[v8-dev] Properly handle stack overflows in the AST graph builder. (issue 697473006 by [email protected])

Fri, 31 Oct 2014 06:24:27 -0700 

Reviewers: jarin,

Description:
Properly handle stack overflows in the AST graph builder.

[email protected]
BUG=chromium:429159
TEST=mjsunit/regress/regress-crbug-429159

Please review this at https://codereview.chromium.org/697473006/

Base URL: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files (+24, -7 lines):
  M src/compiler/ast-graph-builder.h
  M src/compiler/ast-graph-builder.cc
  M src/compiler/pipeline.cc
  A + test/mjsunit/regress/regress-crbug-429159.js


Index: src/compiler/ast-graph-builder.cc
diff --git a/src/compiler/ast-graph-builder.cc b/src/compiler/ast-graph-builder.cc index d7bae5a4197b612cdec3abb69fc4396a8970eeb4..7b5abd191cfe4c12dd2651d953516099833bc168 100644 
--- a/src/compiler/ast-graph-builder.cc
+++ b/src/compiler/ast-graph-builder.cc
@@ -339,24 +339,40 @@ void AstGraphBuilder::VisitForValues(ZoneList<Expression*>* exprs) { 

 void AstGraphBuilder::VisitForValue(Expression* expr) {
   AstValueContext for_value(this);
-  if (!HasStackOverflow()) {
+  if (!CheckStackOverflow()) {
     expr->Accept(this);
+  } else {
+    ast_context()->ProduceValue(jsgraph()->UndefinedConstant());
   }
 }


 void AstGraphBuilder::VisitForEffect(Expression* expr) {
   AstEffectContext for_effect(this);
-  if (!HasStackOverflow()) {
+  if (!CheckStackOverflow()) {
     expr->Accept(this);
+  } else {
+    ast_context()->ProduceValue(jsgraph()->UndefinedConstant());
   }
 }


 void AstGraphBuilder::VisitForTest(Expression* expr) {
   AstTestContext for_condition(this);
-  if (!HasStackOverflow()) {
+  if (!CheckStackOverflow()) {
     expr->Accept(this);
+  } else {
+    ast_context()->ProduceValue(jsgraph()->UndefinedConstant());
+  }
+}
+
+
+void AstGraphBuilder::Visit(Expression* expr) {
+  // Reuses enclosing AstContext.
+  if (!CheckStackOverflow()) {
+    expr->Accept(this);
+  } else {
+    ast_context()->ProduceValue(jsgraph()->UndefinedConstant());
   }
 }

Index: src/compiler/ast-graph-builder.h
diff --git a/src/compiler/ast-graph-builder.h b/src/compiler/ast-graph-builder.h index 441917fca9efd1bd9d208b5adac8b8fde5743540..6e51723e049f5718928a0047809fc95dab1e7681 100644 
--- a/src/compiler/ast-graph-builder.h
+++ b/src/compiler/ast-graph-builder.h
@@ -159,6 +159,7 @@ class AstGraphBuilder : public StructuredGraphBuilder, public AstVisitor { 
   void VisitIfNotNull(Statement* stmt);

   // Visit expressions.
+  void Visit(Expression* expr);
   void VisitForTest(Expression* expr);
   void VisitForEffect(Expression* expr);
   void VisitForValue(Expression* expr);
Index: src/compiler/pipeline.cc
diff --git a/src/compiler/pipeline.cc b/src/compiler/pipeline.cc
index 0dcb4086c896c07de9ca67512e407231afcae272..d1df843294bbdf6149499c08d854894243458bac 100644 
--- a/src/compiler/pipeline.cc
+++ b/src/compiler/pipeline.cc
@@ -319,7 +319,7 @@ Handle<Code> Pipeline::GenerateCode() {
     ZonePool::Scope zone_scope(data.zone_pool());
     AstGraphBuilderWithPositions graph_builder(
zone_scope.zone(), info(), data.jsgraph(), data.source_positions()); 
-    graph_builder.CreateGraph();
+    if (!graph_builder.CreateGraph()) return Handle<Code>::null();
     context_node = graph_builder.GetFunctionContext();
   }

Index: test/mjsunit/regress/regress-crbug-429159.js
diff --git a/test/mjsunit/readonly-accessor.js b/test/mjsunit/regress/regress-crbug-429159.js 
similarity index 65%
copy from test/mjsunit/readonly-accessor.js
copy to test/mjsunit/regress/regress-crbug-429159.js
index 5a73525fea60d67074d81e392d08d8448f8ae39d..08e78d9936236832c0beb381f4120ba4d46086f4 100644 
--- a/test/mjsunit/readonly-accessor.js
+++ b/test/mjsunit/regress/regress-crbug-429159.js
@@ -2,6 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-var foo = {};
-foo.__proto__ = new String("bar");
-foo.length = 20;
+var src = "return " + Array(12000).join("src,") + "src";
+var fun = Function(src);
+fun();


--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
--- You received this message because you are subscribed to the Google Groups "v8-dev" group. 
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to