Attachment 357831 Details for Bug 192939 – proposed patch.

[patch] proposed patch.

bug-192939.patch (text/plain), 3.75 KB, created by Mark Lam on 2018-12-20 10:40:58 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Lam

Created: 2018-12-20 10:40:58 PST

Size: 3.75 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 239453)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2018-12-20  Mark Lam  <mark.lam@apple.com>
>+
>+        Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck.
>+        https://bugs.webkit.org/show_bug.cgi?id=192939
>+        <rdar://problem/46869516>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js: Added.
>+
> 2018-12-20  Tadeu Zagallo  <tzagallo@apple.com>
> 
>         WTF::String and StringImpl overflow MaxLength
>Index: JSTests/stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js
>===================================================================
>--- JSTests/stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js	(nonexistent)
>+++ JSTests/stress/stack-overflow-frame-for-construct-arityCheck-should-use-construct-codeBlock.js	(working copy)
>@@ -0,0 +1,27 @@
>+//@ requireOptions("--maxPerThreadStackUsage=1572864")
>+
>+function foo(a, b, c) {
>+    try {
>+        throw new Error();
>+    } catch {
>+        hello();
>+    }
>+};
>+
>+function Bar(d, e) {
>+    hello();
>+}
>+
>+function hello(f) {
>+    new Bar(0);
>+};
>+
>+var exception;
>+try {
>+    foo();
>+} catch(e) {
>+    exception = e;
>+}
>+
>+if (exception != "RangeError: Maximum call stack size exceeded.")
>+    throw "FAILED";
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 239451)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2018-12-20  Mark Lam  <mark.lam@apple.com>
>+
>+        Fix a typo in slow_path_construct_arityCheck and operationConstructArityCheck.
>+        https://bugs.webkit.org/show_bug.cgi?id=192939
>+        <rdar://problem/46869516>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * jit/JITOperations.cpp:
>+        * runtime/CommonSlowPaths.cpp:
>+
> 2018-12-20  Caio Lima  <ticaiolima@gmail.com>
> 
>         [BigInt] We should enable CSE into arithmetic operations that speculate BigIntUse
>Index: Source/JavaScriptCore/jit/JITOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.cpp	(revision 239443)
>+++ Source/JavaScriptCore/jit/JITOperations.cpp	(working copy)
>@@ -130,7 +130,7 @@ int32_t JIT_OPERATION operationConstruct
> 
>     int32_t missingArgCount = CommonSlowPaths::arityCheckFor(exec, *vm, CodeForConstruct);
>     if (UNLIKELY(missingArgCount < 0)) {
>-        CodeBlock* codeBlock = CommonSlowPaths::codeBlockFromCallFrameCallee(exec, CodeForCall);
>+        CodeBlock* codeBlock = CommonSlowPaths::codeBlockFromCallFrameCallee(exec, CodeForConstruct);
>         exec->convertToStackOverflowFrame(*vm, codeBlock);
>         NativeCallFrameTracer tracer(vm, exec);
>         throwStackOverflowError(vm->topCallFrame, scope);
>Index: Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/CommonSlowPaths.cpp	(revision 239443)
>+++ Source/JavaScriptCore/runtime/CommonSlowPaths.cpp	(working copy)
>@@ -194,7 +194,7 @@ SLOW_PATH_DECL(slow_path_construct_arity
>     BEGIN();
>     int slotsToAdd = CommonSlowPaths::arityCheckFor(exec, vm, CodeForConstruct);
>     if (UNLIKELY(slotsToAdd < 0)) {
>-        CodeBlock* codeBlock = CommonSlowPaths::codeBlockFromCallFrameCallee(exec, CodeForCall);
>+        CodeBlock* codeBlock = CommonSlowPaths::codeBlockFromCallFrameCallee(exec, CodeForConstruct);
>         exec->convertToStackOverflowFrame(vm, codeBlock);
>         NativeCallFrameTracer tracer(&vm, exec);
>         ErrorHandlingScope errorScope(vm);

Flags:

keith_miller: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 192939: 357831