<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[178145] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/178145">178145</a></dd>
<dt>Author</dt> <dd>mark.lam@apple.com</dd>
<dt>Date</dt> <dd>2015-01-08 16:49:31 -0800 (Thu, 08 Jan 2015)</dd>
</dl>
<h3>Log Message</h3>
<pre>Argument object created by "Function dot arguments" should use a clone of the argument values.
<https://webkit.org/b/140093>
Reviewed by Geoffrey Garen.
After the change in <https://webkit.org/b/139827>, the dfg-tear-off-arguments-not-activation.js
test will crash. The relevant code which manifests the issue is as follows:
function bar() {
return foo.arguments;
}
function foo(p) {
var x = 42;
if (p)
return (function() { return x; });
else
return bar();
}
In this case, foo() has no knowledge of bar() needing its LexicalEnvironment and
has dead code eliminated the SetLocal that stores it into its designated local.
In bar(), the factory for the Arguments object (for creating foo.arguments) tries
to read foo's LexicalEnvironment from its designated lexicalEnvironment local,
but instead, finds it to be uninitialized. This results in a null pointer access
which causes a crash.
This can be resolved by having bar() instantiate a clone of the Arguments object
instead, and populate its elements with values fetched directly from foo's frame.
There's no need to reference foo's LexicalEnvironment (whether present or not).
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::Frame::createArguments):
* runtime/Arguments.h:
(JSC::Arguments::finishCreation):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterStackVisitorcpp">trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArgumentsh">trunk/Source/JavaScriptCore/runtime/Arguments.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (178144 => 178145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2015-01-09 00:41:58 UTC (rev 178144)
+++ trunk/Source/JavaScriptCore/ChangeLog 2015-01-09 00:49:31 UTC (rev 178145)
</span><span class="lines">@@ -1,5 +1,43 @@
</span><span class="cx"> 2015-01-08 Mark Lam <mark.lam@apple.com>
</span><span class="cx">
</span><ins>+ Argument object created by "Function dot arguments" should use a clone of the argument values.
+ <https://webkit.org/b/140093>
+
+ Reviewed by Geoffrey Garen.
+
+ After the change in <https://webkit.org/b/139827>, the dfg-tear-off-arguments-not-activation.js
+ test will crash. The relevant code which manifests the issue is as follows:
+
+ function bar() {
+ return foo.arguments;
+ }
+
+ function foo(p) {
+ var x = 42;
+ if (p)
+ return (function() { return x; });
+ else
+ return bar();
+ }
+
+ In this case, foo() has no knowledge of bar() needing its LexicalEnvironment and
+ has dead code eliminated the SetLocal that stores it into its designated local.
+ In bar(), the factory for the Arguments object (for creating foo.arguments) tries
+ to read foo's LexicalEnvironment from its designated lexicalEnvironment local,
+ but instead, finds it to be uninitialized. This results in a null pointer access
+ which causes a crash.
+
+ This can be resolved by having bar() instantiate a clone of the Arguments object
+ instead, and populate its elements with values fetched directly from foo's frame.
+ There's no need to reference foo's LexicalEnvironment (whether present or not).
+
+ * interpreter/StackVisitor.cpp:
+ (JSC::StackVisitor::Frame::createArguments):
+ * runtime/Arguments.h:
+ (JSC::Arguments::finishCreation):
+
+2015-01-08 Mark Lam <mark.lam@apple.com>
+
</ins><span class="cx"> Make the LLINT and Baseline JIT's op_create_arguments and op_get_argument_by_val use their lexicalEnvironment operand.
</span><span class="cx"> <https://webkit.org/b/140236>
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterStackVisitorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp (178144 => 178145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp 2015-01-09 00:41:58 UTC (rev 178144)
+++ trunk/Source/JavaScriptCore/interpreter/StackVisitor.cpp 2015-01-09 00:49:31 UTC (rev 178145)
</span><span class="lines">@@ -260,7 +260,7 @@
</span><span class="cx"> Arguments* arguments;
</span><span class="cx"> ArgumentsMode mode;
</span><span class="cx"> if (Options::enableFunctionDotArguments())
</span><del>- mode = NormalArgumentsCreationMode;
</del><ins>+ mode = ClonedArgumentsCreationMode;
</ins><span class="cx"> else
</span><span class="cx"> mode = FakeArgumentValuesCreationMode;
</span><span class="cx"> #if ENABLE(DFG_JIT)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArgumentsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Arguments.h (178144 => 178145)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Arguments.h 2015-01-09 00:41:58 UTC (rev 178144)
+++ trunk/Source/JavaScriptCore/runtime/Arguments.h 2015-01-09 00:49:31 UTC (rev 178145)
</span><span class="lines">@@ -37,6 +37,7 @@
</span><span class="cx">
</span><span class="cx"> enum ArgumentsMode {
</span><span class="cx"> NormalArgumentsCreationMode,
</span><ins>+ ClonedArgumentsCreationMode,
</ins><span class="cx"> FakeArgumentValuesCreationMode
</span><span class="cx"> };
</span><span class="cx">
</span><span class="lines">@@ -310,6 +311,13 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case ClonedArgumentsCreationMode: {
+ m_numArguments = callFrame->argumentCount();
+ m_registers = reinterpret_cast<WriteBarrierBase<Unknown>*>(callFrame->registers());
+ tearOff(callFrame);
+ break;
+ }
+
</ins><span class="cx"> case FakeArgumentValuesCreationMode: {
</span><span class="cx"> m_numArguments = 0;
</span><span class="cx"> m_registers = nullptr;
</span><span class="lines">@@ -350,6 +358,20 @@
</span><span class="cx"> break;
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+ case ClonedArgumentsCreationMode: {
+ m_numArguments = inlineCallFrame->arguments.size() - 1;
+ if (m_numArguments) {
+ int offsetForArgumentOne = inlineCallFrame->arguments[1].virtualRegister().offset();
+ m_registers = reinterpret_cast<WriteBarrierBase<Unknown>*>(callFrame->registers()) + offsetForArgumentOne - virtualRegisterForArgument(1).offset();
+ } else
+ m_registers = 0;
+
+ ASSERT(!jsCast<FunctionExecutable*>(inlineCallFrame->executable.get())->symbolTable(inlineCallFrame->specializationKind())->slowArguments());
+
+ tearOff(callFrame, inlineCallFrame);
+ break;
+ }
+
</ins><span class="cx"> case FakeArgumentValuesCreationMode: {
</span><span class="cx"> m_numArguments = 0;
</span><span class="cx"> m_registers = nullptr;
</span></span></pre>
</div>
</div>
</body>
</html>