REGRESSION (r179357-r179359): WebContent Crash using AOL Mail @ com.a…

…pple.JavascriptCore JSC::linkPolymorphicCall(JSC::ExecState*, JSC::CallLinkInfo&, JSC::CallVariant, JSC::RegisterPreservationMode) + 1584 https://bugs.webkit.org/show_bug.cgi?id=150513 Reviewed by Saam Barati. Source/JavaScriptCore: Add check in linkPolymorphicCall() to make sure we have a CodeBlock for the newly added variant. If not, we turn the call into a virtual call. The bug was caused by a stack overflow when preparing the function for execution. This properly threw an exception, however linkPolymorphicCall() didn't check for this error case. Added a new test function "failNextNewCodeBlock()" to test tools to simplify the testing. * API/JSCTestRunnerUtils.cpp: (JSC::failNextNewCodeBlock): (JSC::numberOfDFGCompiles): * API/JSCTestRunnerUtils.h: * jit/Repatch.cpp: (JSC::linkPolymorphicCall): * jsc.cpp: (GlobalObject::finishCreation): (functionTransferArrayBuffer): (functionFailNextNewCodeBlock): (functionQuit): * runtime/Executable.cpp: (JSC::ScriptExecutable::prepareForExecutionImpl): * runtime/TestRunnerUtils.cpp: (JSC::optimizeNextInvocation): (JSC::failNextNewCodeBlock): (JSC::numberOfDFGCompiles): * runtime/TestRunnerUtils.h: * runtime/VM.h: (JSC::VM::setFailNextNewCodeBlock): (JSC::VM::getAndClearFailNextNewCodeBlock): (JSC::VM::stackPointerAtVMEntry): Tools: Added a new test function, failNextNewCodeBlock() to simplify the writing of a regression test. * DumpRenderTree/TestRunner.cpp: (simulateWebNotificationClickCallback): (failNextCodeBlock): (numberOfDFGCompiles): (TestRunner::staticFunctions): * WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl: * WebKitTestRunner/InjectedBundle/TestRunner.cpp: (WTR::TestRunner::setBlockAllPlugins): (WTR::TestRunner::failNextCodeBlock): (WTR::TestRunner::numberOfDFGCompiles): * WebKitTestRunner/InjectedBundle/TestRunner.h: LayoutTests: New regression test. * js/regress-150513-expected.txt: Added. * js/regress-150513.html: Added. * js/script-tests/regress-150513.js: Added. (test): * resources/standalone-pre.js: Added failNextNewCodeBlock to testRunner object. Canonical link: https://commits.webkit.org/168677@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@191530 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Oct 24, 2015 · 821f4a5 · 821f4a5
1 parent 34c6804
commit 821f4a5
Show file tree

Hide file tree

Showing 19 changed files with 191 additions and 6 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,18 @@
+2015-10-23  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r179357-r179359): WebContent Crash using AOL Mail @ com.apple.JavascriptCore JSC::linkPolymorphicCall(JSC::ExecState*, JSC::CallLinkInfo&, JSC::CallVariant, JSC::RegisterPreservationMode) + 1584
+        https://bugs.webkit.org/show_bug.cgi?id=150513
+
+        Reviewed by Saam Barati.
+
+        New regression test.
+
+        * js/regress-150513-expected.txt: Added.
+        * js/regress-150513.html: Added.
+        * js/script-tests/regress-150513.js: Added.
+        (test):
+        * resources/standalone-pre.js: Added failNextNewCodeBlock to testRunner object.
+
 2015-10-23  Ryan Haddad  <ryanhaddad@apple.com>
 
         Removing [ Release ] flag from flaky imported blink tests that are timing out in debug too

diff --git a/LayoutTests/js/regress-150513-expected.txt b/LayoutTests/js/regress-150513-expected.txt
@@ -0,0 +1,10 @@
+Regression test for https://webkit.org/b/150513.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS Didn't crash when calling a virtual JavaScript function that doesn't have a CodeBlock.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/js/regress-150513.html b/LayoutTests/js/regress-150513.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/regress-150513.js"></script>
+<script src="../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/js/script-tests/regress-150513.js b/LayoutTests/js/script-tests/regress-150513.js
@@ -0,0 +1,38 @@
+description("Regression test for https://webkit.org/b/150513.");
+
+// This test verifies that we can properly handle calling a virtual JavaScript
+// function that fails during CodeBlock generation.
+
+var functions = [];
+
+function init()
+{
+    functions.push(new Function("a", "return a"));
+    functions.push(new Function("a", "return a"));
+    functions.push(new Function("a", "return a"));
+}
+
+function test()
+{
+    for (var i = 0; i < 100000; i++) {
+        var f;
+        if (i % 1000 == 999) {
+            testRunner.failNextNewCodeBlock();
+            f = functions[2];
+        } else
+            f = functions[i % 2];
+
+        try {
+            var result = f(1);
+            if (result != 1)
+                testFailed("Wrong result, expected 1, got " + result);
+        } catch (e) {
+        }
+    }
+}
+
+init();
+
+test();
+
+testPassed("Didn't crash when calling a virtual JavaScript function that doesn't have a CodeBlock.");
diff --git a/LayoutTests/resources/standalone-pre.js b/LayoutTests/resources/standalone-pre.js
@@ -4,7 +4,8 @@ var self = this;
 
 self.testRunner = {
     neverInlineFunction: neverInlineFunction,
-    numberOfDFGCompiles: numberOfDFGCompiles
+    numberOfDFGCompiles: numberOfDFGCompiles,
+    failNextNewCodeBlock: failNextNewCodeBlock
 };
 
 var silentTestPass, didPassSomeTestsSilently, didFailSomeTests, successfullyParsed;

diff --git a/Source/JavaScriptCore/API/JSCTestRunnerUtils.cpp b/Source/JavaScriptCore/API/JSCTestRunnerUtils.cpp
@@ -32,6 +32,14 @@
 
 namespace JSC {
 
+
+JSValueRef failNextNewCodeBlock(JSContextRef context)
+{
+    ExecState* exec= toJS(context);
+    JSLockHolder holder(exec);
+    return toRef(exec, failNextNewCodeBlock(exec));
+}
+
 JSValueRef numberOfDFGCompiles(JSContextRef context, JSValueRef theFunctionValueRef)
 {
     ExecState* exec= toJS(context);

diff --git a/Source/JavaScriptCore/API/JSCTestRunnerUtils.h b/Source/JavaScriptCore/API/JSCTestRunnerUtils.h
@@ -31,6 +31,7 @@
 
 namespace JSC {
 
+JS_EXPORT_PRIVATE JSValueRef failNextNewCodeBlock(JSContextRef);
 JS_EXPORT_PRIVATE JSValueRef numberOfDFGCompiles(JSContextRef, JSValueRef theFunction);
 JS_EXPORT_PRIVATE JSValueRef setNeverInline(JSContextRef, JSValueRef theFunction);
 JS_EXPORT_PRIVATE JSValueRef setNeverOptimize(JSContextRef, JSValueRef theFunction);

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,41 @@
+2015-10-23  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r179357-r179359): WebContent Crash using AOL Mail @ com.apple.JavascriptCore JSC::linkPolymorphicCall(JSC::ExecState*, JSC::CallLinkInfo&, JSC::CallVariant, JSC::RegisterPreservationMode) + 1584
+        https://bugs.webkit.org/show_bug.cgi?id=150513
+
+        Reviewed by Saam Barati.
+
+        Add check in linkPolymorphicCall() to make sure we have a CodeBlock for the newly added variant.
+        If not, we turn the call into a virtual call.
+
+        The bug was caused by a stack overflow when preparing the function for execution.  This properly
+        threw an exception, however linkPolymorphicCall() didn't check for this error case.
+
+        Added a new test function "failNextNewCodeBlock()" to test tools to simplify the testing.
+
+        * API/JSCTestRunnerUtils.cpp:
+        (JSC::failNextNewCodeBlock):
+        (JSC::numberOfDFGCompiles):
+        * API/JSCTestRunnerUtils.h:
+        * jit/Repatch.cpp:
+        (JSC::linkPolymorphicCall):
+        * jsc.cpp:
+        (GlobalObject::finishCreation):
+        (functionTransferArrayBuffer):
+        (functionFailNextNewCodeBlock):
+        (functionQuit):
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::prepareForExecutionImpl):
+        * runtime/TestRunnerUtils.cpp:
+        (JSC::optimizeNextInvocation):
+        (JSC::failNextNewCodeBlock):
+        (JSC::numberOfDFGCompiles):
+        * runtime/TestRunnerUtils.h:
+        * runtime/VM.h:
+        (JSC::VM::setFailNextNewCodeBlock):
+        (JSC::VM::getAndClearFailNextNewCodeBlock):
+        (JSC::VM::stackPointerAtVMEntry):
+
 2015-10-23  Commit Queue  <commit-queue@webkit.org>
 
         Unreviewed, rolling out r191500.

diff --git a/Source/JavaScriptCore/jit/Repatch.cpp b/Source/JavaScriptCore/jit/Repatch.cpp
@@ -682,9 +682,9 @@ void linkPolymorphicCall(
             else
 #endif
                 codeBlock = jsCast<FunctionExecutable*>(executable)->codeBlockForCall();
-            // If we cannot handle a callee, assume that it's better for this whole thing to be a
-            // virtual call.
-            if (exec->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()) || callLinkInfo.isVarargs()) {
+            // If we cannot handle a callee, either because we don't have a CodeBlock or because arity mismatch,
+            // assume that it's better for this whole thing to be a virtual call.
+            if (!codeBlock || exec->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()) || callLinkInfo.isVarargs()) {
                 linkVirtualFor(exec, callLinkInfo);
                 return;
             }

diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
@@ -526,6 +526,7 @@ static EncodedJSValue JSC_HOST_CALL functionOptimizeNextInvocation(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionNumberOfDFGCompiles(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionReoptimizationRetryCount(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionTransferArrayBuffer(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionFailNextNewCodeBlock(ExecState*);
 static NO_RETURN_WITH_VALUE EncodedJSValue JSC_HOST_CALL functionQuit(ExecState*);
 static NO_RETURN_DUE_TO_CRASH EncodedJSValue JSC_HOST_CALL functionAbort(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionFalse1(ExecState*);
@@ -687,6 +688,7 @@ class GlobalObject : public JSGlobalObject {
         addFunction(vm, "optimizeNextInvocation", functionOptimizeNextInvocation, 1);
         addFunction(vm, "reoptimizationRetryCount", functionReoptimizationRetryCount, 1);
         addFunction(vm, "transferArrayBuffer", functionTransferArrayBuffer, 1);
+        addFunction(vm, "failNextNewCodeBlock", functionFailNextNewCodeBlock, 1);
 #if ENABLE(SAMPLING_FLAGS)
         addFunction(vm, "setSamplingFlags", functionSetSamplingFlags, 1);
         addFunction(vm, "clearSamplingFlags", functionClearSamplingFlags, 1);
@@ -1375,6 +1377,12 @@ EncodedJSValue JSC_HOST_CALL functionTransferArrayBuffer(ExecState* exec)
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL functionFailNextNewCodeBlock(ExecState* exec)
+{
+    exec->vm().setFailNextNewCodeBlock();
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL functionQuit(ExecState*)
 {
     jscExit(EXIT_SUCCESS);

diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -387,7 +387,10 @@ JSObject* ScriptExecutable::prepareForExecutionImpl(
 {
     VM& vm = exec->vm();
     DeferGC deferGC(vm.heap);
-
+
+    if (vm.getAndClearFailNextNewCodeBlock())
+        return createError(exec->callerFrame(), ASCIILiteral("Forced Failure"));
+
     JSObject* exception = 0;
     CodeBlock* codeBlock = newCodeBlockFor(kind, function, scope, exception);
     if (!codeBlock) {

diff --git a/Source/JavaScriptCore/runtime/TestRunnerUtils.cpp b/Source/JavaScriptCore/runtime/TestRunnerUtils.cpp
@@ -103,6 +103,13 @@ JSValue optimizeNextInvocation(JSValue theFunctionValue)
     return jsUndefined();
 }
 
+JSValue failNextNewCodeBlock(ExecState* exec)
+{
+    exec->vm().setFailNextNewCodeBlock();
+
+    return jsUndefined();
+}
+
 JSValue numberOfDFGCompiles(ExecState* exec)
 {
     if (exec->argumentCount() < 1)

diff --git a/Source/JavaScriptCore/runtime/TestRunnerUtils.h b/Source/JavaScriptCore/runtime/TestRunnerUtils.h
@@ -41,6 +41,7 @@ JS_EXPORT_PRIVATE JSValue setNeverInline(JSValue function);
 JS_EXPORT_PRIVATE JSValue setNeverOptimize(JSValue function);
 JS_EXPORT_PRIVATE JSValue optimizeNextInvocation(JSValue function);
 
+JS_EXPORT_PRIVATE JSValue failNextNewCodeBlock(ExecState*);
 JS_EXPORT_PRIVATE JSValue numberOfDFGCompiles(ExecState*);
 JS_EXPORT_PRIVATE JSValue setNeverInline(ExecState*);
 JS_EXPORT_PRIVATE JSValue setNeverOptimize(ExecState*);

diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
@@ -426,6 +426,14 @@ class VM : public ThreadSafeRefCounted<VM> {
     JS_EXPORT_PRIVATE JSValue throwException(ExecState*, JSValue);
     JS_EXPORT_PRIVATE JSObject* throwException(ExecState*, JSObject*);
 
+    void setFailNextNewCodeBlock() { m_failNextNewCodeBlock = true; }
+    bool getAndClearFailNextNewCodeBlock()
+    {
+        bool result = m_failNextNewCodeBlock;
+        m_failNextNewCodeBlock = false;
+        return result;
+    }
+
     void* stackPointerAtVMEntry() const { return m_stackPointerAtVMEntry; }
     void setStackPointerAtVMEntry(void*);
 
@@ -624,6 +632,7 @@ class VM : public ThreadSafeRefCounted<VM> {
     void* m_lastStackTop;
     Exception* m_exception { nullptr };
     Exception* m_lastException { nullptr };
+    bool m_failNextNewCodeBlock { false };
     bool m_inDefineOwnProperty;
     std::unique_ptr<CodeCache> m_codeCache;
     LegacyProfiler* m_enabledProfiler;

diff --git a/Tools/ChangeLog b/Tools/ChangeLog
@@ -1,3 +1,24 @@
+2015-10-23  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r179357-r179359): WebContent Crash using AOL Mail @ com.apple.JavascriptCore JSC::linkPolymorphicCall(JSC::ExecState*, JSC::CallLinkInfo&, JSC::CallVariant, JSC::RegisterPreservationMode) + 1584
+        https://bugs.webkit.org/show_bug.cgi?id=150513
+
+        Reviewed by Saam Barati.
+
+        Added a new test function, failNextNewCodeBlock() to simplify the writing of a regression test.
+
+        * DumpRenderTree/TestRunner.cpp:
+        (simulateWebNotificationClickCallback):
+        (failNextCodeBlock):
+        (numberOfDFGCompiles):
+        (TestRunner::staticFunctions):
+        * WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
+        * WebKitTestRunner/InjectedBundle/TestRunner.cpp:
+        (WTR::TestRunner::setBlockAllPlugins):
+        (WTR::TestRunner::failNextCodeBlock):
+        (WTR::TestRunner::numberOfDFGCompiles):
+        * WebKitTestRunner/InjectedBundle/TestRunner.h:
+
 2015-10-23  Anders Carlsson  <andersca@apple.com>
 
         Simplify the WebKitLegacy menu conversion code

diff --git a/Tools/DumpRenderTree/TestRunner.cpp b/Tools/DumpRenderTree/TestRunner.cpp
@@ -1933,11 +1933,16 @@ static JSValueRef simulateWebNotificationClickCallback(JSContextRef context, JSO
     return JSValueMakeUndefined(context);
 }
 
-static JSValueRef numberOfDFGCompiles(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+static JSValueRef failNextNewCodeBlock(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     if (argumentCount < 1)
         return JSValueMakeUndefined(context);
 
+    return JSC::failNextNewCodeBlock(context);
+}
+
+static JSValueRef numberOfDFGCompiles(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
     return JSC::numberOfDFGCompiles(context, arguments[0]);
 }
 
@@ -2149,6 +2154,7 @@ JSStaticFunction* TestRunner::staticFunctions()
         { "denyWebNotificationPermission", denyWebNotificationPermissionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "removeAllWebNotificationPermissions", removeAllWebNotificationPermissionsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "simulateWebNotificationClick", simulateWebNotificationClickCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "failNextNewCodeBlock", failNextNewCodeBlock, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "numberOfDFGCompiles", numberOfDFGCompiles, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "neverInlineFunction", neverInlineFunction, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { 0, 0, 0 }

diff --git a/Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl b/Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl
@@ -205,6 +205,7 @@ interface TestRunner {
     void setBlockAllPlugins(boolean shouldBlock);
 
     // Hooks to the JSC compiler.
+    object failNextNewCodeBlock();
     object numberOfDFGCompiles(object function);
     object neverInlineFunction(object function);
 

diff --git a/Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp b/Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
@@ -861,6 +861,13 @@ void TestRunner::setBlockAllPlugins(bool shouldBlock)
     WKBundlePagePostMessage(InjectedBundle::singleton().page()->page(), messageName.get(), messageBody.get());
 }
 
+JSValueRef TestRunner::failNextNewCodeBlock()
+{
+    WKBundleFrameRef mainFrame = WKBundlePageGetMainFrame(InjectedBundle::singleton().page()->page());
+    JSContextRef context = WKBundleFrameGetJavaScriptContext(mainFrame);
+    return JSC::failNextNewCodeBlock(context);
+}
+
 JSValueRef TestRunner::numberOfDFGCompiles(JSValueRef theFunction)
 {
     WKBundleFrameRef mainFrame = WKBundlePageGetMainFrame(InjectedBundle::singleton().page()->page());

diff --git a/Tools/WebKitTestRunner/InjectedBundle/TestRunner.h b/Tools/WebKitTestRunner/InjectedBundle/TestRunner.h
@@ -280,6 +280,7 @@ class TestRunner : public JSWrappable {
 
     bool secureEventInputIsEnabled() const;
 
+    JSValueRef failNextNewCodeBlock();
     JSValueRef numberOfDFGCompiles(JSValueRef theFunction);
     JSValueRef neverInlineFunction(JSValueRef theFunction);