SamplingProfiler::stackTracesAsJSON() should escape strings.

https://bugs.webkit.org/show_bug.cgi?id=194649
<rdar://problem/48072386>

Reviewed by Saam Barati.

JSTests:

* stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js: Added.
* stress/type-profiler-with-double-quote-in-constructor-name.js: Added.
* stress/type-profiler-with-double-quote-in-field-name.js: Added.
* stress/type-profiler-with-double-quote-in-optional-field-name.js: Added.

Source/JavaScriptCore:

Ditto for TypeSet::toJSONString() and TypeSet::toJSONString().

* runtime/SamplingProfiler.cpp:
(JSC::SamplingProfiler::stackTracesAsJSON):
* runtime/TypeSet.cpp:
(JSC::TypeSet::toJSONString const):
(JSC::StructureShape::toJSONString const):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@241615 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index 05fdb76..0ae0702 100644 (file)
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,3 +1,16 @@
+2019-02-15  Mark Lam  <mark.lam@apple.com>
+
+        SamplingProfiler::stackTracesAsJSON() should escape strings.
+        https://bugs.webkit.org/show_bug.cgi?id=194649
+        <rdar://problem/48072386>
+
+        Reviewed by Saam Barati.
+
+        * stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js: Added.
+        * stress/type-profiler-with-double-quote-in-constructor-name.js: Added.
+        * stress/type-profiler-with-double-quote-in-field-name.js: Added.
+        * stress/type-profiler-with-double-quote-in-optional-field-name.js: Added.
+
 2019-02-15  Robin Morisset  <rmorisset@apple.com>
         CodeBlock::jettison should clear related watchpoints
         https://bugs.webkit.org/show_bug.cgi?id=194544

diff --git a/JSTests/stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js b/JSTests/stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js
new file mode 100644 (file)
index 0000000..67bc1d9
--- /dev/null
+++ b/JSTests/stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js
@@ -0,0 +1,20 @@
+//@ runDefault("--useConcurrentJIT=false")
+
+function foo() {
+    let obj = {};                                                                
+    for (let i = 0; i < 10; ++i)                                      
+          obj[i + 'p'] = i;                                              
+}
+noInline(foo);
+
+function test() {
+    for (let i = 0; i < 1000; ++i) {
+        foo();
+        let stacktraces = samplingProfilerStackTraces();
+        for (let stackTrace of stacktraces) { }
+    }
+}
+
+startSamplingProfiler();
+foo.displayName = '"';
+test();

diff --git a/JSTests/stress/type-profiler-with-double-quote-in-constructor-name.js b/JSTests/stress/type-profiler-with-double-quote-in-constructor-name.js
new file mode 100644 (file)
index 0000000..f0fa3f7
--- /dev/null
+++ b/JSTests/stress/type-profiler-with-double-quote-in-constructor-name.js
@@ -0,0 +1,17 @@
+//@ runDefault("--useTypeProfiler=true")
+
+var findTypeForExpression = $vm.findTypeForExpression;
+
+function wrapper(x) {
+    class Base {
+        constructor() { }
+    };
+
+    var baseInstance = new Base;
+    Base.displayName = '"';
+}
+wrapper();
+
+var types = findTypeForExpression(wrapper, "baseInstance = new Base");
+JSON.stringify(types)
+

diff --git a/JSTests/stress/type-profiler-with-double-quote-in-field-name.js b/JSTests/stress/type-profiler-with-double-quote-in-field-name.js
new file mode 100644 (file)
index 0000000..327e4b5
--- /dev/null
+++ b/JSTests/stress/type-profiler-with-double-quote-in-field-name.js
@@ -0,0 +1,17 @@
+//@ runDefault("--useTypeProfiler=true")
+
+var findTypeForExpression = $vm.findTypeForExpression;
+
+function wrapper(x) {
+    class Base {
+        constructor() {
+            this['"'] = true;
+        }
+    };
+
+    var baseInstance = new Base;
+}
+wrapper();
+
+var types = findTypeForExpression(wrapper, "baseInstance = new Base");
+JSON.stringify(types)

diff --git a/JSTests/stress/type-profiler-with-double-quote-in-optional-field-name.js b/JSTests/stress/type-profiler-with-double-quote-in-optional-field-name.js
new file mode 100644 (file)
index 0000000..942e28e
--- /dev/null
+++ b/JSTests/stress/type-profiler-with-double-quote-in-optional-field-name.js
@@ -0,0 +1,23 @@
+//@ runDefault("--useTypeProfiler=true")
+
+var findTypeForExpression = $vm.findTypeForExpression;
+
+function wrapper() {
+    var x;
+    var Proto = function() {};
+    var oldProto;
+    for (var i = 0; i < 100; i++) {
+        // Make sure we get a new prototype chain on each assignment to x because objects with shared prototype chains will be merged.
+        x = new Proto;
+        x['"' + i + '"'] = 20;
+        x = x
+        oldProto = Proto;
+        Proto = function() {};
+        Proto.prototype.__proto__ = oldProto.prototype;
+    }
+    x = {};
+}
+wrapper();
+
+var types = findTypeForExpression(wrapper, "x;"); 
+JSON.stringify(types);

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 10c35f5..b45a448 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,19 @@
+2019-02-15  Mark Lam  <mark.lam@apple.com>
+
+        SamplingProfiler::stackTracesAsJSON() should escape strings.
+        https://bugs.webkit.org/show_bug.cgi?id=194649
+        <rdar://problem/48072386>
+
+        Reviewed by Saam Barati.
+
+        Ditto for TypeSet::toJSONString() and TypeSet::toJSONString().
+
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::stackTracesAsJSON):
+        * runtime/TypeSet.cpp:
+        (JSC::TypeSet::toJSONString const):
+        (JSC::StructureShape::toJSONString const):
+
 2019-02-15  Robin Morisset  <rmorisset@apple.com>
 
         CodeBlock::jettison should clear related watchpoints

diff --git a/Source/JavaScriptCore/runtime/SamplingProfiler.cpp b/Source/JavaScriptCore/runtime/SamplingProfiler.cpp
index 6307303..4588df5 100644 (file)
--- a/Source/JavaScriptCore/runtime/SamplingProfiler.cpp
+++ b/Source/JavaScriptCore/runtime/SamplingProfiler.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2016-2018 Apple Inc. All rights reserved.
+ * Copyright (C) 2016-2019 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -904,9 +904,7 @@ String SamplingProfiler::stackTracesAsJSON()
         loopedOnce = false;
         for (StackFrame& stackFrame : stackTrace.frames) {
             comma();
-            json.append('"');
-            json.append(stackFrame.displayNameForJSONTests(m_vm));
-            json.append('"');
+            json.appendQuotedJSONString(stackFrame.displayNameForJSONTests(m_vm));
             loopedOnce = true;
         }
         json.append(']');

diff --git a/Source/JavaScriptCore/runtime/TypeSet.cpp b/Source/JavaScriptCore/runtime/TypeSet.cpp
index ae3102e..cafe4a5 100644 (file)
--- a/Source/JavaScriptCore/runtime/TypeSet.cpp
+++ b/Source/JavaScriptCore/runtime/TypeSet.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014, 2015 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2014-2019 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -253,9 +253,7 @@ String TypeSet::toJSONString() const
     json.append('{');
 
     json.appendLiteral("\"displayTypeName\":");
-    json.append('"');
-    json.append(displayName());
-    json.append('"');
+    json.appendQuotedJSONString(displayName());
     json.append(',');
 
     json.appendLiteral("\"primitiveTypeNames\":");
@@ -442,9 +440,7 @@ String StructureShape::toJSONString() const
     json.append('{');
 
     json.appendLiteral("\"constructorName\":");
-    json.append('"');
-    json.append(m_constructorName);
-    json.append('"');
+    json.appendQuotedJSONString(m_constructorName);
     json.append(',');
 
     json.appendLiteral("\"isInDictionaryMode\":");
@@ -463,9 +459,7 @@ String StructureShape::toJSONString() const
         hasAnItem = true;
 
         String fieldName((*it).get());
-        json.append('"');
-        json.append(fieldName);
-        json.append('"');
+        json.appendQuotedJSONString(fieldName);
     }
     json.append(']');
     json.append(',');
@@ -479,9 +473,7 @@ String StructureShape::toJSONString() const
         hasAnItem = true;
 
         String fieldName((*it).get());
-        json.append('"');
-        json.append(fieldName);
-        json.append('"');
+        json.appendQuotedJSONString(fieldName);
     }
     json.append(']');
     json.append(',');