JavaScriptCore:

        Reviewed by Geoff.

        - fix http://bugs.webkit.org/show_bug.cgi?id=15618
          <rdar://problem/5619353> REGRESSION: Stack overflow/crash in KJS::equal (15618)

        Test: fast/js/recursion-limit-equal.html

        * kjs/operations.cpp: (KJS::equal): Check the exception from toPrimitive.

LayoutTests:

        Reviewed by Geoff.

        - test for http://bugs.webkit.org/show_bug.cgi?id=15618
          <rdar://problem/5619353> REGRESSION: Stack overflow/crash in KJS::equal (15618)

        * fast/js/recursion-limit-equal-expected.txt: Added.
        * fast/js/recursion-limit-equal.html: Added.
        * fast/js/resources/recursion-limit-equal.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@28370 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 57263ef0feb0076ab253872f2b65488dd54f8509..9e3b87265b535b61e19164dd096ad88ce08a701f 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,14 @@
+2007-12-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=15618
+          <rdar://problem/5619353> REGRESSION: Stack overflow/crash in KJS::equal (15618)
+
+        Test: fast/js/recursion-limit-equal.html
+
+        * kjs/operations.cpp: (KJS::equal): Check the exception from toPrimitive.
+
 2007-12-03  Dan Bernstein  <mitz@apple.com>
 
         - fix a copy-and-paste-o

diff --git a/JavaScriptCore/kjs/operations.cpp b/JavaScriptCore/kjs/operations.cpp
index 85332a4340d7c3d32fb74466551d865e3a2579bd..3d1ab581c55b345a55213afbb2df82bead6562a2 100644 (file)
--- a/JavaScriptCore/kjs/operations.cpp
+++ b/JavaScriptCore/kjs/operations.cpp
@@ -58,12 +58,20 @@ bool equal(ExecState *exec, JSValue *v1, JSValue *v2)
             t1 = NumberType;
             // use toNumber
         else {
-            if ((t1 == StringType || t1 == NumberType) && t2 >= ObjectType)
-                return equal(exec, v1, v2->toPrimitive(exec));
+            if ((t1 == StringType || t1 == NumberType) && t2 == ObjectType) {
+                v2 = v2->toPrimitive(exec);
+                if (exec->hadException())
+                    return false;
+                return equal(exec, v1, v2);
+            }
             if (t1 == NullType && t2 == ObjectType)
                 return static_cast<JSObject *>(v2)->masqueradeAsUndefined();
-            if (t1 >= ObjectType && (t2 == StringType || t2 == NumberType))
-                return equal(exec, v1->toPrimitive(exec), v2);
+            if (t1 == ObjectType && (t2 == StringType || t2 == NumberType)) {
+                v1 = v1->toPrimitive(exec);
+                if (exec->hadException())
+                    return false;
+                return equal(exec, v1, v2);
+            }
             if (t1 == ObjectType && t2 == NullType)
                 return static_cast<JSObject *>(v1)->masqueradeAsUndefined();
             if (t1 != t2)

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 8241fb2dacdea6961bc830acc30cf0b7fa21a544..c417949f71071212ded710bac3852c80119dd845 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2007-12-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - test for http://bugs.webkit.org/show_bug.cgi?id=15618
+          <rdar://problem/5619353> REGRESSION: Stack overflow/crash in KJS::equal (15618)
+
+        * fast/js/recursion-limit-equal-expected.txt: Added.
+        * fast/js/recursion-limit-equal.html: Added.
+        * fast/js/resources/recursion-limit-equal.js: Added.
+
 2007-12-03  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.

diff --git a/LayoutTests/fast/js/recursion-limit-equal-expected.txt b/LayoutTests/fast/js/recursion-limit-equal-expected.txt
new file mode 100644 (file)
index 0000000..e12a580
--- /dev/null
+++ b/LayoutTests/fast/js/recursion-limit-equal-expected.txt
@@ -0,0 +1,12 @@
+CONSOLE MESSAGE: line 9: RangeError: Maximum call stack size exceeded.
+Tests hitting the recursion limit with equality comparisons. At one point this crashed due to lack of exception checking inside the engine.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+If the test did not crash, it has passed.
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/LayoutTests/fast/js/recursion-limit-equal.html b/LayoutTests/fast/js/recursion-limit-equal.html
new file mode 100644 (file)
index 0000000..6e7c7d1
--- /dev/null
+++ b/LayoutTests/fast/js/recursion-limit-equal.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="resources/js-test-style.css">
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="resources/recursion-limit-equal.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>

diff --git a/LayoutTests/fast/js/resources/recursion-limit-equal.js b/LayoutTests/fast/js/resources/recursion-limit-equal.js
new file mode 100644 (file)
index 0000000..86e15eb
--- /dev/null
+++ b/LayoutTests/fast/js/resources/recursion-limit-equal.js
@@ -0,0 +1,17 @@
+description('Tests hitting the recursion limit with equality comparisons. At one point this crashed due to lack of exception checking inside the engine.');
+
+ch = 0;
+
+var successfullyParsed = true;
+
+function test()
+{
+    if (ch == 0)
+        ch = document.getElementsByTagName('html');
+    test();
+}
+
+debug('If the test did not crash, it has passed.');
+debug('');
+
+test();