChangeLog

    r224308 r224309  
     12017-11-01  Mark Lam  <mark.lam@apple.com>
     2
     3        Add support to throw OOM if MarkedArgumentBuffer may overflow.
     4        https://bugs.webkit.org/show_bug.cgi?id=179092
     5        <rdar://problem/35116160>
     6
     7        Reviewed by Saam Barati.
     8
     9        No new tests.  The test for overflowing a MarkedArgumentBuffer will run for a
     10        ridiculously long time, which renders it unsuitable for automated tests.
     11
     12        * Modules/plugins/QuickTimePluginReplacement.mm:
     13        (WebCore::QuickTimePluginReplacement::installReplacement):
     14        * bindings/js/JSCustomElementInterface.cpp:
     15        (WebCore::constructCustomElementSynchronously):
     16        (WebCore::JSCustomElementInterface::upgradeElement):
     17        (WebCore::JSCustomElementInterface::invokeCallback):
     18        * bindings/js/JSCustomXPathNSResolver.cpp:
     19        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
     20        * bindings/js/JSDOMBuiltinConstructorBase.cpp:
     21        (WebCore::JSDOMBuiltinConstructorBase::callFunctionWithCurrentArguments):
     22        * bindings/js/JSDOMConvertSequences.h:
     23        (WebCore::JSConverter<IDLSequence<T>>::convert):
     24        (WebCore::JSConverter<IDLFrozenArray<T>>::convert):
     25        * bindings/js/JSDOMConvertWebGL.cpp:
     26        (WebCore::convertToJSValue):
     27        * bindings/js/JSDOMIterator.h:
     28        (WebCore::jsPair):
     29        (WebCore::iteratorForEach):
     30        * bindings/js/JSDOMMapLike.cpp:
     31        (WebCore::forwardFunctionCallToBackingMap):
     32        (WebCore::forwardForEachCallToBackingMap):
     33        * bindings/js/JSDOMPromiseDeferred.cpp:
     34        (WebCore::DeferredPromise::callFunction):
     35        (WebCore::createRejectedPromiseWithTypeError):
     36        * bindings/js/JSErrorHandler.cpp:
     37        (WebCore::JSErrorHandler::handleEvent):
     38        * bindings/js/JSEventListener.cpp:
     39        (WebCore::JSEventListener::handleEvent):
     40        * bindings/js/JSLazyEventListener.cpp:
     41        (WebCore::JSLazyEventListener::initializeJSFunction const):
     42        * bindings/js/JSPluginElementFunctions.cpp:
     43        (WebCore::callPlugin):
     44        * bindings/js/JSReadableStreamPrivateConstructors.cpp:
     45        (WebCore::constructJSReadableStreamReaderGeneric):
     46        * bindings/js/ReadableStream.cpp:
     47        (WebCore::ReadableStream::create):
     48        (WebCore::ReadableStream::pipeTo):
     49        (WebCore::ReadableStream::tee):
     50        (WebCore::ReadableStream::lock):
     51        (WebCore::checkReadableStream):
     52        * bindings/js/ReadableStreamDefaultController.cpp:
     53        (WebCore::ReadableStreamDefaultController::invoke):
     54        * bindings/js/ScheduledAction.cpp:
     55        (WebCore::ScheduledAction::executeFunctionInContext):
     56        * bindings/js/SerializedScriptValue.cpp:
     57        (WebCore::CloneSerializer::recordObject):
     58        (WebCore::CloneSerializer::serialize):
     59        (WebCore::CloneDeserializer::readTerminal):
     60        (WebCore::CloneDeserializer::deserialize):
     61        * bindings/scripts/CodeGeneratorJS.pm:
     62        (GenerateCallbackImplementationContent):
     63        * bindings/scripts/test/JS/JSTestCallbackFunction.cpp:
     64        (WebCore::JSTestCallbackFunction::handleEvent):
     65        * bindings/scripts/test/JS/JSTestCallbackFunctionRethrow.cpp:
     66        (WebCore::JSTestCallbackFunctionRethrow::handleEvent):
     67        * bindings/scripts/test/JS/JSTestCallbackFunctionWithThisObject.cpp:
     68        (WebCore::JSTestCallbackFunctionWithThisObject::handleEvent):
     69        * bindings/scripts/test/JS/JSTestCallbackFunctionWithTypedefs.cpp:
     70        (WebCore::JSTestCallbackFunctionWithTypedefs::handleEvent):
     71        * bindings/scripts/test/JS/JSTestCallbackInterface.cpp:
     72        (WebCore::JSTestCallbackInterface::callbackWithNoParam):
     73        (WebCore::JSTestCallbackInterface::callbackWithArrayParam):
     74        (WebCore::JSTestCallbackInterface::callbackWithSerializedScriptValueParam):
     75        (WebCore::JSTestCallbackInterface::callbackWithStringList):
     76        (WebCore::JSTestCallbackInterface::callbackWithBoolean):
     77        (WebCore::JSTestCallbackInterface::callbackRequiresThisToPass):
     78        (WebCore::JSTestCallbackInterface::callbackWithAReturnValue):
     79        (WebCore::JSTestCallbackInterface::callbackThatRethrowsExceptions):
     80        (WebCore::JSTestCallbackInterface::callbackThatSkipsInvokeCheck):
     81        (WebCore::JSTestCallbackInterface::callbackWithThisObject):
     82        * bindings/scripts/test/JS/JSTestVoidCallbackFunction.cpp:
     83        (WebCore::JSTestVoidCallbackFunction::handleEvent):
     84        * bridge/NP_jsobject.cpp:
     85        * bridge/objc/WebScriptObject.mm:
     86        (-[WebScriptObject callWebScriptMethod:withArguments:]):
     87        * html/HTMLMediaElement.cpp:
     88        (WebCore::HTMLMediaElement::updateCaptionContainer):
     89        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
     90        (WebCore::HTMLMediaElement::updateMediaControlsAfterPresentationModeChange):
     91        (WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):
     92        * html/HTMLPlugInImageElement.cpp:
     93        (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):
     94        * testing/Internals.cpp:
     95        (WebCore::Internals::cloneArrayBuffer):
     96
    1972017-11-01  Andy Estes  <aestes@apple.com>
    298

  • trunk/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm

    r223476 r224309  
    206206    argList.append(toJS<IDLSequence<IDLNullable<IDLDOMString>>>(*exec, *globalObject, m_names));
    207207    argList.append(toJS<IDLSequence<IDLNullable<IDLDOMString>>>(*exec, *globalObject, m_values));
     208    ASSERT(!argList.hasOverflowed());
    208209    JSC::JSValue replacement = call(exec, replacementObject, callType, callData, globalObject, argList);
    209210    if (UNLIKELY(scope.exception())) {

  • trunk/Source/WebCore/bindings/js/JSCustomElementInterface.cpp

    r223728 r224309  
    11/*
    22 * Copyright (C) 2013 Google Inc. All rights reserved.
    3  * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
     3 * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
    44 *
    55 * Redistribution and use in source and binary forms, with or without
    … …  
    128128    InspectorInstrumentationCookie cookie = JSMainThreadExecState::instrumentFunctionConstruct(&document, constructType, constructData);
    129129    MarkedArgumentBuffer args;
     130    ASSERT(!args.hasOverflowed());
    130131    JSValue newElement = construct(&state, constructor, constructType, constructData, args);
    131132    InspectorInstrumentation::didCallFunction(cookie, &document);
    … …  
    199200
    200201    MarkedArgumentBuffer args;
     202    ASSERT(!args.hasOverflowed());
    201203    InspectorInstrumentationCookie cookie = JSMainThreadExecState::instrumentFunctionConstruct(context, constructType, constructData);
    202204    JSValue returnedElement = construct(state, m_constructor.get(), constructType, constructData, args);
    … …  
    246248    MarkedArgumentBuffer args;
    247249    addArguments(state, globalObject, args);
     250    RELEASE_ASSERT(!args.hasOverflowed());
    248251
    249252    InspectorInstrumentationCookie cookie = JSMainThreadExecState::instrumentFunctionCall(context, callType, callData);

  • trunk/Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp

    r223728 r224309  
    8888    MarkedArgumentBuffer args;
    8989    args.append(jsStringWithCache(exec, prefix));
     90    ASSERT(!args.hasOverflowed());
    9091
    9192    NakedPtr<JSC::Exception> exception;

  • trunk/Source/WebCore/bindings/js/JSDOMBuiltinConstructorBase.cpp

    r223476 r224309  
    11/*
    22 *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2004-2011, 2013, 2016 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2004-2017 Apple Inc. All rights reserved.
    44 *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
    55 *  Copyright (C) 2013 Michael Pruett <michael@68k.org>
    … …  
    3131void JSDOMBuiltinConstructorBase::callFunctionWithCurrentArguments(JSC::ExecState& state, JSC::JSObject& thisObject, JSC::JSFunction& function)
    3232{
     33    JSC::VM& vm = state.vm();
     34    auto scope = DECLARE_THROW_SCOPE(vm);
    3335    JSC::CallData callData;
    3436    JSC::CallType callType = JSC::getCallData(&function, callData);
    … …  
    3840    for (unsigned i = 0; i < state.argumentCount(); ++i)
    3941        arguments.append(state.uncheckedArgument(i));
     42    if (UNLIKELY(arguments.hasOverflowed())) {
     43        throwOutOfMemoryError(&state, scope);
     44        return;
     45    }
    4046    JSC::call(&state, &function, callType, callData, &thisObject, arguments);
    4147}

  • trunk/Source/WebCore/bindings/js/JSDOMConvertSequences.h

    r218342 r224309  
    11/*
    2  * Copyright (C) 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    379379    static JSC::JSValue convert(JSC::ExecState& exec, JSDOMGlobalObject& globalObject, const Vector<U, inlineCapacity>& vector)
    380380    {
     381        JSC::VM& vm = exec.vm();
     382        auto scope = DECLARE_THROW_SCOPE(vm);
    381383        JSC::MarkedArgumentBuffer list;
    382384        for (auto& element : vector)
    383385            list.append(toJS<T>(exec, globalObject, element));
     386        if (UNLIKELY(list.hasOverflowed())) {
     387            throwOutOfMemoryError(&exec, scope);
     388            return { };
     389        }
    384390        return JSC::constructArray(&exec, nullptr, &globalObject, list);
    385391    }
    … …  
    407413    static JSC::JSValue convert(JSC::ExecState& exec, JSDOMGlobalObject& globalObject, const Vector<U, inlineCapacity>& vector)
    408414    {
     415        JSC::VM& vm = exec.vm();
     416        auto scope = DECLARE_THROW_SCOPE(vm);
    409417        JSC::MarkedArgumentBuffer list;
    410418        for (auto& element : vector)
    411419            list.append(toJS<T>(exec, globalObject, element));
     420        if (UNLIKELY(list.hasOverflowed())) {
     421            throwOutOfMemoryError(&exec, scope);
     422            return { };
     423        }
    412424        auto* array = JSC::constructArray(&exec, nullptr, &globalObject, list);
    413425        return JSC::objectConstructorFreeze(&exec, array);

  • trunk/Source/WebCore/bindings/js/JSDOMConvertWebGL.cpp

    r223476 r224309  
    9292            for (auto& value : values)
    9393                list.append(jsBoolean(value));
     94            RELEASE_ASSERT(!list.hasOverflowed());
    9495            return constructArray(&state, 0, &globalObject, list);
    9596        },
    … …  
    9899            for (auto& value : values)
    99100                list.append(jsNumber(value));
     101            RELEASE_ASSERT(!list.hasOverflowed());
    100102            return constructArray(&state, 0, &globalObject, list);
    101103        },

  • trunk/Source/WebCore/bindings/js/JSDOMIterator.h

    r218755 r224309  
    11/*
    22 * Copyright (C) 2016 Canon, Inc. All rights reserved.
    3  * Copyright (C) 2016 Apple Inc. All rights reserved.
     3 * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
    44 *
    55 * Redistribution and use in source and binary forms, with or without
    … …  
    128128    arguments.append(value1);
    129129    arguments.append(value2);
     130    ASSERT(!arguments.hasOverflowed());
    130131    return constructArray(&state, nullptr, &globalObject, arguments);
    131132}
    … …  
    215216        appendForEachArguments<JSIterator>(state, *thisObject.globalObject(), arguments, value);
    216217        arguments.append(&thisObject);
     218        if (UNLIKELY(arguments.hasOverflowed())) {
     219            throwOutOfMemoryError(&state, scope);
     220            return { };
     221        }
    217222        JSC::call(&state, callback, callType, callData, thisValue, arguments);
    218223        if (UNLIKELY(scope.exception()))

  • trunk/Source/WebCore/bindings/js/JSDOMMapLike.cpp

    r222473 r224309  
    7474    for (size_t cptr = 0; cptr < state.argumentCount(); ++cptr)
    7575        arguments.append(state.uncheckedArgument(cptr));
     76    ASSERT(!arguments.hasOverflowed());
    7677    return JSC::call(&state, function, callType, callData, &backingMap, arguments);
    7778}
    … …  
    9091    for (size_t cptr = 0; cptr < state.argumentCount(); ++cptr)
    9192        arguments.append(state.uncheckedArgument(cptr));
     93    ASSERT(!arguments.hasOverflowed());
    9294    return JSC::call(&state, function, callType, callData, &mapLike, arguments);
    9395}

  • trunk/Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp

    r223476 r224309  
    5858    MarkedArgumentBuffer arguments;
    5959    arguments.append(resolution);
     60    ASSERT(!arguments.hasOverflowed());
    6061
    6162    call(&exec, function, callType, callData, jsUndefined(), arguments);
    … …  
    207208    MarkedArgumentBuffer arguments;
    208209    arguments.append(rejectionValue);
     210    ASSERT(!arguments.hasOverflowed());
    209211
    210212    return JSValue::encode(call(&state, rejectFunction, callType, callData, promiseConstructor, arguments));

  • trunk/Source/WebCore/bindings/js/JSErrorHandler.cpp

    r223728 r224309  
    11/*
    22 * Copyright (C) 2010 Google Inc. All rights reserved.
    3  * Copyright (C) 2013 Apple Inc. All rights reserved.
     3 * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
    44 *
    55 * Redistribution and use in source and binary forms, with or without
    … …  
    9191        args.append(toJS<IDLUnsignedLong>(errorEvent.colno()));
    9292        args.append(errorEvent.error(*exec, *globalObject));
     93        ASSERT(!args.hasOverflowed());
    9394
    9495        VM& vm = globalObject->vm();

  • trunk/Source/WebCore/bindings/js/JSEventListener.cpp

    r223728 r224309  
    139139        MarkedArgumentBuffer args;
    140140        args.append(toJS(exec, globalObject, &event));
     141        ASSERT(!args.hasOverflowed());
    141142
    142143        Event* savedEvent = globalObject->currentEvent();

  • trunk/Source/WebCore/bindings/js/JSLazyEventListener.cpp

    r224290 r224309  
    113113    args.append(jsNontrivialString(exec, m_eventParameterName));
    114114    args.append(jsStringWithCache(exec, m_code));
     115    ASSERT(!args.hasOverflowed());
    115116
    116117    // We want all errors to refer back to the line on which our attribute was

  • trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp

    r223746 r224309  
    152152    for (size_t i = 0; i < argumentCount; i++)
    153153        argumentList.append(exec->argument(i));
     154    ASSERT(!argumentList.hasOverflowed());
    154155
    155156    CallData callData;

  • trunk/Source/WebCore/bindings/js/JSReadableStreamPrivateConstructors.cpp

    r223476 r224309  
    11/*
    22 *  Copyright (C) 2015 Canon Inc. All rights reserved.
    3  *  Copyright (C) 2016 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2016-2017 Apple Inc. All rights reserved.
    44 *
    55 *  This library is free software; you can redistribute it and/or
    … …  
    7575    MarkedArgumentBuffer args;
    7676    args.append(exec.argument(0));
     77    ASSERT(!args.hasOverflowed());
    7778    return JSValue::encode(JSC::construct(&exec, constructor, constructType, constructData, args));
    7879}

  • trunk/Source/WebCore/bindings/js/ReadableStream.cpp

    r223476 r224309  
    5252    MarkedArgumentBuffer args;
    5353    args.append(source ? toJSNewlyCreated(&execState, &globalObject, source.releaseNonNull()) : JSC::jsUndefined());
     54    ASSERT(!args.hasOverflowed());
    5455
    5556    auto newReadableStream = jsDynamicDowncast<JSReadableStream*>(vm, JSC::construct(&execState, constructor, constructType, constructData, args));
    … …  
    8485    arguments.append(readableStream());
    8586    arguments.append(toJS(&state, m_globalObject.get(), sink));
     87    ASSERT(!arguments.hasOverflowed());
    8688    ReadableStreamInternal::callFunction(state, readableStreamPipeTo, JSC::jsUndefined(), arguments);
    8789}
    … …  
    99101    arguments.append(readableStream());
    100102    arguments.append(JSC::jsBoolean(true));
     103    ASSERT(!arguments.hasOverflowed());
    101104    auto returnedValue = ReadableStreamInternal::callFunction(state, readableStreamTee, JSC::jsUndefined(), arguments);
    102105
    … …  
    123126    MarkedArgumentBuffer args;
    124127    args.append(readableStream());
     128    ASSERT(!args.hasOverflowed());
    125129
    126130    JSC::construct(&state, constructor, constructType, constructData, args);
    … …  
    135139    JSC::MarkedArgumentBuffer arguments;
    136140    arguments.append(readableStream);
     141    ASSERT(!arguments.hasOverflowed());
    137142    return ReadableStreamInternal::callFunction(state, function, JSC::jsUndefined(), arguments).isTrue();
    138143}

  • trunk/Source/WebCore/bindings/js/ReadableStreamDefaultController.cpp

    r221704 r224309  
    6666    JSC::MarkedArgumentBuffer arguments;
    6767    arguments.append(parameter);
     68    ASSERT(!arguments.hasOverflowed());
    6869
    6970    return callFunction(state, function, &object, arguments);

  • trunk/Source/WebCore/bindings/js/ScheduledAction.cpp

    r223728 r224309  
    22 *  Copyright (C) 2000 Harri Porten (porten@kde.org)
    33 *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
    4  *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
     4 *  Copyright (C) 2003-2017 Apple Inc. All rights reseved.
    55 *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
    66 *  Copyright (C) 2009 Google Inc. All rights reseved.
    … …  
    9393{
    9494    ASSERT(m_function);
    95     JSLockHolder lock(context.vm());
     95    VM& vm = context.vm();
     96    JSLockHolder lock(vm);
     97    auto scope = DECLARE_THROW_SCOPE(vm);
    9698
    9799    CallData callData;
    … …  
    105107    for (auto& argument : m_arguments)
    106108        arguments.append(argument.get());
     109    if (UNLIKELY(arguments.hasOverflowed())) {
     110        throwOutOfMemoryError(exec, scope);
     111        NakedPtr<JSC::Exception> exception = scope.exception();
     112        reportException(exec, exception);
     113        return;
     114    }
    107115
    108116    InspectorInstrumentationCookie cookie = JSMainThreadExecState::instrumentFunctionCall(&context, callType, callData);

  • trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp

    r223905 r224309  
    667667    {
    668668        m_objectPool.add(object, m_objectPool.size());
    669         m_gcBuffer.append(object);
     669        m_gcBuffer.appendWithCrashOnOverflow(object);
    670670    }
    671671
    … …  
    15901590                    break;
    15911591                JSMapIterator* iterator = JSMapIterator::create(vm, vm.mapIteratorStructure.get(), inMap, IterateKeyValue);
    1592                 m_gcBuffer.append(inMap);
    1593                 m_gcBuffer.append(iterator);
     1592                m_gcBuffer.appendWithCrashOnOverflow(inMap);
     1593                m_gcBuffer.appendWithCrashOnOverflow(iterator);
    15941594                mapIteratorStack.append(iterator);
    15951595                inputObjectStack.append(inMap);
    … …  
    16111611                }
    16121612                inValue = key;
    1613                 m_gcBuffer.append(value);
     1613                m_gcBuffer.appendWithCrashOnOverflow(value);
    16141614                mapIteratorValueStack.append(value);
    16151615                stateStack.append(MapDataEndVisitKey);
    … …  
    16341634                    break;
    16351635                JSSetIterator* iterator = JSSetIterator::create(vm, vm.setIteratorStructure.get(), inSet, IterateKey);
    1636                 m_gcBuffer.append(inSet);
    1637                 m_gcBuffer.append(iterator);
     1636                m_gcBuffer.appendWithCrashOnOverflow(inSet);
     1637                m_gcBuffer.appendWithCrashOnOverflow(iterator);
    16381638                setIteratorStack.append(iterator);
    16391639                inputObjectStack.append(inSet);
    … …  
    26522652            BooleanObject* obj = BooleanObject::create(m_exec->vm(), m_globalObject->booleanObjectStructure());
    26532653            obj->setInternalValue(m_exec->vm(), jsBoolean(false));
    2654             m_gcBuffer.append(obj);
     2654            m_gcBuffer.appendWithCrashOnOverflow(obj);
    26552655            return obj;
    26562656        }
    … …  
    26582658            BooleanObject* obj = BooleanObject::create(m_exec->vm(), m_globalObject->booleanObjectStructure());
    26592659            obj->setInternalValue(m_exec->vm(), jsBoolean(true));
    2660              m_gcBuffer.append(obj);
     2660            m_gcBuffer.appendWithCrashOnOverflow(obj);
    26612661            return obj;
    26622662        }
    … …  
    26722672                return JSValue();
    26732673            NumberObject* obj = constructNumber(m_exec, m_globalObject, jsNumber(d));
    2674             m_gcBuffer.append(obj);
     2674            m_gcBuffer.appendWithCrashOnOverflow(obj);
    26752675            return obj;
    26762676        }
    … …  
    27642764                return JSValue();
    27652765            StringObject* obj = constructString(m_exec->vm(), m_globalObject, cachedString->jsString(m_exec));
    2766             m_gcBuffer.append(obj);
     2766            m_gcBuffer.appendWithCrashOnOverflow(obj);
    27672767            return obj;
    27682768        }
    … …  
    27702770            VM& vm = m_exec->vm();
    27712771            StringObject* obj = constructString(vm, m_globalObject, jsEmptyString(&vm));
    2772             m_gcBuffer.append(obj);
     2772            m_gcBuffer.appendWithCrashOnOverflow(obj);
    27732773            return obj;
    27742774        }
    … …  
    28172817            // not trow.
    28182818            scope.releaseAssertNoException();
    2819             m_gcBuffer.append(result);
     2819            m_gcBuffer.appendWithCrashOnOverflow(result);
    28202820            return result;
    28212821        }
    … …  
    28352835            }
    28362836            JSValue result = JSArrayBuffer::create(m_exec->vm(), structure, WTFMove(arrayBuffer));
    2837             m_gcBuffer.append(result);
     2837            m_gcBuffer.appendWithCrashOnOverflow(result);
    28382838            return result;
    28392839        }
    … …  
    28622862            RefPtr<ArrayBuffer> buffer = ArrayBuffer::create(WTFMove(m_sharedBuffers->at(index)));
    28632863            JSValue result = getJSValue(buffer.get());
    2864             m_gcBuffer.append(result);
     2864            m_gcBuffer.appendWithCrashOnOverflow(result);
    28652865            return result;
    28662866        }
    … …  
    28712871                return JSValue();
    28722872            }
    2873             m_gcBuffer.append(arrayBufferView);
     2873            m_gcBuffer.appendWithCrashOnOverflow(arrayBufferView);
    28742874            return arrayBufferView;
    28752875        }
    … …  
    28972897                return JSValue();
    28982898            }
    2899             m_gcBuffer.append(cryptoKey);
     2899            m_gcBuffer.appendWithCrashOnOverflow(cryptoKey);
    29002900            return cryptoKey;
    29012901        }
    … …  
    29852985            if (UNLIKELY(scope.exception()))
    29862986                goto error;
    2987             m_gcBuffer.append(outArray);
     2987            m_gcBuffer.appendWithCrashOnOverflow(outArray);
    29882988            outputObjectStack.append(outArray);
    29892989        }
    … …  
    30263026                return std::make_pair(JSValue(), SerializationReturnCode::StackOverflowError);
    30273027            JSObject* outObject = constructEmptyObject(m_exec, m_globalObject->objectPrototype());
    3028             m_gcBuffer.append(outObject);
     3028            m_gcBuffer.appendWithCrashOnOverflow(outObject);
    30293029            outputObjectStack.append(outObject);
    30303030        }
    … …  
    30633063            if (UNLIKELY(scope.exception()))
    30643064                goto error;
    3065             m_gcBuffer.append(map);
     3065            m_gcBuffer.appendWithCrashOnOverflow(map);
    30663066            outputObjectStack.append(map);
    30673067            mapStack.append(map);
    … …  
    30943094            if (UNLIKELY(scope.exception()))
    30953095                goto error;
    3096             m_gcBuffer.append(set);
     3096            m_gcBuffer.appendWithCrashOnOverflow(set);
    30973097            outputObjectStack.append(set);
    30983098            setStack.append(set);

  • trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

    r223930 r224309  
    60416041                push(@$contentRef, "    args.append(" . NativeToJSValueUsingReferences($argument, $interfaceOrCallback, $argument->name, "globalObject") . ");\n");
    60426042            }
     6043            push(@$contentRef, "    ASSERT(!args.hasOverflowed());\n");
    60436044
    60446045            push(@$contentRef, "\n    NakedPtr<JSC::Exception> returnedException;\n");

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCallbackFunction.cpp

    r223476 r224309  
    6666    MarkedArgumentBuffer args;
    6767    args.append(toJS<IDLLong>(argument));
     68    ASSERT(!args.hasOverflowed());
    6869
    6970    NakedPtr<JSC::Exception> returnedException;

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCallbackFunctionRethrow.cpp

    r223476 r224309  
    6969    MarkedArgumentBuffer args;
    7070    args.append(toJS<IDLSequence<IDLLong>>(state, globalObject, argument));
     71    ASSERT(!args.hasOverflowed());
    7172
    7273    NakedPtr<JSC::Exception> returnedException;

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCallbackFunctionWithThisObject.cpp

    r223476 r224309  
    6969    MarkedArgumentBuffer args;
    7070    args.append(toJS<IDLSequence<IDLInterface<TestNode>>>(state, globalObject, parameter));
     71    ASSERT(!args.hasOverflowed());
    7172
    7273    NakedPtr<JSC::Exception> returnedException;

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCallbackFunctionWithTypedefs.cpp

    r223476 r224309  
    7070    args.append(toJS<IDLSequence<IDLNullable<IDLLong>>>(state, globalObject, sequenceArg));
    7171    args.append(toJS<IDLLong>(longArg));
     72    ASSERT(!args.hasOverflowed());
    7273
    7374    NakedPtr<JSC::Exception> returnedException;

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCallbackInterface.cpp

    r223476 r224309  
    175175    JSValue thisValue = jsUndefined();
    176176    MarkedArgumentBuffer args;
     177    ASSERT(!args.hasOverflowed());
    177178
    178179    NakedPtr<JSC::Exception> returnedException;
    … …  
    201202    MarkedArgumentBuffer args;
    202203    args.append(toJS<IDLFloat32Array>(state, globalObject, arrayParam));
     204    ASSERT(!args.hasOverflowed());
    203205
    204206    NakedPtr<JSC::Exception> returnedException;
    … …  
    228230    args.append(toJS<IDLSerializedScriptValue<SerializedScriptValue>>(state, globalObject, srzParam));
    229231    args.append(toJS<IDLDOMString>(state, strParam));
     232    ASSERT(!args.hasOverflowed());
    230233
    231234    NakedPtr<JSC::Exception> returnedException;
    … …  
    254257    MarkedArgumentBuffer args;
    255258    args.append(toJS<IDLInterface<DOMStringList>>(state, globalObject, listParam));
     259    ASSERT(!args.hasOverflowed());
    256260
    257261    NakedPtr<JSC::Exception> returnedException;
    … …  
    280284    MarkedArgumentBuffer args;
    281285    args.append(toJS<IDLBoolean>(boolParam));
     286    ASSERT(!args.hasOverflowed());
    282287
    283288    NakedPtr<JSC::Exception> returnedException;
    … …  
    307312    args.append(toJS<IDLLong>(longParam));
    308313    args.append(toJS<IDLInterface<TestNode>>(state, globalObject, testNodeParam));
     314    ASSERT(!args.hasOverflowed());
    309315
    310316    NakedPtr<JSC::Exception> returnedException;
    … …  
    332338    JSValue thisValue = jsUndefined();
    333339    MarkedArgumentBuffer args;
     340    ASSERT(!args.hasOverflowed());
    334341
    335342    NakedPtr<JSC::Exception> returnedException;
    … …  
    361368    MarkedArgumentBuffer args;
    362369    args.append(toJS<IDLEnumeration<TestCallbackInterface::Enum>>(state, enumParam));
     370    ASSERT(!args.hasOverflowed());
    363371
    364372    NakedPtr<JSC::Exception> returnedException;
    … …  
    388396    MarkedArgumentBuffer args;
    389397    args.append(toJS<IDLDictionary<TestCallbackInterface::Dictionary>>(state, globalObject, dictionaryParam));
     398    ASSERT(!args.hasOverflowed());
    390399
    391400    NakedPtr<JSC::Exception> returnedException;
    … …  
    417426    MarkedArgumentBuffer args;
    418427    args.append(toJS<IDLInterface<TestObj>>(state, globalObject, testObjParam));
     428    ASSERT(!args.hasOverflowed());
    419429
    420430    NakedPtr<JSC::Exception> returnedException;

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestVoidCallbackFunction.cpp

    r223476 r224309  
    8181    args.append(toJS<IDLLong>(longParam));
    8282    args.append(toJS<IDLInterface<TestNode>>(state, globalObject, testNodeParam));
     83    ASSERT(!args.hasOverflowed());
    8384
    8485    NakedPtr<JSC::Exception> returnedException;

  • trunk/Source/WebCore/bridge/NP_jsobject.cpp

    r223476 r224309  
    11/*
    2  * Copyright (C) 2004, 2006 Apple Inc.  All rights reserved.
     2 * Copyright (C) 2004-2017 Apple Inc.  All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    196196        MarkedArgumentBuffer argList;
    197197        getListFromVariantArgs(exec, args, argCount, rootObject, argList);
     198        RELEASE_ASSERT(!argList.hasOverflowed());
    198199        JSValue resultV = JSC::call(exec, function, callType, callData, function, argList);
    199200
    … …  
    248249        MarkedArgumentBuffer argList;
    249250        getListFromVariantArgs(exec, args, argCount, rootObject, argList);
     251        RELEASE_ASSERT(!argList.hasOverflowed());
    250252        JSValue resultV = JSC::call(exec, function, callType, callData, obj->imp, argList);
    251253
    … …  
    537539        MarkedArgumentBuffer argList;
    538540        getListFromVariantArgs(exec, args, argCount, rootObject, argList);
     541        RELEASE_ASSERT(!argList.hasOverflowed());
    539542        JSValue resultV = JSC::construct(exec, constructor, constructType, constructData, argList);
    540543       

  • trunk/Source/WebCore/bridge/objc/WebScriptObject.mm

    r221822 r224309  
    11/*
    2  * Copyright (C) 2004, 2006, 2007, 2008, 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    352352
    353353    MarkedArgumentBuffer argList;
     354    ASSERT(!argList.hasOverflowed());
    354355    getListFromNSArray(exec, args, [self _rootObject], argList);
    355356

  • trunk/Source/WebCore/html/HTMLMediaElement.cpp

    r224085 r224309  
    42784278
    42794279    JSC::MarkedArgumentBuffer noArguments;
     4280    ASSERT(!noArguments.hasOverflowed());
    42804281    JSC::call(exec, methodObject, callType, callData, controllerObject, noArguments);
    42814282    scope.clearException();
    … …  
    70737074    argList.append(mediaJSWrapper);
    70747075    argList.append(mediaControlsHostJSWrapper);
     7076    ASSERT(!argList.hasOverflowed());
    70757077
    70767078    JSC::JSObject* function = functionValue.toObject(exec);
    … …  
    71667168
    71677169    JSC::MarkedArgumentBuffer argList;
     7170    ASSERT(!argList.hasOverflowed());
    71687171    JSC::call(exec, function, callType, callData, controllerObject, argList);
    71697172}
    … …  
    72057208    JSC::CallType callType = function->methodTable(vm)->getCallData(function, callData);
    72067209    JSC::MarkedArgumentBuffer argList;
     7210    ASSERT(!argList.hasOverflowed());
    72077211    if (callType == JSC::CallType::None)
    72087212        return emptyString();

  • trunk/Source/WebCore/html/HTMLPlugInImageElement.cpp

    r223644 r224309  
    378378    // If no snapshot was found then we want the overlay to be visible.
    379379    argList.append(toJS<IDLBoolean>(!m_snapshotImage));
     380    ASSERT(!argList.hasOverflowed());
    380381
    381382    // It is expected the JS file provides a createOverlay(shadowRoot, title, subtitle) function.

  • trunk/Source/WebCore/testing/Internals.cpp

    r224260 r224309  
    38483848    arguments.append(srcByteOffset);
    38493849    arguments.append(srcLength);
     3850    ASSERT(!arguments.hasOverflowed());
    38503851
    38513852    return JSC::call(&state, function, callType, callData, JSC::jsUndefined(), arguments);
Note: See TracChangeset for help on using the changeset viewer.