Title: [283841] trunk
- Revision
- 283841
- Author
- [email protected]
- Date
- 2021-10-08 15:02:02 -0700 (Fri, 08 Oct 2021)
Log Message
[JSC] UnlinkedCodeBlock::m_instructions can be nullptr
https://bugs.webkit.org/show_bug.cgi?id=231445
rdar://83975933
Reviewed by Mark Lam.
JSTests:
* stress/unlinked-code-block-destructor.js: Added.
(useAllMemory.get Object):
(useAllMemory.foo):
(useAllMemory):
(try.bar):
Source/_javascript_Core:
UnlinkedCodeBlock is first created with m_instructions = nullptr.
If BytecodeGenerator failed (due to OOM error etc.), then we keep it nullptr.
So, when destroying UnlinkedCodeBlock, we should have nullptr check.
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (283840 => 283841)
--- trunk/JSTests/ChangeLog 2021-10-08 21:51:59 UTC (rev 283840)
+++ trunk/JSTests/ChangeLog 2021-10-08 22:02:02 UTC (rev 283841)
@@ -1,3 +1,17 @@
+2021-10-08 Yusuke Suzuki <[email protected]>
+
+ [JSC] UnlinkedCodeBlock::m_instructions can be nullptr
+ https://bugs.webkit.org/show_bug.cgi?id=231445
+ rdar://83975933
+
+ Reviewed by Mark Lam.
+
+ * stress/unlinked-code-block-destructor.js: Added.
+ (useAllMemory.get Object):
+ (useAllMemory.foo):
+ (useAllMemory):
+ (try.bar):
+
2021-10-08 Saam Barati <[email protected]>
RegExpExec can't statically prove which of the two structures it will get in AI by just looking at the RegExp*
Added: trunk/JSTests/stress/unlinked-code-block-destructor.js (0 => 283841)
--- trunk/JSTests/stress/unlinked-code-block-destructor.js (rev 0)
+++ trunk/JSTests/stress/unlinked-code-block-destructor.js 2021-10-08 22:02:02 UTC (rev 283841)
@@ -0,0 +1,30 @@
+//@ skip if $memoryLimited
+//@ runDefault("--destroy-vm", "--forceDebuggerBytecodeGeneration=1", "--returnEarlyFromInfiniteLoopsForFuzzing=1")
+
+function useAllMemory() {
+ const a = [0];
+ a.__proto__ = {};
+ Object.defineProperty(a, 0, {get: foo});
+ Object.defineProperty(a, 80000000, {});
+
+ function foo() {
+ new Uint8Array(a);
+ }
+
+ new Promise(foo);
+ try {
+ for (let i = 0; i < 2**32; i++) {
+ new ArrayBuffer(1000);
+ }
+ } catch {
+ }
+}
+
+try {
+ useAllMemory();
+
+ function bar(a0) {
+ arguments;
+ }
+ bar();
+} catch { }
Modified: trunk/Source/_javascript_Core/ChangeLog (283840 => 283841)
--- trunk/Source/_javascript_Core/ChangeLog 2021-10-08 21:51:59 UTC (rev 283840)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-10-08 22:02:02 UTC (rev 283841)
@@ -1,3 +1,18 @@
+2021-10-08 Yusuke Suzuki <[email protected]>
+
+ [JSC] UnlinkedCodeBlock::m_instructions can be nullptr
+ https://bugs.webkit.org/show_bug.cgi?id=231445
+ rdar://83975933
+
+ Reviewed by Mark Lam.
+
+ UnlinkedCodeBlock is first created with m_instructions = nullptr.
+ If BytecodeGenerator failed (due to OOM error etc.), then we keep it nullptr.
+ So, when destroying UnlinkedCodeBlock, we should have nullptr check.
+
+ * bytecode/UnlinkedCodeBlock.cpp:
+ (JSC::UnlinkedCodeBlock::~UnlinkedCodeBlock):
+
2021-10-08 Saam Barati <[email protected]>
RegExpExec can't statically prove which of the two structures it will get in AI by just looking at the RegExp*
Modified: trunk/Source/_javascript_Core/bytecode/UnlinkedCodeBlock.cpp (283840 => 283841)
--- trunk/Source/_javascript_Core/bytecode/UnlinkedCodeBlock.cpp 2021-10-08 21:51:59 UTC (rev 283840)
+++ trunk/Source/_javascript_Core/bytecode/UnlinkedCodeBlock.cpp 2021-10-08 22:02:02 UTC (rev 283841)
@@ -284,10 +284,12 @@
UnlinkedCodeBlock::~UnlinkedCodeBlock()
{
if (UNLIKELY(Options::returnEarlyFromInfiniteLoopsForFuzzing())) {
- VM& vm = this->vm();
- for (const auto& instruction : instructions()) {
- if (instruction->is<OpLoopHint>())
- vm.removeLoopHintExecutionCounter(instruction.ptr());
+ if (auto* instructions = m_instructions.get()) {
+ VM& vm = this->vm();
+ for (const auto& instruction : *instructions) {
+ if (instruction->is<OpLoopHint>())
+ vm.removeLoopHintExecutionCounter(instruction.ptr());
+ }
}
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
