Attachment #256484 for bug #146767

View Details Raw Unified Return to Bug 146767



2015-07-09  Michael Saboff  <msaboff@apple.com>

        REGRESSION (r180248): Repro Crash: com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::createRangeError + 20
        https://bugs.webkit.org/show_bug.cgi?id=146767

        Reviewed by NOBODY (OOPS!).

        If the stack check fails at the top most frame, we must use that frame to
        generate the exception.  Reverted the code to always use the current frame to
        throw an out of stack exception.

        * llint/LLIntSlowPaths.cpp:
        (JSC::LLInt::LLINT_SLOW_PATH_DECL):

2015-07-08  Joseph Pecoraro  <pecoraro@apple.com>

        Fix grammar issue in TypeError attempting to change an unconfigurable property



#endif

#endif
    // This stack check is done in the prologue for a function call, and the
    // CallFrame is not completely set up yet. For example, if the frame needs
    // a lexical environment object, the lexical environment object will only be
    // set up after we start executing the function. If we need to throw a
    // StackOverflowError here, then we need to tell the prologue to start the
    // stack unwinding from the caller frame (which is fully set up) instead.
    // To do that, we return the caller's CallFrame in the second return value.
    //
    // If the stack check succeeds and we don't need to throw the error, then
    // we'll return 0 instead. The prologue will check for a non-zero value
    // when determining whether to set the callFrame or not.

        LLINT_RETURN_TWO(pc, 0);
#endif

    exec = exec->callerFrame(vm.topVMEntryFrame);
    vm.topCallFrame = exec;
    ErrorHandlingScope errorScope(vm);
    CommonSlowPaths::interpreterThrowInCaller(exec, createStackOverflowError(exec));



2015-07-09  Michael Saboff  <msaboff@apple.com>

        REGRESSION (r180248): Repro Crash: com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::createRangeError + 20
        https://bugs.webkit.org/show_bug.cgi?id=146767

        Reviewed by NOBODY (OOPS!).

        New test that generates a call to a function that involves creating a huge
        object literal that exceeds the available stack space.

        * http/tests/misc/large-js-program-expected.txt: Added.
        * http/tests/misc/large-js-program.php: Added.

2015-07-09  Chris Fleizach  <cfleizach@apple.com>

        AX: VoiceOver cannot get to any content in Yahoo Mail messages table

Line 0 LayoutTests/http/tests/misc/large-js-program-expected.txt_sec1
- LayoutTests/http/tests/misc/large-js-program-expected.txt +5 lines
	1	CONSOLE MESSAGE: line 27: RangeError: Maximum call stack size exceeded.
	2	This tests verifies that a large program doesn't crash JavaScript.
	3
	4	This test should generate an out of stack exception, but have no other output.
	5



<html>
<head>
<script>
if (window.testRunner)
    testRunner.dumpAsText();
</script>
</head>
<body>
<h1>This tests verifies that a large program doesn&#39;t crash JavaScript.</h1>
<p>This test should generate an out of stack exception, but have no other output.
<br>
<pre id="console"></pre>
<script src="/js-test-resources/js-test-pre.js"></script>
<script>
function print(m)
{
    document.getElementById("console").innerHTML += m + "<br>";
}

function foo(o)
{
    // We should not get to this code, we should throw an out of stack exception calling foo().
    testFailed("We should never get here!");
}


foo({"x": 1,
     "a": [
<?php
for ($i = 0; $i < 1000000; $i++) {
    if ($i != 0)
        echo ",\n";
    echo "[0, $i]";
}
?>
]});
</script>
</body>
</html>

Return to Bug 146767

Lines 468-481 LLINT_SLOW_PATH_DECL(stack_check) Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec1
- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp -9 lines
468	#endif	468	#endif
469		469
470	#endif	470	#endif
471	// This stack check is done in the prologue for a function call, and the
472	// CallFrame is not completely set up yet. For example, if the frame needs
473	// a lexical environment object, the lexical environment object will only be
474	// set up after we start executing the function. If we need to throw a
475	// StackOverflowError here, then we need to tell the prologue to start the
476	// stack unwinding from the caller frame (which is fully set up) instead.
477	// To do that, we return the caller's CallFrame in the second return value.
478	//
479	// If the stack check succeeds and we don't need to throw the error, then	471	// If the stack check succeeds and we don't need to throw the error, then
480	// we'll return 0 instead. The prologue will check for a non-zero value	472	// we'll return 0 instead. The prologue will check for a non-zero value
481	// when determining whether to set the callFrame or not.	473	// when determining whether to set the callFrame or not.
Lines 489-495 LLINT_SLOW_PATH_DECL(stack_check) Source/JavaScriptCore/llint/LLIntSlowPaths.cpp_sec2
489	LLINT_RETURN_TWO(pc, 0);	481	LLINT_RETURN_TWO(pc, 0);
490	#endif	482	#endif
491		483
492	exec = exec->callerFrame(vm.topVMEntryFrame);
493	vm.topCallFrame = exec;	484	vm.topCallFrame = exec;
494	ErrorHandlingScope errorScope(vm);	485	ErrorHandlingScope errorScope(vm);
495	CommonSlowPaths::interpreterThrowInCaller(exec, createStackOverflowError(exec));	486	CommonSlowPaths::interpreterThrowInCaller(exec, createStackOverflowError(exec));

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +14 lines
		1	2015-07-09 Michael Saboff <msaboff@apple.com>
		2
		3	REGRESSION (r180248): Repro Crash: com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::createRangeError + 20
		4	https://bugs.webkit.org/show_bug.cgi?id=146767
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	If the stack check fails at the top most frame, we must use that frame to
		9	generate the exception. Reverted the code to always use the current frame to
		10	throw an out of stack exception.
		11
		12	* llint/LLIntSlowPaths.cpp:
		13	(JSC::LLInt::LLINT_SLOW_PATH_DECL):
		14
1	2015-07-08 Joseph Pecoraro <pecoraro@apple.com>	15	2015-07-08 Joseph Pecoraro <pecoraro@apple.com>
2		16
3	Fix grammar issue in TypeError attempting to change an unconfigurable property	17	Fix grammar issue in TypeError attempting to change an unconfigurable property

Lines 1-3 LayoutTests/ChangeLog_sec1
- LayoutTests/ChangeLog +13 lines
		1	2015-07-09 Michael Saboff <msaboff@apple.com>
		2
		3	REGRESSION (r180248): Repro Crash: com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::createRangeError + 20
		4	https://bugs.webkit.org/show_bug.cgi?id=146767
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	New test that generates a call to a function that involves creating a huge
		9	object literal that exceeds the available stack space.
		10
		11	* http/tests/misc/large-js-program-expected.txt: Added.
		12	* http/tests/misc/large-js-program.php: Added.
		13
1	2015-07-09 Chris Fleizach <cfleizach@apple.com>	14	2015-07-09 Chris Fleizach <cfleizach@apple.com>
2		15
3	AX: VoiceOver cannot get to any content in Yahoo Mail messages table	16	AX: VoiceOver cannot get to any content in Yahoo Mail messages table

Line 0 LayoutTests/http/tests/misc/large-js-program.php_sec1
- LayoutTests/http/tests/misc/large-js-program.php +39 lines
	1	<html>
	2	<head>
	3	<script>
	4	if (window.testRunner)
	5	testRunner.dumpAsText();
	6	</script>
	7	</head>
	8	<body>
	9	<h1>This tests verifies that a large program doesn't crash JavaScript.</h1>
	10	<p>This test should generate an out of stack exception, but have no other output.
	11	<br>
	12	<pre id="console"></pre>
	13	<script src="/js-test-resources/js-test-pre.js"></script>
	14	<script>
	15	function print(m)
	16	{
	17	document.getElementById("console").innerHTML += m + "<br>";
	18	}
	19
	20	function foo(o)
	21	{
	22	// We should not get to this code, we should throw an out of stack exception calling foo().
	23	testFailed("We should never get here!");
	24	}
	25
	26
	27	foo({"x": 1,
	28	"a": [
	29	<?php
	30	for ($i = 0; $i < 1000000; $i++) {
	31	if ($i != 0)
	32	echo ",\n";
	33	echo "[0, $i]";
	34	}
	35	?>
	36	]});
	37	</script>
	38	</body>
	39	</html>