CachedCall (and its clients) needs overflow checks.

https://bugs.webkit.org/show_bug.cgi?id=179185

Reviewed by JF Bastien.

JSTests:

* stress/regress-179185.js: Added.

Source/JavaScriptCore:

* interpreter/CachedCall.h:
(JSC::CachedCall::CachedCall):
(JSC::CachedCall::hasOverflowedArguments):
* runtime/ArgList.h:
(JSC::MarkedArgumentBuffer::clear):
* runtime/StringPrototype.cpp:
(JSC::replaceUsingRegExpSearch):


Canonical link: https://commits.webkit.org/195337@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@224399 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog

@@ -1,3 +1,12 @@
+2017-11-03  Mark Lam  <mark.lam@apple.com>
+
+        CachedCall (and its clients) needs overflow checks.
+        https://bugs.webkit.org/show_bug.cgi?id=179185
+
+        Reviewed by JF Bastien.
+
+        * stress/regress-179185.js: Added.
+
 2017-11-02  Michael Saboff  <msaboff@apple.com>
 
         DFG needs to handle code motion of code in for..in loop bodies

JSTests/stress/regress-179185.js

@@ -0,0 +1,3 @@
+// This test passes if it does not fail assertions on a debug build.
+str = "Hello There Quick Brown Fox";
+str.replace(/(((el)|(ui))|((Br)|(Fo)))/g, () => { });

Source/JavaScriptCore/ChangeLog

@@ -1,3 +1,18 @@
+2017-11-03  Mark Lam  <mark.lam@apple.com>
+
+        CachedCall (and its clients) needs overflow checks.
+        https://bugs.webkit.org/show_bug.cgi?id=179185
+
+        Reviewed by JF Bastien.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::hasOverflowedArguments):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::clear):
+        * runtime/StringPrototype.cpp:
+        (JSC::replaceUsingRegExpSearch):
+
 2017-11-03  Devin Rousso  <webkit@devinrousso.com>
 
         Web Inspector: Canvas2D Profiling: highlight expensive context commands in the captured command log

Source/JavaScriptCore/interpreter/CachedCall.h

@@ -51,7 +51,10 @@ namespace JSC {
             ASSERT(!function->isHostFunctionNonInline());
             if (UNLIKELY(vm.isSafeToRecurseSoft())) {
                 m_arguments.ensureCapacity(argumentCount);
-                m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, &m_protoCallFrame, function, argumentCount + 1, function->scope(), m_arguments);
+                if (LIKELY(!m_arguments.hasOverflowed()))
+                    m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, &m_protoCallFrame, function, argumentCount + 1, function->scope(), m_arguments);
+                else
+                    throwOutOfMemoryError(callFrame, scope);
             } else
                 throwStackOverflowError(callFrame, scope);
             m_valid = !scope.exception();
@@ -67,6 +70,7 @@ namespace JSC {
 
         void clearArguments() { m_arguments.clear(); }
         void appendArgument(JSValue v) { m_arguments.append(v); }
+        bool hasOverflowedArguments() { return m_arguments.hasOverflowed(); }
 
     private:
         bool m_valid;

Source/JavaScriptCore/runtime/ArgList.h

@@ -73,6 +73,8 @@ class MarkedArgumentBuffer : public RecordOverflow {
 
     void clear()
     {
+        ASSERT(!m_needsOverflowCheck);
+        clearOverflow();
         m_size = 0;
     }
 

Source/JavaScriptCore/runtime/StringPrototype.cpp

@@ -598,6 +598,11 @@ static ALWAYS_INLINE EncodedJSValue replaceUsingRegExpSearch(
                     cachedCall.appendArgument(groups);
 
                 cachedCall.setThis(jsUndefined());
+                if (UNLIKELY(cachedCall.hasOverflowedArguments())) {
+                    throwOutOfMemoryError(exec, scope);
+                    return encodedJSValue();
+                }
+
                 JSValue jsResult = cachedCall.call();
                 RETURN_IF_EXCEPTION(scope, encodedJSValue());
                 replacements.append(jsResult.toWTFString(exec));
@@ -659,6 +664,11 @@ static ALWAYS_INLINE EncodedJSValue replaceUsingRegExpSearch(
                     cachedCall.appendArgument(groups);
 
                 cachedCall.setThis(jsUndefined());
+                if (UNLIKELY(cachedCall.hasOverflowedArguments())) {
+                    throwOutOfMemoryError(exec, scope);
+                    return encodedJSValue();
+                }
+
                 JSValue jsResult = cachedCall.call();
                 RETURN_IF_EXCEPTION(scope, encodedJSValue());
                 replacements.append(jsResult.toWTFString(exec));