Title: [242868] releases/WebKitGTK/webkit-2.24
- Revision
- 242868
- Author
- [email protected]
- Date
- 2019-03-13 02:25:06 -0700 (Wed, 13 Mar 2019)
Log Message
Merge r242667 - Stack overflow crash in JSC::JSObject::hasInstance.
https://bugs.webkit.org/show_bug.cgi?id=195458
<rdar://problem/48710195>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/stack-overflow-in-custom-hasInstance.js: Added.
Source/_javascript_Core:
* runtime/JSObject.cpp:
(JSC::JSObject::hasInstance):
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.24/JSTests/ChangeLog (242867 => 242868)
--- releases/WebKitGTK/webkit-2.24/JSTests/ChangeLog 2019-03-13 09:25:02 UTC (rev 242867)
+++ releases/WebKitGTK/webkit-2.24/JSTests/ChangeLog 2019-03-13 09:25:06 UTC (rev 242868)
@@ -1,3 +1,13 @@
+2019-03-08 Mark Lam <[email protected]>
+
+ Stack overflow crash in JSC::JSObject::hasInstance.
+ https://bugs.webkit.org/show_bug.cgi?id=195458
+ <rdar://problem/48710195>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/stack-overflow-in-custom-hasInstance.js: Added.
+
2019-03-06 Saam Barati <[email protected]>
Air::reportUsedRegisters must padInterference
Added: releases/WebKitGTK/webkit-2.24/JSTests/stress/stack-overflow-in-custom-hasInstance.js (0 => 242868)
--- releases/WebKitGTK/webkit-2.24/JSTests/stress/stack-overflow-in-custom-hasInstance.js (rev 0)
+++ releases/WebKitGTK/webkit-2.24/JSTests/stress/stack-overflow-in-custom-hasInstance.js 2019-03-13 09:25:06 UTC (rev 242868)
@@ -0,0 +1,28 @@
+//@ requireOptions("--maxPerThreadStackUsage=147456", "--exceptionStackTraceLimit=1", "--defaultErrorStackTraceLimit=1")
+
+function f() {}
+
+var fn = f;
+for (var i = 0; i < 100000; ++i) {
+ fn = fn.bind();
+
+ // Ensure we don't fallback to @@hasInstance from %FunctionPrototype%.
+ Object.defineProperty(fn, Symbol.hasInstance, {
+ value: undefined, writable: true, enumerable: true, writable: true
+ });
+
+ // Prevent generating overlong names of the form "bound bound bound [...] f".
+ Object.defineProperty(fn, "name", {
+ value: "", writable: true, enumerable: true, writable: true
+ });
+}
+
+var exception;
+try {
+ ({}) instanceof fn;
+} catch (e) {
+ exception = e;
+}
+
+if (exception != "RangeError: Maximum call stack size exceeded.")
+ throw "FAILED";
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog (242867 => 242868)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog 2019-03-13 09:25:02 UTC (rev 242867)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/ChangeLog 2019-03-13 09:25:06 UTC (rev 242868)
@@ -1,3 +1,14 @@
+2019-03-08 Mark Lam <[email protected]>
+
+ Stack overflow crash in JSC::JSObject::hasInstance.
+ https://bugs.webkit.org/show_bug.cgi?id=195458
+ <rdar://problem/48710195>
+
+ Reviewed by Yusuke Suzuki.
+
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::hasInstance):
+
2019-03-06 Saam Barati <[email protected]>
Air::reportUsedRegisters must padInterference
Modified: releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/JSObject.cpp (242867 => 242868)
--- releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/JSObject.cpp 2019-03-13 09:25:02 UTC (rev 242867)
+++ releases/WebKitGTK/webkit-2.24/Source/_javascript_Core/runtime/JSObject.cpp 2019-03-13 09:25:06 UTC (rev 242868)
@@ -46,6 +46,7 @@
#include "ProxyObject.h"
#include "SlotVisitorInlines.h"
#include "TypeError.h"
+#include "VMInlines.h"
#include <math.h>
#include <wtf/Assertions.h>
@@ -2206,8 +2207,13 @@
RETURN_IF_EXCEPTION(scope, false);
RELEASE_AND_RETURN(scope, defaultHasInstance(exec, value, prototype));
}
- if (info.implementsHasInstance())
+ if (info.implementsHasInstance()) {
+ if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+ throwStackOverflowError(exec, scope);
+ return false;
+ }
RELEASE_AND_RETURN(scope, methodTable(vm)->customHasInstance(this, exec, value));
+ }
throwException(exec, scope, createInvalidInstanceofParameterErrorNotFunction(exec, this));
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
