Changeset 173178 in webkit for trunk/Source/JavaScriptCore/interpreter

Timestamp:

Sep 2, 2014, 9:52:35 AM (11 years ago)

Author:

[email protected]

Message:

Out of bounds write in vmEntryToJavaScript / JSC::JITCode::execute
​https://bugs.webkit.org/show_bug.cgi?id=136305

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

While preparing the callee's CallFrame, ProtoCallFrame fixes any arity mismatch
and then JITCode::execute() calls the normal entrypoint. This is incompatible
with the expectation of FTL generated functions. Changed ProtoCallFrame to not
perform the arity fix, but just flag an arity mismatch. now JITCode::execute()
uses that arity mismatch condition to select the normal or arity check
entrypoint. The entrypoint selection is only done for functions, programs
and eval always have one parameter.

• interpreter/ProtoCallFrame.cpp:

(JSC::ProtoCallFrame::init): Changed to flag arity mismatch instead of fixing it.

• interpreter/ProtoCallFrame.h:

(JSC::ProtoCallFrame::needArityCheck): New boolean to signify what entrypoint
should be called.

• jit/JITCode.cpp:

(JSC::JITCode::execute): Select normal or arity check entrypoint as appropriate.

LayoutTests:

• js/arity-mismatch-at-vmentry-expected.txt: Added.
• js/arity-mismatch-at-vmentry.html: Added.

Location:

trunk/Source/JavaScriptCore/interpreter

Files:

• ProtoCallFrame.cpp (modified) (1 diff)
• ProtoCallFrame.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/interpreter/ProtoCallFrame.cpp

@@ -40 +40 @@
     this->setCallee(callee);
     this->setArgumentCountIncludingThis(argCountIncludingThis);
-    size_t paddedArgsCount = argCountIncludingThis;
-    if (codeBlock) {
-        size_t numParameters = codeBlock->numParameters();
-        if (paddedArgsCount < numParameters)
-            paddedArgsCount = numParameters;
-    }
-    // Round up paddedArgsCount to keep the stack frame size aligned.
-    paddedArgsCount = roundArgumentCountToAlignFrame(paddedArgsCount);
+    if (codeBlock && argCountIncludingThis < codeBlock->numParameters())
+        this->arityMissMatch = true;
+    else
+        this->arityMissMatch = false;
+
+    // Round up argCountIncludingThis to keep the stack frame size aligned.
+    size_t paddedArgsCount = roundArgumentCountToAlignFrame(argCountIncludingThis);
     this->setPaddedArgCount(paddedArgsCount);
     this->clearCurrentVPC();

trunk/Source/JavaScriptCore/interpreter/ProtoCallFrame.h

@@ -38 +38 @@
     Register thisArg;
     uint32_t paddedArgCount;
+    bool arityMissMatch;
     JSValue *args;
 
@@ -61 +62 @@
     void setThisValue(JSValue value) { thisArg = value; }
 
+    bool needArityCheck() { return arityMissMatch; }
+
     JSValue argument(size_t argumentIndex)
     {