Changeset 264059 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Jul 7, 2020, 9:36:49 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] BytecodeGenerator should be robust against failed constant generation
​https://bugs.webkit.org/show_bug.cgi?id=214062
<rdar://problem/65117916>

Reviewed by Saam Barati.

JSTests:

• stress/bigint-oom-in-codegen-array-literal-context.js: Added.

(shouldThrow):
(test):

• stress/bigint-oom-in-codegen-binary-conditional-context.js: Added.

(shouldThrow):
(test):

• stress/bigint-oom-in-codegen-conditional-context.js: Added.

(shouldThrow):
(test):

Source/JavaScriptCore:

Some code in NodesCodegen.cpp assumes jsValue(generator) call for constant nodes must succeed.
But this can fail when BigInt in source code is too large and becomes OOM. BytecodeGenerator should
be robust against BigInt OOM.

• bytecompiler/NodesCodegen.cpp:

(JSC::ConstantNode::emitBytecodeInConditionContext):
(JSC::ArrayNode::emitBytecode):
(JSC::BinaryOpNode::tryFoldToBranch):

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -99 +99 @@
 void ConstantNode::emitBytecodeInConditionContext(BytecodeGenerator& generator, Label& trueTarget, Label& falseTarget, FallThroughMode fallThroughMode)
 {
-    TriState value = jsValue(generator).pureToBoolean();
+    TriState value = TriState::Indeterminate;
+    JSValue constant = jsValue(generator);
+    if (LIKELY(constant))
+        value = constant.pureToBoolean();
 
     if (UNLIKELY(needsDebugHook())) {
@@ -411 +414 @@
         if (!firstPutElement->value()->isConstant())
             hadVariableExpression = true;
-        else
-            recommendedIndexingType = leastUpperBoundOfIndexingTypeAndValue(recommendedIndexingType, static_cast<ConstantNode*>(firstPutElement->value())->jsValue(generator));
+        else {
+            JSValue constant = static_cast<ConstantNode*>(firstPutElement->value())->jsValue(generator);
+            if (UNLIKELY(!constant))
+                hadVariableExpression = true;
+            else
+                recommendedIndexingType = leastUpperBoundOfIndexingTypeAndValue(recommendedIndexingType, constant);
+        }
 
         ++length;
@@ -425 +433 @@
             for (ElementNode* element = elements; index < length; element = element->next()) {
                 ASSERT(element->value()->isConstant());
-                array->setIndex(generator.vm(), index++, static_cast<ConstantNode*>(element->value())->jsValue(generator));
+                JSValue constant = static_cast<ConstantNode*>(element->value())->jsValue(generator);
+                ASSERT(constant);
+                array->setIndex(generator.vm(), index++, constant);
             }
             return generator.emitNewArrayBuffer(dst, array, recommendedIndexingType);
@@ -2704 +2714 @@
     OpcodeID opcodeID = this->opcodeID();
     JSValue value = constant->jsValue(generator);
+    if (UNLIKELY(!value))
+        return;
     bool canFoldToBranch = JSC::canFoldToBranch(opcodeID, branchExpression, value);
     if (!canFoldToBranch)