Changeset 247194 in webkit

Timestamp:

Jul 6, 2019 6:34:51 AM (5 years ago)

Author:

msaboff@apple.com

Message:

switch(String) needs to check for exceptions when resolving the string
​https://bugs.webkit.org/show_bug.cgi?id=199541

Reviewed by Mark Lam.

JSTests:

New tests.

• stress/switch-string-oom.js: Added.

(test):
(testLowerTiers):
(testFTL):

Source/JavaScriptCore:

Added exception checks for resolved Strings in switch processing for all tiers.

• dfg/DFGOperations.cpp:
• jit/JITOperations.cpp:
• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/switch-string-oom.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (3 diffs)
• Source/JavaScriptCore/jit/JITOperations.cpp (modified) (2 diffs)
• Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-07-06  Michael Saboff  <msaboff@apple.com>
+
+        switch(String) needs to check for exceptions when resolving the string
+        https://bugs.webkit.org/show_bug.cgi?id=199541
+
+        Reviewed by Mark Lam.
+
+        New tests.
+
+        * stress/switch-string-oom.js: Added.
+        (test):
+        (testLowerTiers):
+        (testFTL):
+
 2019-07-05  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-07-06  Michael Saboff  <msaboff@apple.com>
+
+        switch(String) needs to check for exceptions when resolving the string
+        https://bugs.webkit.org/show_bug.cgi?id=199541
+
+        Reviewed by Mark Lam.
+
+        Added exception checks for resolved Strings in switch processing for all tiers.
+
+        * dfg/DFGOperations.cpp:
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+
 2019-07-05  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -2447 +2447 @@
     VM& vm = exec->vm();
     NativeCallFrameTracer tracer(&vm, exec);
-
     CodeBlock* codeBlock = exec->codeBlock();
     SimpleJumpTable& table = codeBlock->switchJumpTable(tableIndex);
@@ -2463 +2462 @@
     VM& vm = exec->vm();
     NativeCallFrameTracer tracer(&vm, exec);
-
-    return exec->codeBlock()->stringSwitchJumpTable(tableIndex).ctiForValue(string->value(exec).impl()).executableAddress<char*>();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    StringImpl* strImpl = string->value(exec).impl();
+
+    RETURN_IF_EXCEPTION(throwScope, nullptr);
+
+    return exec->codeBlock()->stringSwitchJumpTable(tableIndex).ctiForValue(strImpl).executableAddress<char*>();
 }
 
@@ -2471 +2475 @@
     VM& vm = exec->vm();
     NativeCallFrameTracer tracer(&vm, exec);
-
-    return exec->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(string->value(exec).impl(), std::numeric_limits<int32_t>::min());
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
+    StringImpl* strImpl = string->value(exec).impl();
+
+    RETURN_IF_EXCEPTION(throwScope, 0);
+
+    return exec->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(strImpl, std::numeric_limits<int32_t>::min());
 }
 

trunk/Source/JavaScriptCore/jit/JITOperations.cpp

@@ -2313 +2313 @@
     JSValue key = JSValue::decode(encodedKey);
     CodeBlock* codeBlock = exec->codeBlock();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
 
     void* result;
@@ -2319 +2320 @@
     if (key.isString()) {
         StringImpl* value = asString(key)->value(exec).impl();
+
+        RETURN_IF_EXCEPTION(throwScope, nullptr);
+
         result = jumpTable.ctiForValue(value).executableAddress();
     } else

trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

@@ -1318 +1318 @@
         JUMP_TO(defaultOffset);
     else {
+        StringImpl* scrutineeStringImpl = asString(scrutinee)->value(exec).impl();
+
+        LLINT_CHECK_EXCEPTION();
+
         CodeBlock* codeBlock = exec->codeBlock();
-        JUMP_TO(codeBlock->stringSwitchJumpTable(bytecode.m_tableIndex).offsetForValue(asString(scrutinee)->value(exec).impl(), defaultOffset));
+
+        JUMP_TO(codeBlock->stringSwitchJumpTable(bytecode.m_tableIndex).offsetForValue(scrutineeStringImpl, defaultOffset));
     }
     LLINT_END();