Ignore:
Timestamp:
Dec 7, 2009, 3:14:04 PM (15 years ago)
Author:
[email protected]
Message:

​https://bugs.webkit.org/show_bug.cgi?id=32184
Handle out-of-memory conditions with JSC Ropes with a JS exception, rather than crashing.
Switch from using fastMalloc to tryFastMalloc, pass an ExecState to record the exception on.

Reviewed by Oliver Hunt.

JavaScriptCore:

  • API/JSCallbackObjectFunctions.h:

(JSC::::toString):

  • API/JSValueRef.cpp:

(JSValueIsStrictEqual):

(JSC::BytecodeGenerator::emitEqualityOp):

  • debugger/DebuggerCallFrame.cpp:

(JSC::DebuggerCallFrame::functionName):
(JSC::DebuggerCallFrame::calculatedFunctionName):

  • interpreter/Interpreter.cpp:

(JSC::Interpreter::callEval):
(JSC::Interpreter::privateExecute):

  • jit/JITStubs.cpp:

(JSC::DEFINE_STUB_FUNCTION):

  • profiler/ProfileGenerator.cpp:

(JSC::ProfileGenerator::addParentForConsoleStart):

  • profiler/Profiler.cpp:

(JSC::Profiler::willExecute):
(JSC::Profiler::didExecute):
(JSC::Profiler::createCallIdentifier):
(JSC::createCallIdentifierFromFunctionImp):

  • profiler/Profiler.h:
  • runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncIndexOf):
(JSC::arrayProtoFuncLastIndexOf):

  • runtime/DateConstructor.cpp:

(JSC::constructDate):

  • runtime/FunctionPrototype.cpp:

(JSC::functionProtoFuncToString):

  • runtime/InternalFunction.cpp:

(JSC::InternalFunction::name):
(JSC::InternalFunction::displayName):
(JSC::InternalFunction::calculatedDisplayName):

  • runtime/InternalFunction.h:
  • runtime/JSCell.cpp:

(JSC::JSCell::getString):

  • runtime/JSCell.h:

(JSC::JSValue::getString):

  • runtime/JSONObject.cpp:

(JSC::gap):
(JSC::Stringifier::Stringifier):
(JSC::Stringifier::appendStringifiedValue):

  • runtime/JSObject.cpp:

(JSC::JSObject::putDirectFunction):
(JSC::JSObject::putDirectFunctionWithoutTransition):
(JSC::JSObject::defineOwnProperty):

  • runtime/JSObject.h:
  • runtime/JSPropertyNameIterator.cpp:

(JSC::JSPropertyNameIterator::get):

  • runtime/JSString.cpp:

(JSC::JSString::Rope::~Rope):
(JSC::JSString::resolveRope):
(JSC::JSString::getPrimitiveNumber):
(JSC::JSString::toNumber):
(JSC::JSString::toString):
(JSC::JSString::toThisString):
(JSC::JSString::getStringPropertyDescriptor):

  • runtime/JSString.h:

(JSC::JSString::Rope::createOrNull):
(JSC::JSString::Rope::operator new):
(JSC::JSString::value):
(JSC::JSString::tryGetValue):
(JSC::JSString::getIndex):
(JSC::JSString::getStringPropertySlot):
(JSC::JSValue::toString):

  • runtime/JSValue.h:
  • runtime/NativeErrorConstructor.cpp:

(JSC::NativeErrorConstructor::NativeErrorConstructor):

  • runtime/Operations.cpp:

(JSC::JSValue::strictEqualSlowCase):

  • runtime/Operations.h:

(JSC::JSValue::equalSlowCaseInline):
(JSC::JSValue::strictEqualSlowCaseInline):
(JSC::JSValue::strictEqual):
(JSC::jsLess):
(JSC::jsLessEq):
(JSC::jsAdd):
(JSC::concatenateStrings):

  • runtime/PropertyDescriptor.cpp:

(JSC::PropertyDescriptor::equalTo):

  • runtime/PropertyDescriptor.h:
  • runtime/StringPrototype.cpp:

(JSC::stringProtoFuncReplace):
(JSC::stringProtoFuncToLowerCase):
(JSC::stringProtoFuncToUpperCase):

WebCore:

  • bindings/ScriptControllerBase.cpp:

(WebCore::ScriptController::executeIfJavaScriptURL):

  • bindings/js/JSCanvasRenderingContext2DCustom.cpp:

(WebCore::toHTMLCanvasStyle):
(WebCore::JSCanvasRenderingContext2D::setFillColor):
(WebCore::JSCanvasRenderingContext2D::setStrokeColor):
(WebCore::JSCanvasRenderingContext2D::setShadow):

  • bindings/js/ScriptCallStack.cpp:

(WebCore::ScriptCallStack::ScriptCallStack):
(WebCore::ScriptCallStack::initialize):

  • bindings/js/ScriptValue.cpp:

(WebCore::ScriptValue::getString):

  • bindings/js/ScriptValue.h:
  • bindings/js/SerializedScriptValue.cpp:

(WebCore::SerializingTreeWalker::convertIfTerminal):

  • bindings/objc/WebScriptObject.mm:

(+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):

  • page/Console.cpp:

(WebCore::Console::addMessage):

WebKit/mac:

  • WebView/WebView.mm:

(aeDescFromJSValue):

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/JavaScriptCore/jit/JITStubs.cpp

    r51735 r51801  
    10451045    if (leftIsString && v2.isString()) {
    10461046        if (asString(v1)->isRope() || asString(v2)->isRope()) {
    1047             RefPtr<JSString::Rope> rope = JSString::Rope::create(2);
     1047            RefPtr<JSString::Rope> rope = JSString::Rope::createOrNull(2);
     1048            if (UNLIKELY(!rope)) {
     1049                throwOutOfMemoryError(callFrame);
     1050                VM_THROW_EXCEPTION();
     1051            }
    10481052            rope->initializeFiber(0, asString(v1));
    10491053            rope->initializeFiber(1, asString(v2));
    … …  
    10521056        }
    10531057
    1054         RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
     1058        RefPtr<UString::Rep> value = concatenate(asString(v1)->value(callFrame).rep(), asString(v2)->value(callFrame).rep());
    10551059        if (UNLIKELY(!value)) {
    10561060            throwOutOfMemoryError(callFrame);
    … …  
    10631067    if (rightIsNumber & leftIsString) {
    10641068        RefPtr<UString::Rep> value = v2.isInt32() ?
    1065             concatenate(asString(v1)->value().rep(), v2.asInt32()) :
    1066             concatenate(asString(v1)->value().rep(), right);
     1069            concatenate(asString(v1)->value(callFrame).rep(), v2.asInt32()) :
     1070            concatenate(asString(v1)->value(callFrame).rep(), right);
    10671071
    10681072        if (UNLIKELY(!value)) {
    … …  
    18891893            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
    18901894            ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_string));
    1891             result = asString(baseValue)->getIndex(stackFrame.globalData, i);
     1895            result = asString(baseValue)->getIndex(callFrame, i);
    18921896        } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
    18931897            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
    … …  
    19201924        uint32_t i = subscript.asUInt32();
    19211925        if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
    1922             result = asString(baseValue)->getIndex(stackFrame.globalData, i);
     1926            result = asString(baseValue)->getIndex(callFrame, i);
    19231927        else {
    19241928            result = baseValue.get(callFrame, i);
    … …  
    24232427    if (cell1->isString()) {
    24242428        if (src2.isInt32())
    2425             return static_cast<JSString*>(cell1)->value().toDouble() == src2.asInt32();
     2429            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == src2.asInt32();
    24262430           
    24272431        if (src2.isDouble())
    2428             return static_cast<JSString*>(cell1)->value().toDouble() == src2.asDouble();
     2432            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == src2.asDouble();
    24292433
    24302434        if (src2.isTrue())
    2431             return static_cast<JSString*>(cell1)->value().toDouble() == 1.0;
     2435            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == 1.0;
    24322436
    24332437        if (src2.isFalse())
    2434             return static_cast<JSString*>(cell1)->value().toDouble() == 0.0;
     2438            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame).toDouble() == 0.0;
    24352439
    24362440        JSCell* cell2 = asCell(src2);
    24372441        if (cell2->isString())
    2438             return static_cast<JSString*>(cell1)->value() == static_cast<JSString*>(cell2)->value();
     2442            return static_cast<JSString*>(cell1)->value(stackFrame.callFrame) == static_cast<JSString*>(cell2)->value(stackFrame.callFrame);
    24392443
    24402444        src2 = asObject(cell2)->toPrimitive(stackFrame.callFrame);
    … …  
    24592463    ASSERT(string1->isString());
    24602464    ASSERT(string2->isString());
    2461     return string1->value() == string2->value();
     2465    return string1->value(stackFrame.callFrame) == string2->value(stackFrame.callFrame);
    24622466}
    24632467
    … …  
    27572761    JSObject* base = stackFrame.args[0].jsObject();
    27582762    JSString* property = stackFrame.args[1].jsString();
    2759     return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value()));
     2763    return base->hasProperty(stackFrame.callFrame, Identifier(stackFrame.callFrame, property->value(stackFrame.callFrame)));
    27602764}
    27612765
    … …  
    28342838    JSValue src2 = stackFrame.args[1].jsValue();
    28352839
    2836     return JSValue::encode(jsBoolean(JSValue::strictEqual(src1, src2)));
     2840    return JSValue::encode(jsBoolean(JSValue::strictEqual(stackFrame.callFrame, src1, src2)));
    28372841}
    28382842
    … …  
    28482852    STUB_INIT_STACK_FRAME(stackFrame);
    28492853
    2850     return JSValue::encode(concatenateStrings(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32()));
     2854    JSValue result = concatenateStrings(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32());
     2855    CHECK_FOR_EXCEPTION_AT_END();
     2856    return JSValue::encode(result);
    28512857}
    28522858
    … …  
    28582864    JSValue src2 = stackFrame.args[1].jsValue();
    28592865
    2860     return JSValue::encode(jsBoolean(!JSValue::strictEqual(src1, src2)));
     2866    return JSValue::encode(jsBoolean(!JSValue::strictEqual(stackFrame.callFrame, src1, src2)));
    28612867}
    28622868
    … …  
    29672973
    29682974    if (scrutinee.isString()) {
    2969         UString::Rep* value = asString(scrutinee)->value().rep();
     2975        UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
    29702976        if (value->size() == 1)
    29712977            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->data()[0]).executableAddress();
    … …  
    29872993
    29882994    if (scrutinee.isString()) {
    2989         UString::Rep* value = asString(scrutinee)->value().rep();
     2995        UString::Rep* value = asString(scrutinee)->value(callFrame).rep();
    29902996        result = codeBlock->stringSwitchJumpTable(tableIndex).ctiForValue(value).executableAddress();
    29912997    }
Note: See TracChangeset for help on using the changeset viewer.