Changeset 38930 in webkit for trunk/JavaScriptCore

Timestamp:

Dec 2, 2008, 10:13:58 PM (16 years ago)

Author:

[email protected]

Message:

2008-12-02 Cameron Zwarich <​[email protected]>

Reviewed by Geoff Garen.

Bug 22504: Crashes during code generation occur due to refing of ignoredResult()
<​https://bugs.webkit.org/show_bug.cgi?id=22504>

Since ignoredResult() was implemented by casting 1 to a RegisterID*, any
attempt to ref ignoredResult() results in a crash. This will occur in
code generation of a function body where a node emits another node with
the dst that was passed to it, and then refs the returned RegisterID*.

To fix this problem, make ignoredResult() a member function of
BytecodeGenerator that simply returns a pointe to a fixed RegisterID
member of BytecodeGenerator.

JavaScriptCore:

• bytecompiler/BytecodeGenerator.h: (JSC::BytecodeGenerator::ignoredResult):
• bytecompiler/RegisterID.h:
• parser/Nodes.cpp: (JSC::NullNode::emitBytecode): (JSC::BooleanNode::emitBytecode): (JSC::NumberNode::emitBytecode): (JSC::StringNode::emitBytecode): (JSC::RegExpNode::emitBytecode): (JSC::ThisNode::emitBytecode): (JSC::ResolveNode::emitBytecode): (JSC::ObjectLiteralNode::emitBytecode): (JSC::PostfixResolveNode::emitBytecode): (JSC::PostfixBracketNode::emitBytecode): (JSC::PostfixDotNode::emitBytecode): (JSC::DeleteValueNode::emitBytecode): (JSC::VoidNode::emitBytecode): (JSC::TypeOfResolveNode::emitBytecode): (JSC::TypeOfValueNode::emitBytecode): (JSC::PrefixResolveNode::emitBytecode): (JSC::AssignResolveNode::emitBytecode): (JSC::CommaNode::emitBytecode): (JSC::ForNode::emitBytecode): (JSC::ForInNode::emitBytecode): (JSC::ReturnNode::emitBytecode): (JSC::ThrowNode::emitBytecode): (JSC::FunctionBodyNode::emitBytecode): (JSC::FuncDeclNode::emitBytecode):

LayoutTests:

• fast/js/ignored-result-ref-crash-expected.txt: Added.
• fast/js/ignored-result-ref-crash.html: Added.
• fast/js/resources/ignored-result-ref-crash.js: Added.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecompiler/BytecodeGenerator.h (modified) (2 diffs)
• bytecompiler/RegisterID.h (modified) (1 diff)
• parser/Nodes.cpp (modified) (30 diffs)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-12-02  Cameron Zwarich  <[email protected]>
+
+        Reviewed by Geoff Garen.
+
+        Bug 22504: Crashes during code generation occur due to refing of ignoredResult()
+        <https://bugs.webkit.org/show_bug.cgi?id=22504>
+
+        Since ignoredResult() was implemented by casting 1 to a RegisterID*, any
+        attempt to ref ignoredResult() results in a crash. This will occur in
+        code generation of a function body where a node emits another node with
+        the dst that was passed to it, and then refs the returned RegisterID*.
+
+        To fix this problem, make ignoredResult() a member function of
+        BytecodeGenerator that simply returns a pointe to a fixed RegisterID
+        member of BytecodeGenerator.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::ignoredResult):
+        * bytecompiler/RegisterID.h:
+        * parser/Nodes.cpp:
+        (JSC::NullNode::emitBytecode):
+        (JSC::BooleanNode::emitBytecode):
+        (JSC::NumberNode::emitBytecode):
+        (JSC::StringNode::emitBytecode):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::ThisNode::emitBytecode):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::ObjectLiteralNode::emitBytecode):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PostfixBracketNode::emitBytecode):
+        (JSC::PostfixDotNode::emitBytecode):
+        (JSC::DeleteValueNode::emitBytecode):
+        (JSC::VoidNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::TypeOfValueNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::CommaNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::FuncDeclNode::emitBytecode):
+
 2008-12-02  Geoffrey Garen  <[email protected]>
 

trunk/JavaScriptCore/bytecompiler/BytecodeGenerator.h

@@ -119 +119 @@
         // Functions for handling of dst register
 
+        RegisterID* ignoredResult() { return &m_ignoredResultRegister; }
+
         // Returns a place to write intermediate values of an operation
         // which reuses dst if it is safe to do so.
@@ -416 +418 @@
 
         HashSet<RefPtr<UString::Rep>, IdentifierRepHash> m_functions;
+        RegisterID m_ignoredResultRegister;
         RegisterID m_thisRegister;
         RegisterID m_argumentsRegister;

trunk/JavaScriptCore/bytecompiler/RegisterID.h

@@ -108 +108 @@
     };
 
-    inline RegisterID* ignoredResult() { return reinterpret_cast<RegisterID*>(1); }
-
 } // namespace JSC
 

trunk/JavaScriptCore/parser/Nodes.cpp

@@ -277 +277 @@
 RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         return 0;
     return generator.emitLoad(dst, jsNull());
@@ -286 +286 @@
 RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         return 0;
     return generator.emitLoad(dst, m_value);
@@ -295 +295 @@
 RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         return 0;
     return generator.emitLoad(dst, m_double);
@@ -304 +304 @@
 RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         return 0;
     return generator.emitLoad(dst, m_value);
@@ -316 +316 @@
     if (!regExp->isValid())
         return emitThrowError(generator, SyntaxError, ("Invalid regular expression: " + UString(regExp->errorMessage())).UTF8String().c_str());
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         return 0;
     return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
@@ -325 +325 @@
 RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         return 0;
     return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
@@ -340 +340 @@
 {
     if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (dst == ignoredResult())
+        if (dst == generator.ignoredResult())
             return 0;
         return generator.moveToDestinationIfNeeded(dst, local);
@@ -432 +432 @@
 {
      if (!m_list) {
-         if (dst == ignoredResult())
+         if (dst == generator.ignoredResult())
              return 0;
          return generator.emitNewObject(generator.finalDestination(dst));
@@ -710 +710 @@
     if (RegisterID* local = generator.registerFor(m_ident)) {
         if (generator.isLocalConstant(m_ident)) {
-            if (dst == ignoredResult())
+            if (dst == generator.ignoredResult())
                 return 0;
             return generator.emitToJSNumber(generator.finalDestination(dst), local);
         }
 
-        if (dst == ignoredResult())
+        if (dst == generator.ignoredResult())
             return emitPreIncOrDec(generator, local, m_operator);
         return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
@@ -726 +726 @@
         RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
         RegisterID* oldValue;
-        if (dst == ignoredResult()) {
+        if (dst == generator.ignoredResult()) {
             oldValue = 0;
             emitPreIncOrDec(generator, value.get(), m_operator);
@@ -740 +740 @@
     RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
     RegisterID* oldValue;
-    if (dst == ignoredResult()) {
+    if (dst == generator.ignoredResult()) {
         oldValue = 0;
         emitPreIncOrDec(generator, value.get(), m_operator);
@@ -771 +771 @@
     RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
     RegisterID* oldValue;
-    if (dst == ignoredResult()) {
+    if (dst == generator.ignoredResult()) {
         oldValue = 0;
         if (m_operator == OpPlusPlus)
@@ -804 +804 @@
     RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
     RegisterID* oldValue;
-    if (dst == ignoredResult()) {
+    if (dst == generator.ignoredResult()) {
         oldValue = 0;
         if (m_operator == OpPlusPlus)
@@ -903 +903 @@
 RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(ignoredResult(), m_expr.get());
+    generator.emitNode(generator.ignoredResult(), m_expr.get());
 
     // delete on a non-location expression ignores the value and returns true
@@ -923 +923 @@
 RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (dst == ignoredResult()) {
-        generator.emitNode(ignoredResult(), m_expr.get());
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr.get());
         return 0;
     }
@@ -936 +936 @@
 {
     if (RegisterID* local = generator.registerFor(m_ident)) {
-        if (dst == ignoredResult())
+        if (dst == generator.ignoredResult())
             return 0;
         return generator.emitTypeOf(generator.finalDestination(dst), local);
@@ -943 +943 @@
     RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
     generator.emitGetById(scratch.get(), scratch.get(), m_ident);
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         return 0;
     return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
@@ -962 +962 @@
 RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (dst == ignoredResult()) {
-        generator.emitNode(ignoredResult(), m_expr.get());
+    if (dst == generator.ignoredResult()) {
+        generator.emitNode(generator.ignoredResult(), m_expr.get());
         return 0;
     }
@@ -976 +976 @@
     if (RegisterID* local = generator.registerFor(m_ident)) {
         if (generator.isLocalConstant(m_ident)) {
-            if (dst == ignoredResult())
+            if (dst == generator.ignoredResult())
                 return 0;
             RefPtr<RegisterID> r0 = generator.emitUnexpectedLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
@@ -1360 +1360 @@
     JSObject* globalObject = 0;
     if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
-        if (dst == ignoredResult())
+        if (dst == generator.ignoredResult())
             dst = 0;
         RegisterID* value = generator.emitNode(dst, m_right.get());
@@ -1368 +1368 @@
 
     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         dst = 0;
     RegisterID* value = generator.emitNode(dst, m_right.get());
@@ -1513 +1513 @@
 RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(ignoredResult(), m_expr1.get());
+    generator.emitNode(generator.ignoredResult(), m_expr1.get());
     return generator.emitNode(dst, m_expr2.get());
 }
@@ -1821 +1821 @@
 RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         dst = 0;
 
@@ -1829 +1829 @@
 
     if (m_expr1)
-        generator.emitNode(ignoredResult(), m_expr1.get());
+        generator.emitNode(generator.ignoredResult(), m_expr1.get());
 
     RefPtr<Label> condition = generator.newLabel();
@@ -1843 +1843 @@
     generator.emitLabel(scope->continueTarget());
     if (m_expr3)
-        generator.emitNode(ignoredResult(), m_expr3.get());
+        generator.emitNode(generator.ignoredResult(), m_expr3.get());
 
     generator.emitLabel(condition.get());
@@ -1909 +1909 @@
 
     if (m_init)
-        generator.emitNode(ignoredResult(), m_init.get());
+        generator.emitNode(generator.ignoredResult(), m_init.get());
     RegisterID* forInBase = generator.emitNode(m_expr.get());
     RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), forInBase);
@@ -2009 +2009 @@
         return emitThrowError(generator, SyntaxError, "Invalid return statement.");
 
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         dst = 0;
     RegisterID* r0 = m_value ? generator.emitNode(dst, m_value.get()) : generator.emitLoad(dst, jsUndefined());
@@ -2286 +2286 @@
 RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    if (dst == ignoredResult())
+    if (dst == generator.ignoredResult())
         dst = 0;
     RefPtr<RegisterID> expr = generator.emitNode(dst, m_expr.get());
@@ -2559 +2559 @@
 {
     generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
-    statementListEmitCode(children(), generator, ignoredResult());
+    statementListEmitCode(children(), generator, generator.ignoredResult());
     if (!children().size() || !children().last()->isReturnNode()) {
         RegisterID* r0 = generator.emitLoad(0, jsUndefined());
@@ -2631 +2631 @@
 }
 
-RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator&, RegisterID* dst)
-{
-    if (dst == ignoredResult())
+RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    if (dst == generator.ignoredResult())
         dst = 0;
     return dst;