Changeset 63237 in webkit for trunk/JavaScriptCore/jit/JITOpcodes32_64.cpp

Timestamp:

Jul 13, 2010, 12:57:08 PM (15 years ago)

Author:

[email protected]

Message:

2010-07-12 Oliver Hunt <​[email protected]>

Reviewed by Gavin Barraclough.

REGRESSION: Crash at JSC::JIT::privateCompile(JSC::MacroAssemblerCodePtr*)
​https://bugs.webkit.org/show_bug.cgi?id=41763

There are two parts to this patch, the first is to fix the actual
problem. When calling copyStringWithoutBOMs on a string we know
to contain BOMs we return a value indicating that there are no
BOMs.

The second part of this fix is simply to harden the path that
led to a crash when parsing failed.

• jit/JITOpcodes.cpp: (JSC::JIT::privateCompileCTIMachineTrampolines):
• jit/JITOpcodes32_64.cpp: (JSC::JIT::privateCompileCTIMachineTrampolines):
• jit/JITStubs.cpp: (JSC::DEFINE_STUB_FUNCTION):

Harden compilation stubs against parser failure.

• parser/Lexer.cpp: (JSC::Lexer::sourceCode):

Add assertions to ensure that subranges into a source provider
are always actually braces. Hopefully this should catch similar
failures in future. These assertions fire on existing tests
without this fix.

• runtime/Executable.h: (JSC::FunctionExecutable::tryJitCodeForCall): (JSC::FunctionExecutable::tryJitCodeForConstruct):
• wtf/text/StringImpl.h: (WebCore::StringImpl::copyStringWithoutBOMs):

Make copyStringWithBOMs do the right thing.

File:

• trunk/JavaScriptCore/jit/JITOpcodes32_64.cpp (modified) (4 diffs)

trunk/JavaScriptCore/jit/JITOpcodes32_64.cpp

@@ -65 +65 @@
     ret();
 #endif
-
+    
+    JumpList callLinkFailures;
     // (2) Trampolines for the slow cases of op_call / op_call_eval / op_construct.
 #if ENABLE(JIT_OPTIMIZE_CALL)
-    JumpList callLazyLinkFailures;
     // VirtualCallLink Trampoline
     // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
@@ -77 +77 @@
     restoreArgumentReference();
     Call callLazyLinkCall = call();
-    callLazyLinkFailures.append(branchTestPtr(Zero, regT0));
+    callLinkFailures.append(branchTestPtr(Zero, regT0));
     restoreReturnAddressBeforeReturn(regT3);
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT1);
@@ -91 +91 @@
     Call callLazyLinkConstruct = call();
     restoreReturnAddressBeforeReturn(regT3);
-    callLazyLinkFailures.append(branchTestPtr(Zero, regT0));
+    callLinkFailures.append(branchTestPtr(Zero, regT0));
     emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT1);
     jump(regT0);
 
+#endif // ENABLE(JIT_OPTIMIZE_CALL)
+
+    // VirtualCall Trampoline
+    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
+    Label virtualCallBegin = align();
+    compileOpCallInitializeCallFrame();
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+
+    Jump hasCodeBlock3 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), Imm32(0));
+    preserveReturnAddressAfterCall(regT3);
+    restoreArgumentReference();
+    Call callCompileCall = call();
+    callLinkFailures.append(branchTestPtr(Zero, regT0));
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    hasCodeBlock3.link(this);
+
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCodeForCallWithArityCheck)), regT0);
+    jump(regT0);
+
+    // VirtualConstruct Trampoline
+    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
+    Label virtualConstructBegin = align();
+    compileOpCallInitializeCallFrame();
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+
+    Jump hasCodeBlock4 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), Imm32(0));
+    preserveReturnAddressAfterCall(regT3);
+    restoreArgumentReference();
+    Call callCompileCconstruct = call();
+    callLinkFailures.append(branchTestPtr(Zero, regT0));
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    hasCodeBlock4.link(this);
+
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCodeForConstructWithArityCheck)), regT0);
+    jump(regT0);
+    
     // If the parser fails we want to be able to be able to keep going,
     // So we handle this as a parse failure.
-    callLazyLinkFailures.link(this);
+    callLinkFailures.link(this);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
@@ -106 +148 @@
     poke(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()));
     ret();
-
-#endif // ENABLE(JIT_OPTIMIZE_CALL)
-
-    // VirtualCall Trampoline
-    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
-    Label virtualCallBegin = align();
-    compileOpCallInitializeCallFrame();
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
-
-    Jump hasCodeBlock3 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForCall)), Imm32(0));
-    preserveReturnAddressAfterCall(regT3);
-    restoreArgumentReference();
-    Call callCompileCall = call();
-    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT1);
-    restoreReturnAddressBeforeReturn(regT3);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
-    hasCodeBlock3.link(this);
-
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCodeForCallWithArityCheck)), regT0);
-    jump(regT0);
-
-    // VirtualConstruct Trampoline
-    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.
-    Label virtualConstructBegin = align();
-    compileOpCallInitializeCallFrame();
-
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
-
-    Jump hasCodeBlock4 = branch32(GreaterThanOrEqual, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParametersForConstruct)), Imm32(0));
-    preserveReturnAddressAfterCall(regT3);
-    restoreArgumentReference();
-    Call callCompileCconstruct = call();
-    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT1);
-    restoreReturnAddressBeforeReturn(regT3);
-    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
-    hasCodeBlock4.link(this);
-
-    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCodeForConstructWithArityCheck)), regT0);
-    jump(regT0);
 
     // NativeCall Trampoline