Ignore:
Timestamp:
Dec 2, 2008, 10:13:58 PM (16 years ago)
Author:
[email protected]
Message:

2008-12-02 Cameron Zwarich <​[email protected]>

Reviewed by Geoff Garen.

Bug 22504: Crashes during code generation occur due to refing of ignoredResult()
<​https://bugs.webkit.org/show_bug.cgi?id=22504>

Since ignoredResult() was implemented by casting 1 to a RegisterID*, any
attempt to ref ignoredResult() results in a crash. This will occur in
code generation of a function body where a node emits another node with
the dst that was passed to it, and then refs the returned RegisterID*.

To fix this problem, make ignoredResult() a member function of
BytecodeGenerator that simply returns a pointe to a fixed RegisterID
member of BytecodeGenerator.

JavaScriptCore:

  • bytecompiler/BytecodeGenerator.h: (JSC::BytecodeGenerator::ignoredResult):
  • bytecompiler/RegisterID.h:
  • parser/Nodes.cpp: (JSC::NullNode::emitBytecode): (JSC::BooleanNode::emitBytecode): (JSC::NumberNode::emitBytecode): (JSC::StringNode::emitBytecode): (JSC::RegExpNode::emitBytecode): (JSC::ThisNode::emitBytecode): (JSC::ResolveNode::emitBytecode): (JSC::ObjectLiteralNode::emitBytecode): (JSC::PostfixResolveNode::emitBytecode): (JSC::PostfixBracketNode::emitBytecode): (JSC::PostfixDotNode::emitBytecode): (JSC::DeleteValueNode::emitBytecode): (JSC::VoidNode::emitBytecode): (JSC::TypeOfResolveNode::emitBytecode): (JSC::TypeOfValueNode::emitBytecode): (JSC::PrefixResolveNode::emitBytecode): (JSC::AssignResolveNode::emitBytecode): (JSC::CommaNode::emitBytecode): (JSC::ForNode::emitBytecode): (JSC::ForInNode::emitBytecode): (JSC::ReturnNode::emitBytecode): (JSC::ThrowNode::emitBytecode): (JSC::FunctionBodyNode::emitBytecode): (JSC::FuncDeclNode::emitBytecode):

LayoutTests:

  • fast/js/ignored-result-ref-crash-expected.txt: Added.
  • fast/js/ignored-result-ref-crash.html: Added.
  • fast/js/resources/ignored-result-ref-crash.js: Added.
File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/JavaScriptCore/parser/Nodes.cpp

    r38917 r38930  
    277277RegisterID* NullNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    278278{
    279     if (dst == ignoredResult())
     279    if (dst == generator.ignoredResult())
    280280        return 0;
    281281    return generator.emitLoad(dst, jsNull());
    … …  
    286286RegisterID* BooleanNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    287287{
    288     if (dst == ignoredResult())
     288    if (dst == generator.ignoredResult())
    289289        return 0;
    290290    return generator.emitLoad(dst, m_value);
    … …  
    295295RegisterID* NumberNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    296296{
    297     if (dst == ignoredResult())
     297    if (dst == generator.ignoredResult())
    298298        return 0;
    299299    return generator.emitLoad(dst, m_double);
    … …  
    304304RegisterID* StringNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    305305{
    306     if (dst == ignoredResult())
     306    if (dst == generator.ignoredResult())
    307307        return 0;
    308308    return generator.emitLoad(dst, m_value);
    … …  
    316316    if (!regExp->isValid())
    317317        return emitThrowError(generator, SyntaxError, ("Invalid regular expression: " + UString(regExp->errorMessage())).UTF8String().c_str());
    318     if (dst == ignoredResult())
     318    if (dst == generator.ignoredResult())
    319319        return 0;
    320320    return generator.emitNewRegExp(generator.finalDestination(dst), regExp.get());
    … …  
    325325RegisterID* ThisNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    326326{
    327     if (dst == ignoredResult())
     327    if (dst == generator.ignoredResult())
    328328        return 0;
    329329    return generator.moveToDestinationIfNeeded(dst, generator.thisRegister());
    … …  
    340340{
    341341    if (RegisterID* local = generator.registerFor(m_ident)) {
    342         if (dst == ignoredResult())
     342        if (dst == generator.ignoredResult())
    343343            return 0;
    344344        return generator.moveToDestinationIfNeeded(dst, local);
    … …  
    432432{
    433433     if (!m_list) {
    434          if (dst == ignoredResult())
     434         if (dst == generator.ignoredResult())
    435435             return 0;
    436436         return generator.emitNewObject(generator.finalDestination(dst));
    … …  
    710710    if (RegisterID* local = generator.registerFor(m_ident)) {
    711711        if (generator.isLocalConstant(m_ident)) {
    712             if (dst == ignoredResult())
     712            if (dst == generator.ignoredResult())
    713713                return 0;
    714714            return generator.emitToJSNumber(generator.finalDestination(dst), local);
    715715        }
    716716
    717         if (dst == ignoredResult())
     717        if (dst == generator.ignoredResult())
    718718            return emitPreIncOrDec(generator, local, m_operator);
    719719        return emitPostIncOrDec(generator, generator.finalDestination(dst), local, m_operator);
    … …  
    726726        RefPtr<RegisterID> value = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
    727727        RegisterID* oldValue;
    728         if (dst == ignoredResult()) {
     728        if (dst == generator.ignoredResult()) {
    729729            oldValue = 0;
    730730            emitPreIncOrDec(generator, value.get(), m_operator);
    … …  
    740740    RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), value.get(), m_ident);
    741741    RegisterID* oldValue;
    742     if (dst == ignoredResult()) {
     742    if (dst == generator.ignoredResult()) {
    743743        oldValue = 0;
    744744        emitPreIncOrDec(generator, value.get(), m_operator);
    … …  
    771771    RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
    772772    RegisterID* oldValue;
    773     if (dst == ignoredResult()) {
     773    if (dst == generator.ignoredResult()) {
    774774        oldValue = 0;
    775775        if (m_operator == OpPlusPlus)
    … …  
    804804    RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
    805805    RegisterID* oldValue;
    806     if (dst == ignoredResult()) {
     806    if (dst == generator.ignoredResult()) {
    807807        oldValue = 0;
    808808        if (m_operator == OpPlusPlus)
    … …  
    903903RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    904904{
    905     generator.emitNode(ignoredResult(), m_expr.get());
     905    generator.emitNode(generator.ignoredResult(), m_expr.get());
    906906
    907907    // delete on a non-location expression ignores the value and returns true
    … …  
    923923RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    924924{
    925     if (dst == ignoredResult()) {
    926         generator.emitNode(ignoredResult(), m_expr.get());
     925    if (dst == generator.ignoredResult()) {
     926        generator.emitNode(generator.ignoredResult(), m_expr.get());
    927927        return 0;
    928928    }
    … …  
    936936{
    937937    if (RegisterID* local = generator.registerFor(m_ident)) {
    938         if (dst == ignoredResult())
     938        if (dst == generator.ignoredResult())
    939939            return 0;
    940940        return generator.emitTypeOf(generator.finalDestination(dst), local);
    … …  
    943943    RefPtr<RegisterID> scratch = generator.emitResolveBase(generator.tempDestination(dst), m_ident);
    944944    generator.emitGetById(scratch.get(), scratch.get(), m_ident);
    945     if (dst == ignoredResult())
     945    if (dst == generator.ignoredResult())
    946946        return 0;
    947947    return generator.emitTypeOf(generator.finalDestination(dst, scratch.get()), scratch.get());
    … …  
    962962RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    963963{
    964     if (dst == ignoredResult()) {
    965         generator.emitNode(ignoredResult(), m_expr.get());
     964    if (dst == generator.ignoredResult()) {
     965        generator.emitNode(generator.ignoredResult(), m_expr.get());
    966966        return 0;
    967967    }
    … …  
    976976    if (RegisterID* local = generator.registerFor(m_ident)) {
    977977        if (generator.isLocalConstant(m_ident)) {
    978             if (dst == ignoredResult())
     978            if (dst == generator.ignoredResult())
    979979                return 0;
    980980            RefPtr<RegisterID> r0 = generator.emitUnexpectedLoad(generator.finalDestination(dst), (m_operator == OpPlusPlus) ? 1.0 : -1.0);
    … …  
    13601360    JSObject* globalObject = 0;
    13611361    if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
    1362         if (dst == ignoredResult())
     1362        if (dst == generator.ignoredResult())
    13631363            dst = 0;
    13641364        RegisterID* value = generator.emitNode(dst, m_right.get());
    … …  
    13681368
    13691369    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
    1370     if (dst == ignoredResult())
     1370    if (dst == generator.ignoredResult())
    13711371        dst = 0;
    13721372    RegisterID* value = generator.emitNode(dst, m_right.get());
    … …  
    15131513RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    15141514{
    1515     generator.emitNode(ignoredResult(), m_expr1.get());
     1515    generator.emitNode(generator.ignoredResult(), m_expr1.get());
    15161516    return generator.emitNode(dst, m_expr2.get());
    15171517}
    … …  
    18211821RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    18221822{
    1823     if (dst == ignoredResult())
     1823    if (dst == generator.ignoredResult())
    18241824        dst = 0;
    18251825
    … …  
    18291829
    18301830    if (m_expr1)
    1831         generator.emitNode(ignoredResult(), m_expr1.get());
     1831        generator.emitNode(generator.ignoredResult(), m_expr1.get());
    18321832
    18331833    RefPtr<Label> condition = generator.newLabel();
    … …  
    18431843    generator.emitLabel(scope->continueTarget());
    18441844    if (m_expr3)
    1845         generator.emitNode(ignoredResult(), m_expr3.get());
     1845        generator.emitNode(generator.ignoredResult(), m_expr3.get());
    18461846
    18471847    generator.emitLabel(condition.get());
    … …  
    19091909
    19101910    if (m_init)
    1911         generator.emitNode(ignoredResult(), m_init.get());
     1911        generator.emitNode(generator.ignoredResult(), m_init.get());
    19121912    RegisterID* forInBase = generator.emitNode(m_expr.get());
    19131913    RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), forInBase);
    … …  
    20092009        return emitThrowError(generator, SyntaxError, "Invalid return statement.");
    20102010
    2011     if (dst == ignoredResult())
     2011    if (dst == generator.ignoredResult())
    20122012        dst = 0;
    20132013    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value.get()) : generator.emitLoad(dst, jsUndefined());
    … …  
    22862286RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
    22872287{
    2288     if (dst == ignoredResult())
     2288    if (dst == generator.ignoredResult())
    22892289        dst = 0;
    22902290    RefPtr<RegisterID> expr = generator.emitNode(dst, m_expr.get());
    … …  
    25592559{
    25602560    generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
    2561     statementListEmitCode(children(), generator, ignoredResult());
     2561    statementListEmitCode(children(), generator, generator.ignoredResult());
    25622562    if (!children().size() || !children().last()->isReturnNode()) {
    25632563        RegisterID* r0 = generator.emitLoad(0, jsUndefined());
    … …  
    26312631}
    26322632
    2633 RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator&, RegisterID* dst)
    2634 {
    2635     if (dst == ignoredResult())
     2633RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
     2634{
     2635    if (dst == generator.ignoredResult())
    26362636        dst = 0;
    26372637    return dst;
Note: See TracChangeset for help on using the changeset viewer.