Changeset 245152 in webkit

Timestamp:

May 9, 2019 12:40:42 PM (5 years ago)

Author:

keith_miller@apple.com

Message:

parseStatementListItem needs a stack overflow check
​https://bugs.webkit.org/show_bug.cgi?id=197749
JSTests:

Reviewed by Saam Barati.

• stress/many-nested-functions-parser-stack-overflow.js: Added.

Source/JavaScriptCore:

<rdar://problem/50302697>

Reviewed by Saam Barati.

There currently exists a path in the parser where you can loop
arbibrarily many times without a stack overflow check. This patch
adds a check to parseStatementListItem to break that cycle.

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parseStatementListItem):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/many-nested-functions-parser-stack-overflow.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/parser/Parser.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-05-09  Keith Miller  <keith_miller@apple.com>
+
+        parseStatementListItem needs a stack overflow check
+        https://bugs.webkit.org/show_bug.cgi?id=197749
+
+        Reviewed by Saam Barati.
+
+        * stress/many-nested-functions-parser-stack-overflow.js: Added.
+
 2019-05-08  Saam barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-05-09  Keith Miller  <keith_miller@apple.com>
+
+        parseStatementListItem needs a stack overflow check
+        https://bugs.webkit.org/show_bug.cgi?id=197749
+        <rdar://problem/50302697>
+
+        Reviewed by Saam Barati.
+
+        There currently exists a path in the parser where you can loop
+        arbibrarily many times without a stack overflow check. This patch
+        adds a check to parseStatementListItem to break that cycle.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parseStatementListItem):
+
 2019-05-09  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/parser/Parser.cpp

@@ -653 +653 @@
     DepthManager statementDepth(&m_statementDepth);
     m_statementDepth++;
+    failIfStackOverflow();
     TreeStatement result = 0;
     bool shouldSetEndOffset = true;