Title: [175967] trunk/Source/_javascript_Core
- Revision
- 175967
- Author
- [email protected]
- Date
- 2014-11-11 12:36:11 -0800 (Tue, 11 Nov 2014)
Log Message
Handle cases in StackVisitor::Frame::existingArguments() when lexicalEnvironment and/or unmodifiedArgumentsRegister is not set up yet
https://bugs.webkit.org/show_bug.cgi?id=138543
Patch by Akos Kiss <[email protected]> on 2014-11-11
Reviewed by Geoffrey Garen.
Exception fuzzing may may raise exceptions in places where they would be
otherwise impossible. Therefore, a callFrame may lack activation even if
the codeBlock signals need of activation. Also, even if codeBlock
signals the use of arguments, the unmodifiedArgumentsRegister may not be
initialized yet (neither locally nor in lexicalEnvironment).
If codeBlock()->needsActivation() is false, unmodifiedArgumentsRegister
is already checked for Undefined. This patch applies the same check when
the condition is true (and also checks whether
callFrame()->hasActivation()).
* interpreter/CallFrame.h:
(JSC::ExecState::hasActivation):
Moved to interpreter/CallFrameInlines.h.
* interpreter/CallFrameInlines.h:
(JSC::CallFrame::hasActivation):
Fixed to verify that the JSValue returned by uncheckedActivation() is a
cell.
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::Frame::existingArguments):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (175966 => 175967)
--- trunk/Source/_javascript_Core/ChangeLog 2014-11-11 20:12:02 UTC (rev 175966)
+++ trunk/Source/_javascript_Core/ChangeLog 2014-11-11 20:36:11 UTC (rev 175967)
@@ -1,3 +1,31 @@
+2014-11-11 Akos Kiss <[email protected]>
+
+ Handle cases in StackVisitor::Frame::existingArguments() when lexicalEnvironment and/or unmodifiedArgumentsRegister is not set up yet
+ https://bugs.webkit.org/show_bug.cgi?id=138543
+
+ Reviewed by Geoffrey Garen.
+
+ Exception fuzzing may may raise exceptions in places where they would be
+ otherwise impossible. Therefore, a callFrame may lack activation even if
+ the codeBlock signals need of activation. Also, even if codeBlock
+ signals the use of arguments, the unmodifiedArgumentsRegister may not be
+ initialized yet (neither locally nor in lexicalEnvironment).
+
+ If codeBlock()->needsActivation() is false, unmodifiedArgumentsRegister
+ is already checked for Undefined. This patch applies the same check when
+ the condition is true (and also checks whether
+ callFrame()->hasActivation()).
+
+ * interpreter/CallFrame.h:
+ (JSC::ExecState::hasActivation):
+ Moved to interpreter/CallFrameInlines.h.
+ * interpreter/CallFrameInlines.h:
+ (JSC::CallFrame::hasActivation):
+ Fixed to verify that the JSValue returned by uncheckedActivation() is a
+ cell.
+ * interpreter/StackVisitor.cpp:
+ (JSC::StackVisitor::Frame::existingArguments):
+
2014-11-11 Andreas Kling <[email protected]>
Another assertion fix for debug builds after r175846.
Modified: trunk/Source/_javascript_Core/interpreter/CallFrame.h (175966 => 175967)
--- trunk/Source/_javascript_Core/interpreter/CallFrame.h 2014-11-11 20:12:02 UTC (rev 175966)
+++ trunk/Source/_javascript_Core/interpreter/CallFrame.h 2014-11-11 20:36:11 UTC (rev 175967)
@@ -51,7 +51,7 @@
return this[JSStack::ScopeChain].Register::scope();
}
- bool hasActivation() const { return !!uncheckedActivation(); }
+ bool hasActivation() const;
JSLexicalEnvironment* lexicalEnvironment() const;
JSValue uncheckedActivation() const;
Modified: trunk/Source/_javascript_Core/interpreter/CallFrameInlines.h (175966 => 175967)
--- trunk/Source/_javascript_Core/interpreter/CallFrameInlines.h 2014-11-11 20:12:02 UTC (rev 175966)
+++ trunk/Source/_javascript_Core/interpreter/CallFrameInlines.h 2014-11-11 20:36:11 UTC (rev 175967)
@@ -139,6 +139,12 @@
return Location::decode(locationAsRawBits());
}
+inline bool CallFrame::hasActivation() const
+{
+ JSValue activation = uncheckedActivation();
+ return !!activation && activation.isCell();
+}
+
inline JSValue CallFrame::uncheckedActivation() const
{
CodeBlock* codeBlock = this->codeBlock();
Modified: trunk/Source/_javascript_Core/interpreter/StackVisitor.cpp (175966 => 175967)
--- trunk/Source/_javascript_Core/interpreter/StackVisitor.cpp 2014-11-11 20:12:02 UTC (rev 175966)
+++ trunk/Source/_javascript_Core/interpreter/StackVisitor.cpp 2014-11-11 20:36:11 UTC (rev 175967)
@@ -297,11 +297,18 @@
#endif // ENABLE(DFG_JIT)
reg = codeBlock()->argumentsRegister();
- if (codeBlock()->needsActivation())
- return jsCast<Arguments*>(callFrame()->lexicalEnvironment()->registerAt(unmodifiedArgumentsRegister(reg).offset()).get());
-
- JSValue result = callFrame()->r(unmodifiedArgumentsRegister(reg).offset()).jsValue();
- if (!result || !result.isCell()) // Protect against Undefined in case we throw in op_enter.
+ // Care should be taken here since exception fuzzing may raise exceptions in
+ // places where they would be otherwise impossible. Therefore, callFrame may
+ // lack activation even if the codeBlock signals need of activation. Also,
+ // even if codeBlock signals the use of arguments, the
+ // unmodifiedArgumentsRegister may not be initialized yet (neither locally
+ // nor in lexicalEnvironment).
+ JSValue result = jsUndefined();
+ if (codeBlock()->needsActivation() && callFrame()->hasActivation())
+ result = callFrame()->lexicalEnvironment()->registerAt(unmodifiedArgumentsRegister(reg).offset()).get();
+ if (!result || !result.isCell()) // Try local unmodifiedArgumentsRegister if lexicalEnvironment is not present (generally possible) or has not set up registers yet (only possible if fuzzing exceptions).
+ result = callFrame()->r(unmodifiedArgumentsRegister(reg).offset()).jsValue();
+ if (!result || !result.isCell()) // Protect against the case when exception fuzzing throws when unmodifiedArgumentsRegister is not set up yet (e.g., in op_enter).
return 0;
return jsCast<Arguments*>(result);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
