Changeset 236369 in webkit for trunk/Source/JavaScriptCore/runtime/JSString.cpp

Timestamp:

Sep 21, 2018, 4:18:15 PM (7 years ago)

Author:

[email protected]

Message:

JSRopeString::resolveRope() wrongly assumes that tryGetValue() passes it a valid ExecState.
​https://bugs.webkit.org/show_bug.cgi?id=189855
<rdar://problem/44680181>

Reviewed by Filip Pizlo.

tryGetValue() always passes a nullptr to JSRopeString::resolveRope() for the
ExecState* argument. This is intentional so that resolveRope() does not throw
in the event of an OutOfMemory error. Hence, JSRopeString::resolveRope() should
get the VM from the cell instead of via the ExecState.

Also removed an obsolete and unused field in JSString.

• runtime/JSString.cpp:

(JSC::JSRopeString::resolveRope const):
(JSC::JSRopeString::outOfMemory const):

• runtime/JSString.h:

(JSC::JSString::tryGetValue const):

File:

• trunk/Source/JavaScriptCore/runtime/JSString.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/runtime/JSString.cpp

@@ -251 +251 @@
 }
 
-void JSRopeString::resolveRope(ExecState* exec) const
+void JSRopeString::resolveRope(ExecState* nullOrExecForOOM) const
 {
     ASSERT(isRope());
@@ -265 +265 @@
         LChar* buffer;
         if (auto newImpl = StringImpl::tryCreateUninitialized(length(), buffer)) {
-            exec->vm().heap.reportExtraMemoryAllocated(newImpl->cost());
+            Heap::heap(this)->reportExtraMemoryAllocated(newImpl->cost());
             m_value = WTFMove(newImpl);
         } else {
-            outOfMemory(exec);
+            outOfMemory(nullOrExecForOOM);
             return;
         }
@@ -279 +279 @@
     UChar* buffer;
     if (auto newImpl = StringImpl::tryCreateUninitialized(length(), buffer)) {
-        exec->vm().heap.reportExtraMemoryAllocated(newImpl->cost());
+        Heap::heap(this)->reportExtraMemoryAllocated(newImpl->cost());
         m_value = WTFMove(newImpl);
     } else {
-        outOfMemory(exec);
+        outOfMemory(nullOrExecForOOM);
         return;
     }
@@ -381 +381 @@
 }
 
-void JSRopeString::outOfMemory(ExecState* exec) const
-{
-    VM& vm = exec->vm();
-    auto scope = DECLARE_THROW_SCOPE(vm);
-
+void JSRopeString::outOfMemory(ExecState* nullOrExecForOOM) const
+{
     clearFibers();
     ASSERT(isRope());
     ASSERT(m_value.isNull());
-    if (exec)
-        throwOutOfMemoryError(exec, scope);
+    if (nullOrExecForOOM) {
+        VM& vm = nullOrExecForOOM->vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        throwOutOfMemoryError(nullOrExecForOOM, scope);
+    }
 }