Diff
Modified: trunk/Source/_javascript_Core/CMakeLists.txt (275242 => 275243)
--- trunk/Source/_javascript_Core/CMakeLists.txt 2021-03-30 22:25:29 UTC (rev 275242)
+++ trunk/Source/_javascript_Core/CMakeLists.txt 2021-03-30 22:46:57 UTC (rev 275243)
@@ -1044,6 +1044,7 @@
runtime/RegExpKey.h
runtime/RegExpObject.h
runtime/RegExpStringIteratorPrototype.h
+ runtime/ResourceExhaustion.h
runtime/RuntimeFlags.h
runtime/RuntimeType.h
runtime/SamplingProfiler.h
Modified: trunk/Source/_javascript_Core/ChangeLog (275242 => 275243)
--- trunk/Source/_javascript_Core/ChangeLog 2021-03-30 22:25:29 UTC (rev 275242)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-03-30 22:46:57 UTC (rev 275243)
@@ -1,3 +1,27 @@
+2021-03-30 Mark Lam <[email protected]>
+
+ Add Options::exitOnResourceExhaustion() to enable exiting instead of crashing on resource exhaustion.
+ https://bugs.webkit.org/show_bug.cgi?id=223959
+ rdar://63934158
+
+ Reviewed by Tadeu Zagallo.
+
+ This is useful to unblock fuzzers from false positive crashes due to resource
+ exhaustion. Currently, this is only applied to StructureID exhaustion.
+
+ Since we're adding this facility, we might as well implement it in such a way that
+ it can be easily deployed for other types of resource exhaustion as well.
+
+ * CMakeLists.txt:
+ * _javascript_Core.xcodeproj/project.pbxproj:
+ * Sources.txt:
+ * runtime/OptionsList.h:
+ * runtime/ResourceExhaustion.cpp: Added.
+ (JSC::handleResourceExhaustion):
+ * runtime/ResourceExhaustion.h: Added.
+ * runtime/StructureIDTable.cpp:
+ (JSC::StructureIDTable::resize):
+
2021-03-30 Ryan Haddad <[email protected]>
Ensure that GlobalPropertyInfo is allocated on the stack.
Modified: trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj (275242 => 275243)
--- trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2021-03-30 22:25:29 UTC (rev 275242)
+++ trunk/Source/_javascript_Core/_javascript_Core.xcodeproj/project.pbxproj 2021-03-30 22:46:57 UTC (rev 275243)
@@ -1988,6 +1988,7 @@
FE912B4F2531193300FABDDF /* AbstractSlotVisitor.h in Headers */ = {isa = PBXBuildFile; fileRef = FE912B4E2531193300FABDDF /* AbstractSlotVisitor.h */; settings = {ATTRIBUTES = (Private, ); }; };
FE912B5125311AD100FABDDF /* AbstractSlotVisitorInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FE912B5025311AD100FABDDF /* AbstractSlotVisitorInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
FE99B2491C24C3D300C82159 /* JITNegGenerator.h in Headers */ = {isa = PBXBuildFile; fileRef = FE99B2481C24B6D300C82159 /* JITNegGenerator.h */; };
+ FE9F3FB92613C7890069E89F /* ResourceExhaustion.h in Headers */ = {isa = PBXBuildFile; fileRef = FE9F3FB82613C7880069E89F /* ResourceExhaustion.h */; };
FEA08620182B7A0400F6D851 /* Breakpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA0861E182B7A0400F6D851 /* Breakpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
FEA08621182B7A0400F6D851 /* DebuggerPrimitives.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */; settings = {ATTRIBUTES = (Private, ); }; };
FEA3BBA8212B655900E93AD1 /* CallFrameInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA3BBA7212B655800E93AD1 /* CallFrameInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -5354,6 +5355,8 @@
FE98B5B61BB9AE110073E7A6 /* JITSubGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITSubGenerator.h; sourceTree = "<group>"; };
FE99B2471C24B6D300C82159 /* JITNegGenerator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITNegGenerator.cpp; sourceTree = "<group>"; };
FE99B2481C24B6D300C82159 /* JITNegGenerator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JITNegGenerator.h; sourceTree = "<group>"; };
+ FE9F3FB82613C7880069E89F /* ResourceExhaustion.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceExhaustion.h; sourceTree = "<group>"; };
+ FE9F3FBA2613C87C0069E89F /* ResourceExhaustion.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceExhaustion.cpp; sourceTree = "<group>"; };
FEA0861E182B7A0400F6D851 /* Breakpoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Breakpoint.h; sourceTree = "<group>"; };
FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerPrimitives.h; sourceTree = "<group>"; };
FEA3BBA7212B655800E93AD1 /* CallFrameInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallFrameInlines.h; sourceTree = "<group>"; };
@@ -7773,6 +7776,8 @@
BCD202C00E1706A7002C7E82 /* RegExpPrototype.h */,
84925A9A22B30CBA00D1DFFF /* RegExpStringIteratorPrototype.cpp */,
84925A9B22B30CBA00D1DFFF /* RegExpStringIteratorPrototype.h */,
+ FE9F3FBA2613C87C0069E89F /* ResourceExhaustion.cpp */,
+ FE9F3FB82613C7880069E89F /* ResourceExhaustion.h */,
70B0A9D01A9B66200001306A /* RuntimeFlags.h */,
527773DD1AAF83AC00BDE7E8 /* RuntimeType.cpp */,
52C0611D1AA51E1B00B4ADBA /* RuntimeType.h */,
@@ -9493,6 +9498,7 @@
0F620177143FCD3F0068B77C /* DFGAbstractValue.h in Headers */,
0F4F11EB209D426600709654 /* DFGAbstractValueClobberEpoch.h in Headers */,
0FD3E4021B618AAF00C80E1E /* DFGAdaptiveInferredPropertyValueWatchpoint.h in Headers */,
+ FE9F3FB92613C7890069E89F /* ResourceExhaustion.h in Headers */,
0F18D3D01B55A6E0002C5C9F /* DFGAdaptiveStructureWatchpoint.h in Headers */,
0F66E16B14DF3F1600B7B2E4 /* DFGAdjacencyList.h in Headers */,
0F1E3A461534CBAF000F9456 /* DFGArgumentPosition.h in Headers */,
Modified: trunk/Source/_javascript_Core/Sources.txt (275242 => 275243)
--- trunk/Source/_javascript_Core/Sources.txt 2021-03-30 22:25:29 UTC (rev 275242)
+++ trunk/Source/_javascript_Core/Sources.txt 2021-03-30 22:46:57 UTC (rev 275243)
@@ -974,6 +974,7 @@
runtime/RegExpObject.cpp
runtime/RegExpPrototype.cpp
runtime/RegExpStringIteratorPrototype.cpp
+runtime/ResourceExhaustion.cpp
runtime/RuntimeType.cpp
runtime/SamplingCounter.cpp
runtime/SamplingProfiler.cpp
Modified: trunk/Source/_javascript_Core/runtime/OptionsList.h (275242 => 275243)
--- trunk/Source/_javascript_Core/runtime/OptionsList.h 2021-03-30 22:25:29 UTC (rev 275242)
+++ trunk/Source/_javascript_Core/runtime/OptionsList.h 2021-03-30 22:46:57 UTC (rev 275243)
@@ -376,6 +376,7 @@
\
v(Unsigned, exceptionStackTraceLimit, 100, Normal, "Stack trace limit for internal Exception object") \
v(Unsigned, defaultErrorStackTraceLimit, 100, Normal, "The default value for Error.stackTraceLimit") \
+ v(Bool, exitOnResourceExhaustion, false, Normal, nullptr) \
v(Bool, useExceptionFuzz, false, Normal, nullptr) \
v(Unsigned, fireExceptionFuzzAt, 0, Normal, nullptr) \
v(Bool, validateDFGExceptionHandling, false, Normal, "Causes the DFG to emit code validating exception handling for each node that can exit") /* This is true by default on Debug builds */\
Added: trunk/Source/_javascript_Core/runtime/ResourceExhaustion.cpp (0 => 275243)
--- trunk/Source/_javascript_Core/runtime/ResourceExhaustion.cpp (rev 0)
+++ trunk/Source/_javascript_Core/runtime/ResourceExhaustion.cpp 2021-03-30 22:46:57 UTC (rev 275243)
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2021 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ResourceExhaustion.h"
+
+#include "Options.h"
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+NO_RETURN_DUE_TO_CRASH void handleResourceExhaustion(const char* file, int line, const char* function, const char* assertion, ResourceExhaustionCode exitCode, const char* exitCodeAsString, const char* failureMessage)
+{
+ WTFReportAssertionFailureWithMessage(file, line, function, assertion, "%s: %s", exitCodeAsString, failureMessage);
+ if (Options::exitOnResourceExhaustion())
+ exit(exitCode);
+ CRASH();
+}
+
+} // namespace JSC
Added: trunk/Source/_javascript_Core/runtime/ResourceExhaustion.h (0 => 275243)
--- trunk/Source/_javascript_Core/runtime/ResourceExhaustion.h (rev 0)
+++ trunk/Source/_javascript_Core/runtime/ResourceExhaustion.h 2021-03-30 22:46:57 UTC (rev 275243)
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2021 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+enum ResourceExhaustionCode {
+ StructureIDExhaustion = 30,
+};
+
+#define RELEASE_ASSERT_RESOURCE_AVAILABLE(assertion, resourceExhaustionCode, failureMessage) do { \
+ if (UNLIKELY(!(assertion))) \
+ handleResourceExhaustion(__FILE__, __LINE__, WTF_PRETTY_FUNCTION, #assertion, resourceExhaustionCode, #resourceExhaustionCode, failureMessage); \
+ } while (false)
+
+NO_RETURN_DUE_TO_CRASH void handleResourceExhaustion(const char* file, int line, const char* function, const char* assertion, ResourceExhaustionCode, const char* resourceExhaustionCodeAsString, const char* failureMessage);
+
+} // namespace JSC
Modified: trunk/Source/_javascript_Core/runtime/StructureIDTable.cpp (275242 => 275243)
--- trunk/Source/_javascript_Core/runtime/StructureIDTable.cpp 2021-03-30 22:25:29 UTC (rev 275242)
+++ trunk/Source/_javascript_Core/runtime/StructureIDTable.cpp 2021-03-30 22:46:57 UTC (rev 275243)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
#include "config.h"
#include "StructureIDTable.h"
+#include "ResourceExhaustion.h"
#include <wtf/Atomics.h>
#include <wtf/DataLog.h>
#include <wtf/RawPointer.h>
@@ -109,7 +110,7 @@
// If m_size is already s_maximumNumberOfStructures, newCapacity becomes s_maximumNumberOfStructures in the above code.
// In that case, we should crash because of exhaust of StructureIDs.
- RELEASE_ASSERT_WITH_MESSAGE(m_size < newCapacity, "Crash intentionally because of exhaust of StructureIDs.");
+ RELEASE_ASSERT_RESOURCE_AVAILABLE(m_size < newCapacity, StructureIDExhaustion, "Crash intentionally because of exhaust of StructureIDs.");
// Create the new table.
auto newTable = makeUniqueArray<StructureOrOffset>(newCapacity);
