Revision: 11260
Author: [email protected]
Date: Wed Apr 11 00:45:41 2012
Log: Merged r11219, r11220, r11236, r11238 into 3.9 branch.
Fix stack overflow crashes when entering the debugger.
BUG=chromium:119429
[email protected]
Review URL: https://chromiumcodereview.appspot.com/10027028
http://code.google.com/p/v8/source/detail?r=11260
Added:
/branches/3.9/test/mjsunit/regress/regress-119429.js
Modified:
/branches/3.9/src/bootstrapper.cc
/branches/3.9/src/debug.cc
/branches/3.9/src/execution.cc
/branches/3.9/src/flag-definitions.h
/branches/3.9/src/version.cc
=======================================
--- /dev/null
+++ /branches/3.9/test/mjsunit/regress/regress-119429.js Wed Apr 11
00:45:41 2012
@@ -0,0 +1,37 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var d = 0;
+function recurse() {
+ if (++d == 25135) { // A magic number just below stack overflow on ia32
+ %DebugBreak();
+ }
+ recurse();
+}
+assertThrows(function() { recurse();} );
=======================================
--- /branches/3.9/src/bootstrapper.cc Mon Mar 12 01:18:42 2012
+++ /branches/3.9/src/bootstrapper.cc Wed Apr 11 00:45:41 2012
@@ -1301,6 +1301,12 @@
#ifdef ENABLE_DEBUGGER_SUPPORT
isolate->debugger()->set_compiling_natives(true);
#endif
+ // During genesis, the boilerplate for stack overflow won't work until
the
+ // environment has been at least partially initialized. Add a stack check
+ // before entering JS code to catch overflow early.
+ StackLimitCheck check(Isolate::Current());
+ if (check.HasOverflowed()) return false;
+
bool result = CompileScriptCached(name,
source,
NULL,
@@ -2289,6 +2295,12 @@
HandleScope scope;
SaveContext saved_context(isolate);
+ // During genesis, the boilerplate for stack overflow won't work until
the
+ // environment has been at least partially initialized. Add a stack check
+ // before entering JS code to catch overflow early.
+ StackLimitCheck check(Isolate::Current());
+ if (check.HasOverflowed()) return;
+
Handle<Context> new_context = Snapshot::NewContextFromSnapshot();
if (!new_context.is_null()) {
global_context_ =
=======================================
--- /branches/3.9/src/debug.cc Mon Mar 19 04:01:52 2012
+++ /branches/3.9/src/debug.cc Wed Apr 11 00:45:41 2012
@@ -1,4 +1,4 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
+// Copyright 2012 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -767,15 +767,22 @@
Handle<JSFunction> function =
factory->NewFunctionFromSharedFunctionInfo(function_info, context);
- Execution::TryCall(function, Handle<Object>(context->global()),
- 0, NULL, &caught_exception);
+ Handle<Object> exception =
+ Execution::TryCall(function, Handle<Object>(context->global()),
+ 0, NULL, &caught_exception);
// Check for caught exceptions.
if (caught_exception) {
+ ASSERT(!isolate->has_pending_exception());
+ MessageLocation computed_location;
+ isolate->ComputeLocation(&computed_location);
Handle<Object> message = MessageHandler::MakeMessageObject(
- "error_loading_debugger", NULL, Vector<Handle<Object> >::empty(),
- Handle<String>(), Handle<JSArray>());
+ "error_loading_debugger", &computed_location,
+ Vector<Handle<Object> >::empty(), Handle<String>(),
Handle<JSArray>());
+ ASSERT(!isolate->has_pending_exception());
+ isolate->set_pending_exception(*exception);
MessageHandler::ReportMessage(Isolate::Current(), NULL, message);
+ isolate->clear_pending_exception();
return false;
}
@@ -813,6 +820,9 @@
v8::Handle<ObjectTemplate>(),
NULL);
+ // Fail if no context could be created.
+ if (context.is_null()) return false;
+
// Use the debugger context.
SaveContext save(isolate_);
isolate_->set_context(*context);
@@ -3239,7 +3249,7 @@
debug->SetBreak(break_frame_id_, break_id_);
// Check for leaving the debugger.
- if (prev_ == NULL) {
+ if (!load_failed_ && prev_ == NULL) {
// Clear mirror cache when leaving the debugger. Skip this if there is
a
// pending exception as clearing the mirror cache calls back into
// JavaScript. This can happen if the v8::Debug::Call is used in which
=======================================
--- /branches/3.9/src/execution.cc Wed Mar 14 04:16:03 2012
+++ /branches/3.9/src/execution.cc Wed Apr 11 00:45:41 2012
@@ -825,6 +825,11 @@
if (isolate->bootstrapper()->IsActive()) {
return isolate->heap()->undefined_value();
}
+
+ StackLimitCheck check(isolate);
+ if (check.HasOverflowed()) {
+ return isolate->heap()->undefined_value();
+ }
{
JavaScriptFrameIterator it(isolate);
@@ -861,6 +866,11 @@
Isolate* isolate = Isolate::Current();
// Clear the debug command request flag.
isolate->stack_guard()->Continue(DEBUGCOMMAND);
+
+ StackLimitCheck check(isolate);
+ if (check.HasOverflowed()) {
+ return;
+ }
HandleScope scope(isolate);
// Enter the debugger. Just continue if we fail to enter the debugger.
=======================================
--- /branches/3.9/src/flag-definitions.h Wed Mar 28 00:54:11 2012
+++ /branches/3.9/src/flag-definitions.h Wed Apr 11 00:45:41 2012
@@ -310,7 +310,9 @@
DEFINE_bool(break_on_abort, true, "always cause a debug break before
aborting")
// execution.cc
-DEFINE_int(stack_size, kPointerSize * 128,
+// Slightly less than 1MB on 64-bit, since Windows' default stack size for
+// the main execution thread is 1MB for both 32 and 64-bit.
+DEFINE_int(stack_size, kPointerSize * 123,
"default size of stack region v8 is allowed to use (in kBytes)")
// frames.cc
=======================================
--- /branches/3.9/src/version.cc Tue Apr 10 08:04:02 2012
+++ /branches/3.9/src/version.cc Wed Apr 11 00:45:41 2012
@@ -35,7 +35,7 @@
#define MAJOR_VERSION 3
#define MINOR_VERSION 9
#define BUILD_NUMBER 24
-#define PATCH_LEVEL 8
+#define PATCH_LEVEL 9
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
#define IS_CANDIDATE_VERSION 0
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
