<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[212692] trunk/Source</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/212692">212692</a></dd>
<dt>Author</dt> <dd>mark.lam@apple.com</dd>
<dt>Date</dt> <dd>2017-02-20 17:51:05 -0800 (Mon, 20 Feb 2017)</dd>
</dl>
<h3>Log Message</h3>
<pre>[Re-landing] CachedCall should let GC know to keep its arguments alive.
https://bugs.webkit.org/show_bug.cgi?id=168567
<rdar://problem/30475767>
Reviewed by Saam Barati.
Source/JavaScriptCore:
We fix this by having CachedCall use a MarkedArgumentBuffer to store its
arguments instead of a Vector.
Also declared CachedCall, MarkedArgumentBuffer, and ProtoCallFrame as
WTF_FORBID_HEAP_ALLOCATION because they rely on being stack allocated for
correctness.
Update: the original patch has a bug in MarkedArgumentBuffer::expandCapacity()
where it was copying and calling addMarkSet() on values in m_buffer beyond m_size
(up to m_capacity). As a result, depending on the pre-existing values in
m_inlineBuffer, this may result in a computed Heap pointer that is wrong, and
subsequently, manifest as a crash. This is likely to be the cause of the PLT
regression.
I don't have a new test for this fix because the issue relies on sufficiently bad
values randomly showing up in m_inlineBuffer when we do an ensureCapacity() which
calls expandCapacity().
* interpreter/CachedCall.h:
(JSC::CachedCall::CachedCall):
(JSC::CachedCall::call):
(JSC::CachedCall::clearArguments):
(JSC::CachedCall::appendArgument):
(JSC::CachedCall::setArgument): Deleted.
* interpreter/CallFrame.h:
(JSC::ExecState::emptyList):
* interpreter/Interpreter.cpp:
(JSC::Interpreter::prepareForRepeatCall):
* interpreter/Interpreter.h:
* interpreter/ProtoCallFrame.h:
* runtime/ArgList.cpp:
(JSC::MarkedArgumentBuffer::slowEnsureCapacity):
(JSC::MarkedArgumentBuffer::expandCapacity):
(JSC::MarkedArgumentBuffer::slowAppend):
* runtime/ArgList.h:
(JSC::MarkedArgumentBuffer::append):
(JSC::MarkedArgumentBuffer::ensureCapacity):
* runtime/StringPrototype.cpp:
(JSC::replaceUsingRegExpSearch):
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
Source/WTF:
Added a WTF_FORBID_HEAP_ALLOCATION that will cause a compilation failure if
a class declared with it is malloced.
While this doesn't prevent that class declared WTF_FORBID_HEAP_ALLOCATION from
being embedded in another class that is heap allocated, it does at minimum
document the intent and gives the users of this class a chance to do the
right thing.
* WTF.xcodeproj/project.pbxproj:
* wtf/ForbidHeapAllocation.h: Added.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterCachedCallh">trunk/Source/JavaScriptCore/interpreter/CachedCall.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterCallFrameh">trunk/Source/JavaScriptCore/interpreter/CallFrame.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterInterpretercpp">trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterInterpreterh">trunk/Source/JavaScriptCore/interpreter/Interpreter.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterProtoCallFrameh">trunk/Source/JavaScriptCore/interpreter/ProtoCallFrame.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArgListcpp">trunk/Source/JavaScriptCore/runtime/ArgList.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArgListh">trunk/Source/JavaScriptCore/runtime/ArgList.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringPrototypecpp">trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMcpp">trunk/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeVMh">trunk/Source/JavaScriptCore/runtime/VM.h</a></li>
<li><a href="#trunkSourceWTFChangeLog">trunk/Source/WTF/ChangeLog</a></li>
<li><a href="#trunkSourceWTFWTFxcodeprojprojectpbxproj">trunk/Source/WTF/WTF.xcodeproj/project.pbxproj</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#trunkSourceWTFwtfForbidHeapAllocationh">trunk/Source/WTF/wtf/ForbidHeapAllocation.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/ChangeLog        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -1,3 +1,54 @@
</span><ins>+2017-02-20 Mark Lam <mark.lam@apple.com>
+
+ [Re-landing] CachedCall should let GC know to keep its arguments alive.
+ https://bugs.webkit.org/show_bug.cgi?id=168567
+ <rdar://problem/30475767>
+
+ Reviewed by Saam Barati.
+
+ We fix this by having CachedCall use a MarkedArgumentBuffer to store its
+ arguments instead of a Vector.
+
+ Also declared CachedCall, MarkedArgumentBuffer, and ProtoCallFrame as
+ WTF_FORBID_HEAP_ALLOCATION because they rely on being stack allocated for
+ correctness.
+
+ Update: the original patch has a bug in MarkedArgumentBuffer::expandCapacity()
+ where it was copying and calling addMarkSet() on values in m_buffer beyond m_size
+ (up to m_capacity). As a result, depending on the pre-existing values in
+ m_inlineBuffer, this may result in a computed Heap pointer that is wrong, and
+ subsequently, manifest as a crash. This is likely to be the cause of the PLT
+ regression.
+
+ I don't have a new test for this fix because the issue relies on sufficiently bad
+ values randomly showing up in m_inlineBuffer when we do an ensureCapacity() which
+ calls expandCapacity().
+
+ * interpreter/CachedCall.h:
+ (JSC::CachedCall::CachedCall):
+ (JSC::CachedCall::call):
+ (JSC::CachedCall::clearArguments):
+ (JSC::CachedCall::appendArgument):
+ (JSC::CachedCall::setArgument): Deleted.
+ * interpreter/CallFrame.h:
+ (JSC::ExecState::emptyList):
+ * interpreter/Interpreter.cpp:
+ (JSC::Interpreter::prepareForRepeatCall):
+ * interpreter/Interpreter.h:
+ * interpreter/ProtoCallFrame.h:
+ * runtime/ArgList.cpp:
+ (JSC::MarkedArgumentBuffer::slowEnsureCapacity):
+ (JSC::MarkedArgumentBuffer::expandCapacity):
+ (JSC::MarkedArgumentBuffer::slowAppend):
+ * runtime/ArgList.h:
+ (JSC::MarkedArgumentBuffer::append):
+ (JSC::MarkedArgumentBuffer::ensureCapacity):
+ * runtime/StringPrototype.cpp:
+ (JSC::replaceUsingRegExpSearch):
+ * runtime/VM.cpp:
+ (JSC::VM::VM):
+ * runtime/VM.h:
+
</ins><span class="cx"> 2017-02-20 Commit Queue <commit-queue@webkit.org>
</span><span class="cx">
</span><span class="cx"> Unreviewed, rolling out r212618.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterCachedCallh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/CachedCall.h (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/CachedCall.h        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/interpreter/CachedCall.h        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2009, 2013, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2009-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -33,10 +33,12 @@
</span><span class="cx"> #include "ProtoCallFrame.h"
</span><span class="cx"> #include "VMEntryScope.h"
</span><span class="cx"> #include "VMInlines.h"
</span><ins>+#include <wtf/ForbidHeapAllocation.h>
</ins><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx"> class CachedCall {
</span><del>- WTF_MAKE_NONCOPYABLE(CachedCall); WTF_MAKE_FAST_ALLOCATED;
</del><ins>+ WTF_MAKE_NONCOPYABLE(CachedCall);
+ WTF_FORBID_HEAP_ALLOCATION;
</ins><span class="cx"> public:
</span><span class="cx"> CachedCall(CallFrame* callFrame, JSFunction* function, int argumentCount)
</span><span class="cx"> : m_valid(false)
</span><span class="lines">@@ -49,8 +51,8 @@
</span><span class="cx">
</span><span class="cx"> ASSERT(!function->isHostFunctionNonInline());
</span><span class="cx"> if (UNLIKELY(vm.isSafeToRecurseSoft())) {
</span><del>- m_arguments.resize(argumentCount);
- m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, &m_protoCallFrame, function, argumentCount + 1, function->scope(), m_arguments.data());
</del><ins>+ m_arguments.ensureCapacity(argumentCount);
+ m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, &m_protoCallFrame, function, argumentCount + 1, function->scope(), m_arguments);
</ins><span class="cx"> } else
</span><span class="cx"> throwStackOverflowError(callFrame, scope);
</span><span class="cx"> m_valid = !scope.exception();
</span><span class="lines">@@ -59,11 +61,14 @@
</span><span class="cx"> JSValue call()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_valid);
</span><ins>+ ASSERT(m_arguments.size() == static_cast<size_t>(m_protoCallFrame.argumentCount()));
</ins><span class="cx"> return m_interpreter->execute(m_closure);
</span><span class="cx"> }
</span><span class="cx"> void setThis(JSValue v) { m_protoCallFrame.setThisValue(v); }
</span><del>- void setArgument(int n, JSValue v) { m_protoCallFrame.setArgument(n, v); }
</del><span class="cx">
</span><ins>+ void clearArguments() { m_arguments.clear(); }
+ void appendArgument(JSValue v) { m_arguments.append(v); }
+
</ins><span class="cx"> private:
</span><span class="cx"> bool m_valid;
</span><span class="cx"> Interpreter* m_interpreter;
</span><span class="lines">@@ -70,7 +75,7 @@
</span><span class="cx"> VM& m_vm;
</span><span class="cx"> VMEntryScope m_entryScope;
</span><span class="cx"> ProtoCallFrame m_protoCallFrame;
</span><del>- Vector<JSValue> m_arguments;
</del><ins>+ MarkedArgumentBuffer m_arguments;
</ins><span class="cx"> CallFrameClosure m_closure;
</span><span class="cx"> };
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterCallFrameh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/CallFrame.h (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/CallFrame.h        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/interpreter/CallFrame.h        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><span class="cx"> * Copyright (C) 2001 Peter Kelly (pmk@post.com)
</span><del>- * Copyright (C) 2003, 2007-2008, 2011, 2013-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -119,7 +119,7 @@
</span><span class="cx">
</span><span class="cx"> AtomicStringTable* atomicStringTable() const { return vm().atomicStringTable(); }
</span><span class="cx"> const CommonIdentifiers& propertyNames() const { return *vm().propertyNames; }
</span><del>- const MarkedArgumentBuffer& emptyList() const { return *vm().emptyList; }
</del><ins>+ const ArgList& emptyList() const { return *vm().emptyList; }
</ins><span class="cx"> Interpreter* interpreter() { return vm().interpreter; }
</span><span class="cx"> Heap* heap() { return &vm().heap; }
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterInterpretercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008-2010, 2012-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
</span><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -1005,7 +1005,7 @@
</span><span class="cx"> return checkedReturn(asObject(result));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* functionExecutable, CallFrame* callFrame, ProtoCallFrame* protoCallFrame, JSFunction* function, int argumentCountIncludingThis, JSScope* scope, JSValue* args)
</del><ins>+CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* functionExecutable, CallFrame* callFrame, ProtoCallFrame* protoCallFrame, JSFunction* function, int argumentCountIncludingThis, JSScope* scope, const ArgList& args)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = *scope->vm();
</span><span class="cx"> auto throwScope = DECLARE_THROW_SCOPE(vm);
</span><span class="lines">@@ -1025,7 +1025,7 @@
</span><span class="cx">
</span><span class="cx"> size_t argsCount = argumentCountIncludingThis;
</span><span class="cx">
</span><del>- protoCallFrame->init(newCodeBlock, function, jsUndefined(), argsCount, args);
</del><ins>+ protoCallFrame->init(newCodeBlock, function, jsUndefined(), argsCount, args.data());
</ins><span class="cx"> // Return the successful closure:
</span><span class="cx"> CallFrameClosure result = { callFrame, protoCallFrame, function, functionExecutable, &vm, scope, newCodeBlock->numParameters(), argumentCountIncludingThis };
</span><span class="cx"> return result;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterInterpreterh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/Interpreter.h (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/Interpreter.h        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/interpreter/Interpreter.h        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2013, 2015-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
</span><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -154,7 +154,7 @@
</span><span class="cx"> private:
</span><span class="cx"> enum ExecutionFlag { Normal, InitializeAndReturn };
</span><span class="cx">
</span><del>- CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, ProtoCallFrame*, JSFunction*, int argumentCountIncludingThis, JSScope*, JSValue*);
</del><ins>+ CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, ProtoCallFrame*, JSFunction*, int argumentCountIncludingThis, JSScope*, const ArgList&);
</ins><span class="cx">
</span><span class="cx"> JSValue execute(CallFrameClosure&);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterProtoCallFrameh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/ProtoCallFrame.h (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/ProtoCallFrame.h        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/interpreter/ProtoCallFrame.h        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2013-2017 Apple Inc. All Rights Reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -26,10 +26,13 @@
</span><span class="cx"> #pragma once
</span><span class="cx">
</span><span class="cx"> #include "Register.h"
</span><ins>+#include <wtf/ForbidHeapAllocation.h>
</ins><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><span class="cx"> struct JS_EXPORT_PRIVATE ProtoCallFrame {
</span><ins>+ WTF_FORBID_HEAP_ALLOCATION;
+public:
</ins><span class="cx"> Register codeBlockValue;
</span><span class="cx"> Register calleeValue;
</span><span class="cx"> Register argCountAndCodeOriginValue;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArgListcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArgList.cpp (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArgList.cpp        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/runtime/ArgList.cpp        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2009, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -63,12 +63,24 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void MarkedArgumentBuffer::slowEnsureCapacity(size_t requestedCapacity)
+{
+ int newCapacity = Checked<int>(requestedCapacity).unsafeGet();
+ expandCapacity(newCapacity);
+}
+
</ins><span class="cx"> void MarkedArgumentBuffer::expandCapacity()
</span><span class="cx"> {
</span><span class="cx"> int newCapacity = (Checked<int>(m_capacity) * 2).unsafeGet();
</span><ins>+ expandCapacity(newCapacity);
+}
+
+void MarkedArgumentBuffer::expandCapacity(int newCapacity)
+{
+ ASSERT(m_capacity < newCapacity);
</ins><span class="cx"> size_t size = (Checked<size_t>(newCapacity) * sizeof(EncodedJSValue)).unsafeGet();
</span><span class="cx"> EncodedJSValue* newBuffer = static_cast<EncodedJSValue*>(fastMalloc(size));
</span><del>- for (int i = 0; i < m_capacity; ++i) {
</del><ins>+ for (int i = 0; i < m_size; ++i) {
</ins><span class="cx"> newBuffer[i] = m_buffer[i];
</span><span class="cx"> addMarkSet(JSValue::decode(m_buffer[i]));
</span><span class="cx"> }
</span><span class="lines">@@ -82,7 +94,8 @@
</span><span class="cx">
</span><span class="cx"> void MarkedArgumentBuffer::slowAppend(JSValue v)
</span><span class="cx"> {
</span><del>- if (m_size >= m_capacity)
</del><ins>+ ASSERT(m_size <= m_capacity);
+ if (m_size == m_capacity)
</ins><span class="cx"> expandCapacity();
</span><span class="cx">
</span><span class="cx"> slotFor(m_size) = JSValue::encode(v);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArgListh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArgList.h (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArgList.h        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/runtime/ArgList.h        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><del>- * Copyright (C) 2003, 2007, 2008, 2009, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -22,6 +22,7 @@
</span><span class="cx"> #pragma once
</span><span class="cx">
</span><span class="cx"> #include "CallFrame.h"
</span><ins>+#include <wtf/ForbidHeapAllocation.h>
</ins><span class="cx"> #include <wtf/HashSet.h>
</span><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -28,6 +29,7 @@
</span><span class="cx">
</span><span class="cx"> class MarkedArgumentBuffer {
</span><span class="cx"> WTF_MAKE_NONCOPYABLE(MarkedArgumentBuffer);
</span><ins>+ WTF_FORBID_HEAP_ALLOCATION;
</ins><span class="cx"> friend class VM;
</span><span class="cx"> friend class ArgList;
</span><span class="cx">
</span><span class="lines">@@ -73,7 +75,8 @@
</span><span class="cx">
</span><span class="cx"> void append(JSValue v)
</span><span class="cx"> {
</span><del>- if (m_size >= m_capacity || mallocBase())
</del><ins>+ ASSERT(m_size <= m_capacity);
+ if (m_size == m_capacity || mallocBase())
</ins><span class="cx"> return slowAppend(v);
</span><span class="cx">
</span><span class="cx"> slotFor(m_size) = JSValue::encode(v);
</span><span class="lines">@@ -94,8 +97,16 @@
</span><span class="cx">
</span><span class="cx"> static void markLists(SlotVisitor&, ListSet&);
</span><span class="cx">
</span><ins>+ void ensureCapacity(size_t requestedCapacity)
+ {
+ if (requestedCapacity > static_cast<size_t>(m_capacity))
+ slowEnsureCapacity(requestedCapacity);
+ }
+
</ins><span class="cx"> private:
</span><span class="cx"> void expandCapacity();
</span><ins>+ void expandCapacity(int newCapacity);
+ void slowEnsureCapacity(size_t requestedCapacity);
</ins><span class="cx">
</span><span class="cx"> void addMarkSet(JSValue);
</span><span class="cx">
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><del>- * Copyright (C) 2004-2008, 2013, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2009 Torch Mobile, Inc.
</span><span class="cx"> * Copyright (C) 2015 Jordan Harband (ljharb@gmail.com)
</span><span class="cx"> *
</span><span class="lines">@@ -539,18 +539,19 @@
</span><span class="cx"> OUT_OF_MEMORY(exec, scope);
</span><span class="cx">
</span><span class="cx"> unsigned i = 0;
</span><ins>+ cachedCall.clearArguments();
</ins><span class="cx"> for (; i < regExp->numSubpatterns() + 1; ++i) {
</span><span class="cx"> int matchStart = ovector[i * 2];
</span><span class="cx"> int matchLen = ovector[i * 2 + 1] - matchStart;
</span><span class="cx">
</span><span class="cx"> if (matchStart < 0)
</span><del>- cachedCall.setArgument(i, jsUndefined());
</del><ins>+ cachedCall.appendArgument(jsUndefined());
</ins><span class="cx"> else
</span><del>- cachedCall.setArgument(i, jsSubstring(&vm, source, matchStart, matchLen));
</del><ins>+ cachedCall.appendArgument(jsSubstring(&vm, source, matchStart, matchLen));
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- cachedCall.setArgument(i++, jsNumber(result.start));
- cachedCall.setArgument(i++, string);
</del><ins>+ cachedCall.appendArgument(jsNumber(result.start));
+ cachedCall.appendArgument(string);
</ins><span class="cx">
</span><span class="cx"> cachedCall.setThis(jsUndefined());
</span><span class="cx"> JSValue jsResult = cachedCall.call();
</span><span class="lines">@@ -578,18 +579,19 @@
</span><span class="cx"> OUT_OF_MEMORY(exec, scope);
</span><span class="cx">
</span><span class="cx"> unsigned i = 0;
</span><ins>+ cachedCall.clearArguments();
</ins><span class="cx"> for (; i < regExp->numSubpatterns() + 1; ++i) {
</span><span class="cx"> int matchStart = ovector[i * 2];
</span><span class="cx"> int matchLen = ovector[i * 2 + 1] - matchStart;
</span><span class="cx">
</span><span class="cx"> if (matchStart < 0)
</span><del>- cachedCall.setArgument(i, jsUndefined());
</del><ins>+ cachedCall.appendArgument(jsUndefined());
</ins><span class="cx"> else
</span><del>- cachedCall.setArgument(i, jsSubstring(&vm, source, matchStart, matchLen));
</del><ins>+ cachedCall.appendArgument(jsSubstring(&vm, source, matchStart, matchLen));
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- cachedCall.setArgument(i++, jsNumber(result.start));
- cachedCall.setArgument(i++, string);
</del><ins>+ cachedCall.appendArgument(jsNumber(result.start));
+ cachedCall.appendArgument(string);
</ins><span class="cx">
</span><span class="cx"> cachedCall.setThis(jsUndefined());
</span><span class="cx"> JSValue jsResult = cachedCall.call();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.cpp (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.cpp        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/runtime/VM.cpp        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -180,7 +180,7 @@
</span><span class="cx"> , topJSWebAssemblyInstance(nullptr)
</span><span class="cx"> , m_atomicStringTable(vmType == Default ? wtfThreadData().atomicStringTable() : new AtomicStringTable)
</span><span class="cx"> , propertyNames(nullptr)
</span><del>- , emptyList(new MarkedArgumentBuffer)
</del><ins>+ , emptyList(new ArgList)
</ins><span class="cx"> , machineCodeBytesPerBytecodeWordForBaselineJIT(std::make_unique<SimpleStats>())
</span><span class="cx"> , customGetterSetterFunctionMap(*this)
</span><span class="cx"> , stringCache(*this)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/VM.h (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/VM.h        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/JavaScriptCore/runtime/VM.h        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -385,7 +385,7 @@
</span><span class="cx"> WTF::SymbolRegistry m_symbolRegistry;
</span><span class="cx"> TemplateRegistryKeyTable m_templateRegistryKeytable;
</span><span class="cx"> CommonIdentifiers* propertyNames;
</span><del>- const MarkedArgumentBuffer* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
</del><ins>+ const ArgList* emptyList;
</ins><span class="cx"> SmallStrings smallStrings;
</span><span class="cx"> NumericStrings numericStrings;
</span><span class="cx"> DateInstanceCache dateInstanceCache;
</span></span></pre></div>
<a id="trunkSourceWTFChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/ChangeLog (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/ChangeLog        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/WTF/ChangeLog        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -1,3 +1,22 @@
</span><ins>+2017-02-20 Mark Lam <mark.lam@apple.com>
+
+ [Re-landing] CachedCall should let GC know to keep its arguments alive.
+ https://bugs.webkit.org/show_bug.cgi?id=168567
+ <rdar://problem/30475767>
+
+ Reviewed by Saam Barati.
+
+ Added a WTF_FORBID_HEAP_ALLOCATION that will cause a compilation failure if
+ a class declared with it is malloced.
+
+ While this doesn't prevent that class declared WTF_FORBID_HEAP_ALLOCATION from
+ being embedded in another class that is heap allocated, it does at minimum
+ document the intent and gives the users of this class a chance to do the
+ right thing.
+
+ * WTF.xcodeproj/project.pbxproj:
+ * wtf/ForbidHeapAllocation.h: Added.
+
</ins><span class="cx"> 2017-02-20 Ryan Haddad <ryanhaddad@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, rolling out r212685.
</span></span></pre></div>
<a id="trunkSourceWTFWTFxcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/WTF/WTF.xcodeproj/project.pbxproj (212691 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/WTF.xcodeproj/project.pbxproj        2017-02-21 01:48:10 UTC (rev 212691)
+++ trunk/Source/WTF/WTF.xcodeproj/project.pbxproj        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -368,6 +368,7 @@
</span><span class="cx">                 E4A0AD3D1A96253C00536DF6 /* WorkQueueCocoa.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4A0AD3C1A96253C00536DF6 /* WorkQueueCocoa.cpp */; };
</span><span class="cx">                 EB95E1F0161A72410089A2F5 /* ByteOrder.h in Headers */ = {isa = PBXBuildFile; fileRef = EB95E1EF161A72410089A2F5 /* ByteOrder.h */; };
</span><span class="cx">                 FE8225311B2A1E5B00BA68FD /* NakedPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = FE8225301B2A1E5B00BA68FD /* NakedPtr.h */; };
</span><ins>+                FE86A8751E59440200111BBF /* ForbidHeapAllocation.h in Headers */ = {isa = PBXBuildFile; fileRef = FE86A8741E59440200111BBF /* ForbidHeapAllocation.h */; };
</ins><span class="cx">                 FE8925B01D00DAEC0046907E /* Indenter.h in Headers */ = {isa = PBXBuildFile; fileRef = FE8925AF1D00DAEC0046907E /* Indenter.h */; };
</span><span class="cx">                 FEDACD3D1630F83F00C69634 /* StackStats.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FEDACD3B1630F83F00C69634 /* StackStats.cpp */; };
</span><span class="cx">                 FEDACD3E1630F83F00C69634 /* StackStats.h in Headers */ = {isa = PBXBuildFile; fileRef = FEDACD3C1630F83F00C69634 /* StackStats.h */; };
</span><span class="lines">@@ -751,6 +752,7 @@
</span><span class="cx">                 EB95E1EF161A72410089A2F5 /* ByteOrder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByteOrder.h; sourceTree = "<group>"; };
</span><span class="cx">                 F72BBDB107FA424886178B9E /* SymbolImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SymbolImpl.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 FE8225301B2A1E5B00BA68FD /* NakedPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NakedPtr.h; sourceTree = "<group>"; };
</span><ins>+                FE86A8741E59440200111BBF /* ForbidHeapAllocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ForbidHeapAllocation.h; sourceTree = "<group>"; };
</ins><span class="cx">                 FE8925AF1D00DAEC0046907E /* Indenter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Indenter.h; sourceTree = "<group>"; };
</span><span class="cx">                 FEDACD3B1630F83F00C69634 /* StackStats.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StackStats.cpp; sourceTree = "<group>"; };
</span><span class="cx">                 FEDACD3C1630F83F00C69634 /* StackStats.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StackStats.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -962,6 +964,7 @@
</span><span class="cx">                                 0F9D335B165DBA73005AD387 /* FilePrintStream.cpp */,
</span><span class="cx">                                 0F9D335C165DBA73005AD387 /* FilePrintStream.h */,
</span><span class="cx">                                 0F2B66A517B6B4F700A7AE3F /* FlipBytes.h */,
</span><ins>+                                FE86A8741E59440200111BBF /* ForbidHeapAllocation.h */,
</ins><span class="cx">                                 A8A472A6151A825A004123FF /* Forward.h */,
</span><span class="cx">                                 83F2BADE1CF9524E003E99C3 /* Function.h */,
</span><span class="cx">                                 1A1D8B9D1731879800141DA4 /* FunctionDispatcher.cpp */,
</span><span class="lines">@@ -1418,6 +1421,7 @@
</span><span class="cx">                                 83F2BADF1CF9524E003E99C3 /* Function.h in Headers */,
</span><span class="cx">                                 1A1D8B9C173186CE00141DA4 /* FunctionDispatcher.h in Headers */,
</span><span class="cx">                                 A8A473CA151A825B004123FF /* GetPtr.h in Headers */,
</span><ins>+                                FE86A8751E59440200111BBF /* ForbidHeapAllocation.h in Headers */,
</ins><span class="cx">                                 0FEC84AF1BD825310080FF74 /* GraphNodeWorklist.h in Headers */,
</span><span class="cx">                                 2C05385415BC819000F21B96 /* GregorianDateTime.h in Headers */,
</span><span class="cx">                                 A8A473D3151A825B004123FF /* HashCountedSet.h in Headers */,
</span></span></pre></div>
<a id="trunkSourceWTFwtfForbidHeapAllocationh"></a>
<div class="addfile"><h4>Added: trunk/Source/WTF/wtf/ForbidHeapAllocation.h (0 => 212692)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WTF/wtf/ForbidHeapAllocation.h         (rev 0)
+++ trunk/Source/WTF/wtf/ForbidHeapAllocation.h        2017-02-21 01:51:05 UTC (rev 212692)
</span><span class="lines">@@ -0,0 +1,37 @@
</span><ins>+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#define WTF_FORBID_HEAP_ALLOCATION \
+private: \
+ void* operator new(size_t, void*) = delete; \
+ void* operator new[](size_t, void*) = delete; \
+ void* operator new(size_t) = delete; \
+ void operator delete(void*) = delete; \
+ void* operator new[](size_t size) = delete; \
+ void operator delete[](void*) = delete; \
+ void* operator new(size_t, NotNullTag, void* location) = delete; \
+ typedef int __thisIsHereToForceASemicolonAfterThisForbidHeapAllocationMacro
</ins></span></pre>
</div>
</div>
</body>
</html>