Changeset 276719 in webkit for trunk/Source/JavaScriptCore/bytecompiler

Timestamp:

Apr 28, 2021, 10:13:40 AM (4 years ago)

Author:

[email protected]

Message:

Fix exception assertions in light of the TerminationException.
​https://bugs.webkit.org/show_bug.cgi?id=225128
rdar://76694909

Reviewed by Robin Morisset.

JSTests:

• stress/suppress-TerminationException-in-JSFunction-prototypeForConstruction.js: Added.

Source/JavaScriptCore:

Some pre-existing functions assertNoException() or releaseAssertNoException().
These assertion may not be valid anymore in light of the TerminationException, and
require some fix up:

1. If it makes sense to convert the assertion into an exception check, then do so.

For example, see objectPrototypeToString(), slow_path_create_this().

2. If the assertion is at the end of a function just before it returns, or if the remaining code in the function will not be affected by the pending exception, then we can replace the assertion as follows:

assertNoException() => assertNoExceptionExceptTermination()
releaseAssertNoException() => releaseAssertNoExceptionExceptTermination()

For example, see objectPrototypeHasOwnProperty(), JSObject::getOwnNonIndexPropertyNames().

3. If the assertion is in a function where perf is not absolutely critical, and the function isn't calling any other functions that will re-enter the VM or potentially get stuck in an infinite loop, then we can use a DeferTermination scope to defer termination.

For example, see Debugger::pauseIfNeeded(), SamplingProfiler::StackFrame::nameFromCallee().

4. If the assertion is in an initializer function is only run once and adding exception checks would complicate the code more than it's worth (an engineering judgement), then use a DeferTermination scope.

For example, see ProgramExecutable::initializeGlobalProperties(), setupAdaptiveWatchpoint().

Some leaf (or near-leaf) functions that currently DECLARE_CATCH_SCOPE() may also
fall under this category.

For example, see JSFunction::prototypeForConstruction().

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::addBigIntConstant):

• debugger/Debugger.cpp:

(JSC::Debugger::pauseIfNeeded):

• dfg/DFGOperations.cpp:

(JSC::DFG::JSC_DEFINE_JIT_OPERATION):

• interpreter/Interpreter.cpp:

(JSC::notifyDebuggerOfUnwinding):
(JSC::Interpreter::executeProgram):
(JSC::Interpreter::debug):

• interpreter/ShadowChicken.cpp:

(JSC::ShadowChicken::functionsOnStack):

• jsc.cpp:

(runWithOptions):

• parser/ParserArena.cpp:

(JSC::IdentifierArena::makeBigIntDecimalIdentifier):

• runtime/AbstractModuleRecord.cpp:

(JSC::AbstractModuleRecord::finishCreation):

• runtime/CommonSlowPaths.cpp:

(JSC::JSC_DEFINE_COMMON_SLOW_PATH):

• runtime/ErrorInstance.cpp:

(JSC::ErrorInstance::sanitizedMessageString):
(JSC::ErrorInstance::sanitizedNameString):

• runtime/ExceptionScope.h:

(JSC::ExceptionScope::assertNoExceptionExceptTermination):
(JSC::ExceptionScope::releaseAssertNoExceptionExceptTermination):

• runtime/JSFunction.cpp:

(JSC::JSFunction::prototypeForConstruction):

• runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::genericTypedArrayViewProtoFuncIncludes):
(JSC::genericTypedArrayViewProtoFuncIndexOf):
(JSC::genericTypedArrayViewProtoFuncLastIndexOf):
(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):

• runtime/JSGlobalObject.cpp:

(JSC::setupAdaptiveWatchpoint):
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::defineOwnProperty):
(JSC::JSGlobalObject::tryInstallSpeciesWatchpoint):

• runtime/JSModuleLoader.cpp:

(JSC::printableModuleKey):

• runtime/JSModuleNamespaceObject.cpp:

(JSC::JSModuleNamespaceObject::finishCreation):

• runtime/JSObject.cpp:

(JSC::JSObject::ordinaryToPrimitive const):
(JSC::JSObject::getOwnNonIndexPropertyNames):

• runtime/JSTemplateObjectDescriptor.cpp:

(JSC::JSTemplateObjectDescriptor::createTemplateObject):

• runtime/JSTypedArrayViewPrototype.cpp:
• runtime/ObjectPrototype.cpp:

(JSC::objectPrototypeHasOwnProperty):
(JSC::objectPrototypeToString):

• runtime/ProgramExecutable.cpp:

(JSC::ProgramExecutable::initializeGlobalProperties):

• runtime/SamplingProfiler.cpp:

(JSC::SamplingProfiler::StackFrame::nameFromCallee):

• tools/JSDollarVM.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

Source/WebCore:

A few changes plus rebasing bindings test results.

• Modules/plugins/QuickTimePluginReplacement.mm:

(WebCore::QuickTimePluginReplacement::installReplacement):

• bindings/js/JSDOMExceptionHandling.cpp:

(WebCore::propagateExceptionSlowPath):
(WebCore::throwNotSupportedError):
(WebCore::throwInvalidStateError):
(WebCore::throwSecurityError):
(WebCore::throwDOMSyntaxError):
(WebCore::throwDataCloneError):

• bindings/js/JSDOMGlobalObject.cpp:

(WebCore::JSC_DEFINE_HOST_FUNCTION):

• bindings/js/JSDOMGlobalObjectTask.cpp:
• bindings/js/JSDOMMapLike.cpp:

(WebCore::getBackingMap):

• bindings/js/JSDOMSetLike.cpp:

(WebCore::getBackingSet):

• bindings/js/JSMicrotaskCallback.h:

(WebCore::JSMicrotaskCallback::call):

• bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneDeserializer::readTerminal):

• bindings/js/WritableStream.cpp:

(WebCore::WritableStreamInternal::callFunction):
(WebCore::WritableStream::lock):

• bindings/scripts/CodeGeneratorJS.pm:

(GeneratePut):
(GeneratePutByIndex):
(GenerateDefineOwnProperty):

• bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp:

(WebCore::JSTestNamedAndIndexedSetterNoIdentifier::put):
(WebCore::JSTestNamedAndIndexedSetterNoIdentifier::putByIndex):
(WebCore::JSTestNamedAndIndexedSetterNoIdentifier::defineOwnProperty):

• bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp:

(WebCore::JSTestNamedAndIndexedSetterThrowingException::put):
(WebCore::JSTestNamedAndIndexedSetterThrowingException::putByIndex):
(WebCore::JSTestNamedAndIndexedSetterThrowingException::defineOwnProperty):

• bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp:

(WebCore::JSTestNamedAndIndexedSetterWithIdentifier::put):
(WebCore::JSTestNamedAndIndexedSetterWithIdentifier::putByIndex):
(WebCore::JSTestNamedAndIndexedSetterWithIdentifier::defineOwnProperty):

• bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp:

(WebCore::JSTestNamedSetterNoIdentifier::put):
(WebCore::JSTestNamedSetterNoIdentifier::putByIndex):
(WebCore::JSTestNamedSetterNoIdentifier::defineOwnProperty):

• bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp:

(WebCore::JSTestNamedSetterThrowingException::put):
(WebCore::JSTestNamedSetterThrowingException::putByIndex):
(WebCore::JSTestNamedSetterThrowingException::defineOwnProperty):

• bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp:

(WebCore::JSTestNamedSetterWithIdentifier::put):
(WebCore::JSTestNamedSetterWithIdentifier::putByIndex):
(WebCore::JSTestNamedSetterWithIdentifier::defineOwnProperty):

• bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp:

(WebCore::JSTestNamedSetterWithIndexedGetter::put):
(WebCore::JSTestNamedSetterWithIndexedGetter::putByIndex):
(WebCore::JSTestNamedSetterWithIndexedGetter::defineOwnProperty):

• bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp:

(WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::put):
(WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::putByIndex):
(WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::defineOwnProperty):

• bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp:

(WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::put):
(WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::putByIndex):
(WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::defineOwnProperty):

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
(WebCore::HTMLMediaElement::updateMediaControlsAfterPresentationModeChange):
(WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):

File:

• trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

@@ -56 +56 @@
 #include "UnlinkedModuleProgramCodeBlock.h"
 #include "UnlinkedProgramCodeBlock.h"
+#include "VMTrapsInlines.h"
 #include <wtf/BitVector.h>
 #include <wtf/HashSet.h>
@@ -3071 +3072 @@
 {
     return m_bigIntMap.ensure(BigIntMapEntry(identifier.impl(), radix, sign), [&] {
-        auto scope = DECLARE_CATCH_SCOPE(vm());
+        VM& vm = this->vm();
+        DeferTermination deferScope(vm);
+        auto scope = DECLARE_CATCH_SCOPE(vm);
         auto parseIntSign = sign ? JSBigInt::ParseIntSign::Signed : JSBigInt::ParseIntSign::Unsigned;
-        JSValue bigIntInMap = JSBigInt::parseInt(nullptr, vm(), identifier.string(), radix, JSBigInt::ErrorParseMode::ThrowExceptions, parseIntSign);
+        JSValue bigIntInMap = JSBigInt::parseInt(nullptr, vm, identifier.string(), radix, JSBigInt::ErrorParseMode::ThrowExceptions, parseIntSign);
         scope.assertNoException();
         addConstantValue(bigIntInMap);