Attachment 357483 Details for Bug 192779 – proposed patch.

[patch] proposed patch.

bug-192779.patch (text/plain), 3.37 KB, created by Mark Lam on 2018-12-17 15:08:21 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Lam

Created: 2018-12-17 15:08:21 PST

Size: 3.37 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 239291)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2018-12-17  Mark Lam  <mark.lam@apple.com>
>+
>+        SamplingProfiler's isValidFramePointer() should reject address at stack origin.
>+        https://bugs.webkit.org/show_bug.cgi?id=192779
>+        <rdar://problem/46775869>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.
>+
> 2018-12-17  Mark Lam  <mark.lam@apple.com>
> 
>         Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
>Index: JSTests/stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js
>===================================================================
>--- JSTests/stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js	(nonexistent)
>+++ JSTests/stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js	(working copy)
>@@ -0,0 +1,24 @@
>+//@ requireOptions("--useSamplingProfiler=true", "--useProbeOSRExit=true", "--useObjectAllocationSinking=false", "--sampleInterval=10")
>+
>+function foo(ranges) {
>+    const CHUNK_SIZE = 95;
>+    for (const [start, end] of ranges) {
>+        const codePoints = [];
>+        for (let length = 0, codePoint = start; codePoint <= end; codePoint++) {
>+            codePoints[length++] = codePoint;
>+            if (length === CHUNK_SIZE) {
>+                length = 0;
>+                codePoints.length = 0;
>+                String.fromCodePoint(...[]);
>+            }
>+        }
>+        String.fromCodePoint(...codePoints);
>+    }
>+}
>+
>+for (let i=0; i<3; i++) {
>+    let x = foo([
>+        [ 0, 10000 ],
>+        [ 68000, 1114111 ]
>+    ]);
>+}
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 239290)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,18 @@
>+2018-12-17  Mark Lam  <mark.lam@apple.com>
>+
>+        SamplingProfiler's isValidFramePointer() should reject address at stack origin.
>+        https://bugs.webkit.org/show_bug.cgi?id=192779
>+        <rdar://problem/46775869>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        isValidFramePointer() was previously treating the address at StackBounds::origin()
>+        as valid stack memory.  This is not true.  StackBounds::origin() is actually the
>+        first address beyond valid stack memory. This is now fixed.
>+
>+        * runtime/SamplingProfiler.cpp:
>+        (JSC::FrameWalker::isValidFramePointer):
>+
> 2018-12-17  Mark Lam  <mark.lam@apple.com>
> 
>         Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
>Index: Source/JavaScriptCore/runtime/SamplingProfiler.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/SamplingProfiler.cpp	(revision 239290)
>+++ Source/JavaScriptCore/runtime/SamplingProfiler.cpp	(working copy)
>@@ -172,7 +172,8 @@ protected:
>             uint8_t* stackLimit = static_cast<uint8_t*>(thread->stack().end());
>             RELEASE_ASSERT(stackBase);
>             RELEASE_ASSERT(stackLimit);
>-            if (fpCast <= stackBase && fpCast >= stackLimit)
>+            RELEASE_ASSERT(stackLimit <= stackBase);
>+            if (fpCast < stackBase && fpCast >= stackLimit)
>                 return true;
>         }
>         return false;

Actions: View | Formatted Diff | Diff

Attachments on bug 192779: 357483