Changeset 261780 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

May 16, 2020, 1:24:22 AM (5 years ago)

Author:

[email protected]

Message:

[JSC] Make OutOfMemory error as instance of RangeError
​https://bugs.webkit.org/show_bug.cgi?id=211952

Reviewed by Mark Lam.

JSTests:

• ChakraCore/test/Error/outofmem.baseline-jsc:
• es6/String.prototype_methods_String.prototype.padEnd.js:

(TestMemoryLimits):

• es6/String.prototype_methods_String.prototype.padStart.js:

(TestMemoryLimits):

• slowMicrobenchmarks/function-constructor-with-huge-strings.js:
• stress/array-join-on-strings-need-overflow-checks.js:
• stress/big-wasm-memory-grow-no-max.js:

(test):

• stress/big-wasm-memory-grow.js:

(test):

• stress/big-wasm-memory.js:

(test):

• stress/bigint-exponential-oom.js:

(shouldThrow):

• stress/bigint-int32-min-shift.js:

(shouldThrow):

• stress/check-symbol-description-oom.js:
• stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js:
• stress/intl-canonicalize-locale-list-error-oom.js:

(shouldThrow):

• stress/joined-strings-should-not-exceed-max-string-length.js:
• stress/js-fixed-array-out-of-memory.js:

(test):

• stress/json-stringified-overflow-2.js:

(catch):

• stress/json-stringified-overflow.js:

(catch):

• stress/json-stringify-string-builder-overflow.js:
• stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js:
• stress/missing-exception-check-in-array-prototype-fastJoin.js:
• stress/missing-exception-check-in-canonicalizeLocaleList.js:
• stress/missing-exception-check-in-json-stringifier-gap.js:
• stress/missing-exception-check-in-string-compare.js:
• stress/missing-exception-check-in-string-greater-than-compare.js:
• stress/missing-exception-check-in-string-greater-than-or-equal-compare.js:
• stress/missing-exception-check-in-string-lastIndexOf.js:
• stress/missing-exception-check-in-string-less-than-compare.js:
• stress/missing-exception-check-in-string-less-than-or-equal-compare.js:
• stress/missing-exception-check-in-string-toLower.js:
• stress/missing-exception-check-in-string-toUpper.js:
• stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js:
• stress/out-of-memory-while-constructing-BytecodeGenerator.js:
• stress/regexp-prototype-exec-on-too-long-rope.js:
• stress/regexp-prototype-match-on-too-long-rope.js:
• stress/regexp-prototype-test-on-too-long-rope.js:
• stress/regress-169783.js:

(doTest):

• stress/regress-178385.js:
• stress/regress-178386.js:
• stress/regress-185888.js:
• stress/regress-189132.js:
• stress/regress-190187.js:
• stress/regress-191563.js:
• stress/scoped-arguments-table-should-be-tolerant-for-oom.js:

(i.canThrow):

• stress/string-16bit-repeat-overflow.js:
• stress/string-overflow-createError-builder.js:
• stress/string-overflow-createError-fit.js:
• stress/string-overflow-createError.js:
• stress/string-prototype-charCodeAt-on-too-long-rope.js:
• stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
• stress/switch-string-oom.js:

(testLowerTiers):
(testFTL):

• stress/test-exception-assert-in-ExceptionHelpers-createError.js:
• stress/test-out-of-memory.js:
• stress/typed-array-subarray-can-throw-oom-error.js:

(get bar):

• wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js:
• wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js:

Source/JavaScriptCore:

The spec sometimes requires "check parameters and throw RangeError" before allocating an object.
But we are just allocating an object and throwing an out-of-memory error since wrong parameter will
cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while
we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8.

This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError
in builtin code: the previous thrown errors are not marked as out-of-memory error.

• bytecode/BytecodeList.rb:
• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitThrowStaticError):
(JSC::BytecodeGenerator::emitThrowReferenceError):
(JSC::BytecodeGenerator::emitThrowTypeError):
(JSC::BytecodeGenerator::emitThrowRangeError):
(JSC::BytecodeGenerator::emitThrowOutOfMemoryError):

• bytecompiler/BytecodeGenerator.h:
• bytecompiler/NodesCodegen.cpp:

(JSC::RegExpNode::emitBytecode):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError):

• dfg/DFGOperations.cpp:
• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

• runtime/Error.cpp:

(JSC::createError):
(JSC::createOutOfMemoryError):

• runtime/Error.h:
• runtime/ErrorType.cpp:

(JSC::errorTypeName):
(WTF::printInternal):

• runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types.

LayoutTests:

• inspector/debugger/no-pause-out-of-memory-exception-expected.txt:
• js/array-join-expected.txt:
• js/dom/concat-large-strings-crash-expected.txt:
• js/dom/concat-large-strings-crash2-expected.txt:
• js/dom/script-tests/string-replacement-outofmemory.js:
• js/dom/string-concatenate-outofmemory-expected.txt:
• js/dom/string-replacement-outofmemory-expected.txt:
• js/large-expressions-expected.txt:
• js/resources/string-concatenate-outofmemory.js:
• js/script-tests/array-join.js:
• js/script-tests/stack-overflow-regexp.js:

(shouldThrow.recursiveCall):
(shouldThrow):

• js/script-tests/string-padend.js:
• js/script-tests/string-padstart.js:
• js/script-tests/string-repeat.js:
• js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js:
• js/stack-overflow-regexp-expected.txt:
• js/string-padend-expected.txt:
• js/string-padstart-expected.txt:
• js/string-repeat-expected.txt:
• js/stringimpl-to-jsstring-on-large-strings-1-expected.txt:

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -158 +158 @@
     const char* messageCharacters = regExp->errorMessage();
     const Identifier& message = generator.parserArena().identifierArena().makeIdentifier(generator.vm(), bitwise_cast<const LChar*>(messageCharacters), strlen(messageCharacters));
-    generator.emitThrowStaticError(ErrorType::SyntaxError, message);
+    generator.emitThrowStaticError(ErrorTypeWithExtension::SyntaxError, message);
     return generator.emitLoad(generator.finalDestination(dst), jsUndefined());
 }
@@ -1465 +1465 @@
     } else {
         RefPtr<RegisterID> message = generator.emitNode(node);
-        generator.emitThrowStaticError(ErrorType::TypeError, message.get());
+        generator.emitThrowStaticError(ErrorTypeWithExtension::TypeError, message.get());
     }
     return dst;
@@ -1479 +1479 @@
     } else {
         RefPtr<RegisterID> message = generator.emitNode(node);
-        generator.emitThrowStaticError(ErrorType::RangeError, message.get());
+        generator.emitThrowStaticError(ErrorTypeWithExtension::RangeError, message.get());
     }