Changeset 171213 in webkit for trunk/Source/JavaScriptCore/interpreter

Timestamp:

Jul 17, 2014, 9:34:16 PM (11 years ago)

Author:

[email protected]

Message:

Need ability to fuzz exception throwing
​https://bugs.webkit.org/show_bug.cgi?id=134945
<rdar://problem/17722027>

Reviewed by Sam Weinig.

Source/JavaScriptCore:
Adds the ability to instrument exception checks, and to force some random
exception check to artificially throw an exception. Also adds new tests that
are suitable for testing this. Note that this is closely tied to the Tools
directory changes that are also part of this changeset.

This also fixes an activation tear-off bug that arises if we ever throw an
exception from operationOptimize, or if due to some other bug it's only due
to the operationOptimize exception check that we realize that there is an
exception to be thrown.

• dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::fastExceptionCheck):

• ftl/FTLIntrinsicRepository.h:
• ftl/FTLLowerDFGToLLVM.cpp:

(JSC::FTL::LowerDFGToLLVM::callCheck):

• interpreter/Interpreter.cpp:

(JSC::unwindCallFrame):

• jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::callExceptionFuzz):
(JSC::AssemblyHelpers::emitExceptionCheck):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::emitExceptionCheck): Deleted.

• jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

• jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_enter):

• jit/JITOperations.cpp:

(JSC::numberOfExceptionFuzzChecks):

• jit/JITOperations.h:
• jsc.cpp:

(jscmain):

• runtime/Options.h:
• runtime/TestRunnerUtils.h:
• tests/exceptionFuzz.yaml: Added.
• tests/exceptionFuzz: Added.
• tests/exceptionFuzz/3d-cube.js: Added.
• tests/exceptionFuzz/date-format-xparb.js: Added.
• tests/exceptionFuzz/earley-boyer.js: Added.

Tools:
Adds a new script, js-exception-fuzz, which will run some jsc command-line using
exception fuzzing. This means that we will force exceptions to be thrown in random
places to see how the engine reacts. This is now integrated with the various test
drivers, so run-javascriptcore-tests will run some exception fuzzing tests by
default.

• Scripts/jsc-stress-test-helpers/js-exception-fuzz: Added.

(fail):

• Scripts/run-javascriptcore-tests:
• Scripts/run-jsc-stress-tests:

Location:

trunk/Source/JavaScriptCore/interpreter

Files:

• Interpreter.cpp (modified) (1 diff)
• StackVisitor.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -458 +458 @@
 #endif
         activation = callFrame->uncheckedActivation();
-        if (activation)
-            jsCast<JSActivation*>(activation)->tearOff(*scope->vm());
+        // Protect against the activation not being created, or the variable still being
+        // initialized to Undefined inside op_enter.
+        if (activation && activation.isCell()) {
+            JSActivation* activationObject = jsCast<JSActivation*>(activation);
+            // Protect against throwing exceptions after tear-off.
+            if (!activationObject->isTornOff())
+                activationObject->tearOff(*scope->vm());
+        }
     }
 
     if (codeBlock->codeType() == FunctionCode && codeBlock->usesArguments()) {
         if (Arguments* arguments = visitor->existingArguments()) {
-            if (activation)
+            if (activation && activation.isCell())
                 arguments->didTearOffActivation(callFrame, jsCast<JSActivation*>(activation));
 #if ENABLE(DFG_JIT)

trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp

@@ -279 +279 @@
     
     JSValue result = callFrame()->r(unmodifiedArgumentsRegister(reg).offset()).jsValue();
-    if (!result)
+    if (!result || !result.isCell()) // Protect against Undefined in case we throw in op_enter.
         return 0;
     return jsCast<Arguments*>(result);