Title: [242859] branches/safari-607-branch
- Revision
- 242859
- Author
- [email protected]
- Date
- 2019-03-13 01:24:45 -0700 (Wed, 13 Mar 2019)
Log Message
Cherry-pick r242667. rdar://problem/48839311
Stack overflow crash in JSC::JSObject::hasInstance.
https://bugs.webkit.org/show_bug.cgi?id=195458
<rdar://problem/48710195>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/stack-overflow-in-custom-hasInstance.js: Added.
Source/_javascript_Core:
* runtime/JSObject.cpp:
(JSC::JSObject::hasInstance):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-607-branch/JSTests/ChangeLog (242858 => 242859)
--- branches/safari-607-branch/JSTests/ChangeLog 2019-03-13 08:24:42 UTC (rev 242858)
+++ branches/safari-607-branch/JSTests/ChangeLog 2019-03-13 08:24:45 UTC (rev 242859)
@@ -1,5 +1,38 @@
2019-03-13 Babak Shafiei <[email protected]>
+ Cherry-pick r242667. rdar://problem/48839311
+
+ Stack overflow crash in JSC::JSObject::hasInstance.
+ https://bugs.webkit.org/show_bug.cgi?id=195458
+ <rdar://problem/48710195>
+
+ Reviewed by Yusuke Suzuki.
+
+ JSTests:
+
+ * stress/stack-overflow-in-custom-hasInstance.js: Added.
+
+ Source/_javascript_Core:
+
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::hasInstance):
+
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-08 Mark Lam <[email protected]>
+
+ Stack overflow crash in JSC::JSObject::hasInstance.
+ https://bugs.webkit.org/show_bug.cgi?id=195458
+ <rdar://problem/48710195>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/stack-overflow-in-custom-hasInstance.js: Added.
+
+2019-03-13 Babak Shafiei <[email protected]>
+
Cherry-pick r242569. rdar://problem/48839273
Air::reportUsedRegisters must padInterference
Added: branches/safari-607-branch/JSTests/stress/stack-overflow-in-custom-hasInstance.js (0 => 242859)
--- branches/safari-607-branch/JSTests/stress/stack-overflow-in-custom-hasInstance.js (rev 0)
+++ branches/safari-607-branch/JSTests/stress/stack-overflow-in-custom-hasInstance.js 2019-03-13 08:24:45 UTC (rev 242859)
@@ -0,0 +1,28 @@
+//@ requireOptions("--maxPerThreadStackUsage=147456", "--exceptionStackTraceLimit=1", "--defaultErrorStackTraceLimit=1")
+
+function f() {}
+
+var fn = f;
+for (var i = 0; i < 100000; ++i) {
+ fn = fn.bind();
+
+ // Ensure we don't fallback to @@hasInstance from %FunctionPrototype%.
+ Object.defineProperty(fn, Symbol.hasInstance, {
+ value: undefined, writable: true, enumerable: true, writable: true
+ });
+
+ // Prevent generating overlong names of the form "bound bound bound [...] f".
+ Object.defineProperty(fn, "name", {
+ value: "", writable: true, enumerable: true, writable: true
+ });
+}
+
+var exception;
+try {
+ ({}) instanceof fn;
+} catch (e) {
+ exception = e;
+}
+
+if (exception != "RangeError: Maximum call stack size exceeded.")
+ throw "FAILED";
Modified: branches/safari-607-branch/Source/_javascript_Core/ChangeLog (242858 => 242859)
--- branches/safari-607-branch/Source/_javascript_Core/ChangeLog 2019-03-13 08:24:42 UTC (rev 242858)
+++ branches/safari-607-branch/Source/_javascript_Core/ChangeLog 2019-03-13 08:24:45 UTC (rev 242859)
@@ -1,5 +1,39 @@
2019-03-13 Babak Shafiei <[email protected]>
+ Cherry-pick r242667. rdar://problem/48839311
+
+ Stack overflow crash in JSC::JSObject::hasInstance.
+ https://bugs.webkit.org/show_bug.cgi?id=195458
+ <rdar://problem/48710195>
+
+ Reviewed by Yusuke Suzuki.
+
+ JSTests:
+
+ * stress/stack-overflow-in-custom-hasInstance.js: Added.
+
+ Source/_javascript_Core:
+
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::hasInstance):
+
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@242667 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-08 Mark Lam <[email protected]>
+
+ Stack overflow crash in JSC::JSObject::hasInstance.
+ https://bugs.webkit.org/show_bug.cgi?id=195458
+ <rdar://problem/48710195>
+
+ Reviewed by Yusuke Suzuki.
+
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::hasInstance):
+
+2019-03-13 Babak Shafiei <[email protected]>
+
Cherry-pick r242569. rdar://problem/48839273
Air::reportUsedRegisters must padInterference
Modified: branches/safari-607-branch/Source/_javascript_Core/runtime/JSObject.cpp (242858 => 242859)
--- branches/safari-607-branch/Source/_javascript_Core/runtime/JSObject.cpp 2019-03-13 08:24:42 UTC (rev 242858)
+++ branches/safari-607-branch/Source/_javascript_Core/runtime/JSObject.cpp 2019-03-13 08:24:45 UTC (rev 242859)
@@ -46,6 +46,7 @@
#include "ProxyObject.h"
#include "SlotVisitorInlines.h"
#include "TypeError.h"
+#include "VMInlines.h"
#include <math.h>
#include <wtf/Assertions.h>
@@ -2206,8 +2207,13 @@
RETURN_IF_EXCEPTION(scope, false);
RELEASE_AND_RETURN(scope, defaultHasInstance(exec, value, prototype));
}
- if (info.implementsHasInstance())
+ if (info.implementsHasInstance()) {
+ if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+ throwStackOverflowError(exec, scope);
+ return false;
+ }
RELEASE_AND_RETURN(scope, methodTable(vm)->customHasInstance(this, exec, value));
+ }
throwException(exec, scope, createInvalidInstanceofParameterErrorNotFunction(exec, this));
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
