REGRESSION (r179357-r179359): WebContent Crash using AOL Mail @ com.apple.JavascriptC...
authormsaboff@apple.com <msaboff@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 24 Oct 2015 01:45:30 +0000 (01:45 +0000)
committermsaboff@apple.com <msaboff@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 24 Oct 2015 01:45:30 +0000 (01:45 +0000)
https://bugs.webkit.org/show_bug.cgi?id=150513

Reviewed by Saam Barati.

Source/JavaScriptCore:

Add check in linkPolymorphicCall() to make sure we have a CodeBlock for the newly added variant.
If not, we turn the call into a virtual call.

The bug was caused by a stack overflow when preparing the function for execution.  This properly
threw an exception, however linkPolymorphicCall() didn't check for this error case.

Added a new test function "failNextNewCodeBlock()" to test tools to simplify the testing.

* API/JSCTestRunnerUtils.cpp:
(JSC::failNextNewCodeBlock):
(JSC::numberOfDFGCompiles):
* API/JSCTestRunnerUtils.h:
* jit/Repatch.cpp:
(JSC::linkPolymorphicCall):
* jsc.cpp:
(GlobalObject::finishCreation):
(functionTransferArrayBuffer):
(functionFailNextNewCodeBlock):
(functionQuit):
* runtime/Executable.cpp:
(JSC::ScriptExecutable::prepareForExecutionImpl):
* runtime/TestRunnerUtils.cpp:
(JSC::optimizeNextInvocation):
(JSC::failNextNewCodeBlock):
(JSC::numberOfDFGCompiles):
* runtime/TestRunnerUtils.h:
* runtime/VM.h:
(JSC::VM::setFailNextNewCodeBlock):
(JSC::VM::getAndClearFailNextNewCodeBlock):
(JSC::VM::stackPointerAtVMEntry):

Tools:

Added a new test function, failNextNewCodeBlock() to simplify the writing of a regression test.

* DumpRenderTree/TestRunner.cpp:
(simulateWebNotificationClickCallback):
(failNextCodeBlock):
(numberOfDFGCompiles):
(TestRunner::staticFunctions):
* WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::TestRunner::setBlockAllPlugins):
(WTR::TestRunner::failNextCodeBlock):
(WTR::TestRunner::numberOfDFGCompiles):
* WebKitTestRunner/InjectedBundle/TestRunner.h:

LayoutTests:

New regression test.

* js/regress-150513-expected.txt: Added.
* js/regress-150513.html: Added.
* js/script-tests/regress-150513.js: Added.
(test):
* resources/standalone-pre.js: Added failNextNewCodeBlock to testRunner object.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@191530 268f45cc-cd09-0410-ab3c-d52691b4dbfc

19 files changed:
LayoutTests/ChangeLog
LayoutTests/js/regress-150513-expected.txt [new file with mode: 0644]
LayoutTests/js/regress-150513.html [new file with mode: 0644]
LayoutTests/js/script-tests/regress-150513.js [new file with mode: 0644]
LayoutTests/resources/standalone-pre.js
Source/JavaScriptCore/API/JSCTestRunnerUtils.cpp
Source/JavaScriptCore/API/JSCTestRunnerUtils.h
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/jit/Repatch.cpp
Source/JavaScriptCore/jsc.cpp
Source/JavaScriptCore/runtime/Executable.cpp
Source/JavaScriptCore/runtime/TestRunnerUtils.cpp
Source/JavaScriptCore/runtime/TestRunnerUtils.h
Source/JavaScriptCore/runtime/VM.h
Tools/ChangeLog
Tools/DumpRenderTree/TestRunner.cpp
Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl
Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
Tools/WebKitTestRunner/InjectedBundle/TestRunner.h

index 4c3d5c6..2d9aa00 100644 (file)
@@ -1,3 +1,18 @@
+2015-10-23  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r179357-r179359): WebContent Crash using AOL Mail @ com.apple.JavascriptCore JSC::linkPolymorphicCall(JSC::ExecState*, JSC::CallLinkInfo&, JSC::CallVariant, JSC::RegisterPreservationMode) + 1584
+        https://bugs.webkit.org/show_bug.cgi?id=150513
+
+        Reviewed by Saam Barati.
+
+        New regression test.
+
+        * js/regress-150513-expected.txt: Added.
+        * js/regress-150513.html: Added.
+        * js/script-tests/regress-150513.js: Added.
+        (test):
+        * resources/standalone-pre.js: Added failNextNewCodeBlock to testRunner object.
+
 2015-10-23  Ryan Haddad  <ryanhaddad@apple.com>
 
         Removing [ Release ] flag from flaky imported blink tests that are timing out in debug too
diff --git a/LayoutTests/js/regress-150513-expected.txt b/LayoutTests/js/regress-150513-expected.txt
new file mode 100644 (file)
index 0000000..4cde5aa
--- /dev/null
@@ -0,0 +1,10 @@
+Regression test for https://webkit.org/b/150513.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS Didn't crash when calling a virtual JavaScript function that doesn't have a CodeBlock.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress-150513.html b/LayoutTests/js/regress-150513.html
new file mode 100644 (file)
index 0000000..abb8b8f
--- /dev/null
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/regress-150513.js"></script>
+<script src="../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/js/script-tests/regress-150513.js b/LayoutTests/js/script-tests/regress-150513.js
new file mode 100644 (file)
index 0000000..2124ad2
--- /dev/null
@@ -0,0 +1,38 @@
+description("Regression test for https://webkit.org/b/150513.");
+
+// This test verifies that we can properly handle calling a virtual JavaScript
+// function that fails during CodeBlock generation.
+
+var functions = [];
+
+function init()
+{
+    functions.push(new Function("a", "return a"));
+    functions.push(new Function("a", "return a"));
+    functions.push(new Function("a", "return a"));
+}
+
+function test()
+{
+    for (var i = 0; i < 100000; i++) {
+        var f;
+        if (i % 1000 == 999) {
+            testRunner.failNextNewCodeBlock();
+            f = functions[2];
+        } else
+            f = functions[i % 2];
+
+        try {
+            var result = f(1);
+            if (result != 1)
+                testFailed("Wrong result, expected 1, got " + result);
+        } catch (e) {
+        }
+    }
+}
+
+init();
+
+test();
+
+testPassed("Didn't crash when calling a virtual JavaScript function that doesn't have a CodeBlock.");
index 7846b4a..468c6d4 100644 (file)
@@ -4,7 +4,8 @@ var self = this;
 
 self.testRunner = {
     neverInlineFunction: neverInlineFunction,
-    numberOfDFGCompiles: numberOfDFGCompiles
+    numberOfDFGCompiles: numberOfDFGCompiles,
+    failNextNewCodeBlock: failNextNewCodeBlock
 };
 
 var silentTestPass, didPassSomeTestsSilently, didFailSomeTests, successfullyParsed;
index b73e338..d314c5d 100644 (file)
 
 namespace JSC {
 
+
+JSValueRef failNextNewCodeBlock(JSContextRef context)
+{
+    ExecState* exec= toJS(context);
+    JSLockHolder holder(exec);
+    return toRef(exec, failNextNewCodeBlock(exec));
+}
+
 JSValueRef numberOfDFGCompiles(JSContextRef context, JSValueRef theFunctionValueRef)
 {
     ExecState* exec= toJS(context);
index b762cd7..c52da52 100644 (file)
@@ -31,6 +31,7 @@
 
 namespace JSC {
 
+JS_EXPORT_PRIVATE JSValueRef failNextNewCodeBlock(JSContextRef);
 JS_EXPORT_PRIVATE JSValueRef numberOfDFGCompiles(JSContextRef, JSValueRef theFunction);
 JS_EXPORT_PRIVATE JSValueRef setNeverInline(JSContextRef, JSValueRef theFunction);
 JS_EXPORT_PRIVATE JSValueRef setNeverOptimize(JSContextRef, JSValueRef theFunction);
index 036be79..435b915 100644 (file)
@@ -1,3 +1,41 @@
+2015-10-23  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r179357-r179359): WebContent Crash using AOL Mail @ com.apple.JavascriptCore JSC::linkPolymorphicCall(JSC::ExecState*, JSC::CallLinkInfo&, JSC::CallVariant, JSC::RegisterPreservationMode) + 1584
+        https://bugs.webkit.org/show_bug.cgi?id=150513
+
+        Reviewed by Saam Barati.
+
+        Add check in linkPolymorphicCall() to make sure we have a CodeBlock for the newly added variant.
+        If not, we turn the call into a virtual call.
+
+        The bug was caused by a stack overflow when preparing the function for execution.  This properly
+        threw an exception, however linkPolymorphicCall() didn't check for this error case.
+
+        Added a new test function "failNextNewCodeBlock()" to test tools to simplify the testing.
+
+        * API/JSCTestRunnerUtils.cpp:
+        (JSC::failNextNewCodeBlock):
+        (JSC::numberOfDFGCompiles):
+        * API/JSCTestRunnerUtils.h:
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionTransferArrayBuffer):
+        (functionFailNextNewCodeBlock):
+        (functionQuit):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::optimizeNextInvocation):
+        (JSC::failNextNewCodeBlock):
+        (JSC::numberOfDFGCompiles):
+        * runtime/TestRunnerUtils.h:
+        * runtime/VM.h:
+        (JSC::VM::setFailNextNewCodeBlock):
+        (JSC::VM::getAndClearFailNextNewCodeBlock):
+        (JSC::VM::stackPointerAtVMEntry):
+
 2015-10-23  Commit Queue  <commit-queue@webkit.org>
 
         Unreviewed, rolling out r191500.
index e0ac36e..d1bf35d 100644 (file)
@@ -682,9 +682,9 @@ void linkPolymorphicCall(
             else
 #endif
                 codeBlock = jsCast<FunctionExecutable*>(executable)->codeBlockForCall();
-            // If we cannot handle a callee, assume that it's better for this whole thing to be a
-            // virtual call.
-            if (exec->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()) || callLinkInfo.isVarargs()) {
+            // If we cannot handle a callee, either because we don't have a CodeBlock or because arity mismatch,
+            // assume that it's better for this whole thing to be a virtual call.
+            if (!codeBlock || exec->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()) || callLinkInfo.isVarargs()) {
                 linkVirtualFor(exec, callLinkInfo);
                 return;
             }
index 5728f00..d2cd986 100644 (file)
@@ -526,6 +526,7 @@ static EncodedJSValue JSC_HOST_CALL functionOptimizeNextInvocation(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionNumberOfDFGCompiles(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionReoptimizationRetryCount(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionTransferArrayBuffer(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionFailNextNewCodeBlock(ExecState*);
 static NO_RETURN_WITH_VALUE EncodedJSValue JSC_HOST_CALL functionQuit(ExecState*);
 static NO_RETURN_DUE_TO_CRASH EncodedJSValue JSC_HOST_CALL functionAbort(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionFalse1(ExecState*);
@@ -687,6 +688,7 @@ protected:
         addFunction(vm, "optimizeNextInvocation", functionOptimizeNextInvocation, 1);
         addFunction(vm, "reoptimizationRetryCount", functionReoptimizationRetryCount, 1);
         addFunction(vm, "transferArrayBuffer", functionTransferArrayBuffer, 1);
+        addFunction(vm, "failNextNewCodeBlock", functionFailNextNewCodeBlock, 1);
 #if ENABLE(SAMPLING_FLAGS)
         addFunction(vm, "setSamplingFlags", functionSetSamplingFlags, 1);
         addFunction(vm, "clearSamplingFlags", functionClearSamplingFlags, 1);
@@ -1375,6 +1377,12 @@ EncodedJSValue JSC_HOST_CALL functionTransferArrayBuffer(ExecState* exec)
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL functionFailNextNewCodeBlock(ExecState* exec)
+{
+    exec->vm().setFailNextNewCodeBlock();
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL functionQuit(ExecState*)
 {
     jscExit(EXIT_SUCCESS);
index aaf85c4..8365292 100644 (file)
@@ -387,7 +387,10 @@ JSObject* ScriptExecutable::prepareForExecutionImpl(
 {
     VM& vm = exec->vm();
     DeferGC deferGC(vm.heap);
-    
+
+    if (vm.getAndClearFailNextNewCodeBlock())
+        return createError(exec->callerFrame(), ASCIILiteral("Forced Failure"));
+
     JSObject* exception = 0;
     CodeBlock* codeBlock = newCodeBlockFor(kind, function, scope, exception);
     if (!codeBlock) {
index ce958dc..d13090f 100644 (file)
@@ -103,6 +103,13 @@ JSValue optimizeNextInvocation(JSValue theFunctionValue)
     return jsUndefined();
 }
 
+JSValue failNextNewCodeBlock(ExecState* exec)
+{
+    exec->vm().setFailNextNewCodeBlock();
+
+    return jsUndefined();
+}
+
 JSValue numberOfDFGCompiles(ExecState* exec)
 {
     if (exec->argumentCount() < 1)
index 3ef7dd0..b8dfaea 100644 (file)
@@ -41,6 +41,7 @@ JS_EXPORT_PRIVATE JSValue setNeverInline(JSValue function);
 JS_EXPORT_PRIVATE JSValue setNeverOptimize(JSValue function);
 JS_EXPORT_PRIVATE JSValue optimizeNextInvocation(JSValue function);
 
+JS_EXPORT_PRIVATE JSValue failNextNewCodeBlock(ExecState*);
 JS_EXPORT_PRIVATE JSValue numberOfDFGCompiles(ExecState*);
 JS_EXPORT_PRIVATE JSValue setNeverInline(ExecState*);
 JS_EXPORT_PRIVATE JSValue setNeverOptimize(ExecState*);
index 38b6f43..e4ccd7e 100644 (file)
@@ -426,6 +426,14 @@ public:
     JS_EXPORT_PRIVATE JSValue throwException(ExecState*, JSValue);
     JS_EXPORT_PRIVATE JSObject* throwException(ExecState*, JSObject*);
 
+    void setFailNextNewCodeBlock() { m_failNextNewCodeBlock = true; }
+    bool getAndClearFailNextNewCodeBlock()
+    {
+        bool result = m_failNextNewCodeBlock;
+        m_failNextNewCodeBlock = false;
+        return result;
+    }
+    
     void* stackPointerAtVMEntry() const { return m_stackPointerAtVMEntry; }
     void setStackPointerAtVMEntry(void*);
 
@@ -624,6 +632,7 @@ private:
     void* m_lastStackTop;
     Exception* m_exception { nullptr };
     Exception* m_lastException { nullptr };
+    bool m_failNextNewCodeBlock { false };
     bool m_inDefineOwnProperty;
     std::unique_ptr<CodeCache> m_codeCache;
     LegacyProfiler* m_enabledProfiler;
index 31f1da9..19072ba 100644 (file)
@@ -1,3 +1,24 @@
+2015-10-23  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r179357-r179359): WebContent Crash using AOL Mail @ com.apple.JavascriptCore JSC::linkPolymorphicCall(JSC::ExecState*, JSC::CallLinkInfo&, JSC::CallVariant, JSC::RegisterPreservationMode) + 1584
+        https://bugs.webkit.org/show_bug.cgi?id=150513
+
+        Reviewed by Saam Barati.
+
+        Added a new test function, failNextNewCodeBlock() to simplify the writing of a regression test.
+
+        * DumpRenderTree/TestRunner.cpp:
+        (simulateWebNotificationClickCallback):
+        (failNextCodeBlock):
+        (numberOfDFGCompiles):
+        (TestRunner::staticFunctions):
+        * WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
+        * WebKitTestRunner/InjectedBundle/TestRunner.cpp:
+        (WTR::TestRunner::setBlockAllPlugins):
+        (WTR::TestRunner::failNextCodeBlock):
+        (WTR::TestRunner::numberOfDFGCompiles):
+        * WebKitTestRunner/InjectedBundle/TestRunner.h:
+
 2015-10-23  Anders Carlsson  <andersca@apple.com>
 
         Simplify the WebKitLegacy menu conversion code
index 814fda4..b5270dc 100644 (file)
@@ -1933,11 +1933,16 @@ static JSValueRef simulateWebNotificationClickCallback(JSContextRef context, JSO
     return JSValueMakeUndefined(context);
 }
 
-static JSValueRef numberOfDFGCompiles(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+static JSValueRef failNextNewCodeBlock(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     if (argumentCount < 1)
         return JSValueMakeUndefined(context);
     
+    return JSC::failNextNewCodeBlock(context);
+}
+
+static JSValueRef numberOfDFGCompiles(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
     return JSC::numberOfDFGCompiles(context, arguments[0]);
 }
 
@@ -2149,6 +2154,7 @@ JSStaticFunction* TestRunner::staticFunctions()
         { "denyWebNotificationPermission", denyWebNotificationPermissionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "removeAllWebNotificationPermissions", removeAllWebNotificationPermissionsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "simulateWebNotificationClick", simulateWebNotificationClickCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "failNextNewCodeBlock", failNextNewCodeBlock, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "numberOfDFGCompiles", numberOfDFGCompiles, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "neverInlineFunction", neverInlineFunction, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { 0, 0, 0 }
index 345527d..52eae35 100644 (file)
@@ -205,6 +205,7 @@ interface TestRunner {
     void setBlockAllPlugins(boolean shouldBlock);
     
     // Hooks to the JSC compiler.
+    object failNextNewCodeBlock();
     object numberOfDFGCompiles(object function);
     object neverInlineFunction(object function);
 
index 61c302e..c80f88e 100644 (file)
@@ -861,6 +861,13 @@ void TestRunner::setBlockAllPlugins(bool shouldBlock)
     WKBundlePagePostMessage(InjectedBundle::singleton().page()->page(), messageName.get(), messageBody.get());
 }
 
+JSValueRef TestRunner::failNextNewCodeBlock()
+{
+    WKBundleFrameRef mainFrame = WKBundlePageGetMainFrame(InjectedBundle::singleton().page()->page());
+    JSContextRef context = WKBundleFrameGetJavaScriptContext(mainFrame);
+    return JSC::failNextNewCodeBlock(context);
+}
+
 JSValueRef TestRunner::numberOfDFGCompiles(JSValueRef theFunction)
 {
     WKBundleFrameRef mainFrame = WKBundlePageGetMainFrame(InjectedBundle::singleton().page()->page());
index c330da1..d904736 100644 (file)
@@ -280,6 +280,7 @@ public:
 
     bool secureEventInputIsEnabled() const;
     
+    JSValueRef failNextNewCodeBlock();
     JSValueRef numberOfDFGCompiles(JSValueRef theFunction);
     JSValueRef neverInlineFunction(JSValueRef theFunction);