Changeset 173178 in webkit for trunk/Source/JavaScriptCore/interpreter/ProtoCallFrame.h

Timestamp:

Sep 2, 2014, 9:52:35 AM (11 years ago)

Author:

[email protected]

Message:

Out of bounds write in vmEntryToJavaScript / JSC::JITCode::execute
​https://bugs.webkit.org/show_bug.cgi?id=136305

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

While preparing the callee's CallFrame, ProtoCallFrame fixes any arity mismatch
and then JITCode::execute() calls the normal entrypoint. This is incompatible
with the expectation of FTL generated functions. Changed ProtoCallFrame to not
perform the arity fix, but just flag an arity mismatch. now JITCode::execute()
uses that arity mismatch condition to select the normal or arity check
entrypoint. The entrypoint selection is only done for functions, programs
and eval always have one parameter.

• interpreter/ProtoCallFrame.cpp:

(JSC::ProtoCallFrame::init): Changed to flag arity mismatch instead of fixing it.

• interpreter/ProtoCallFrame.h:

(JSC::ProtoCallFrame::needArityCheck): New boolean to signify what entrypoint
should be called.

• jit/JITCode.cpp:

(JSC::JITCode::execute): Select normal or arity check entrypoint as appropriate.

LayoutTests:

• js/arity-mismatch-at-vmentry-expected.txt: Added.
• js/arity-mismatch-at-vmentry.html: Added.

File:

• trunk/Source/JavaScriptCore/interpreter/ProtoCallFrame.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/interpreter/ProtoCallFrame.h

@@ -38 +38 @@
     Register thisArg;
     uint32_t paddedArgCount;
+    bool arityMissMatch;
     JSValue *args;
 
@@ -61 +62 @@
     void setThisValue(JSValue value) { thisArg = value; }
 
+    bool needArityCheck() { return arityMissMatch; }
+
     JSValue argument(size_t argumentIndex)
     {