97836 2012-09-27 17:30:31 -0700 JSC: CallFrameClosure::resetCallFrame() can corrupt the previous frame. 2012-09-28 08:51:50 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 mark.lam mark.lam ggaren oldest_to_newest 730054 0 mark.lam 2012-09-27 17:30:31 -0700 Currently, CallFrameClosure::resetCallFrame() looks like this: void resetCallFrame() { newCallFrame->setScope(scope); for (int i = argumentCountIncludingThis; i < parameterCountIncludingThis; ++i) newCallFrame->setArgument(i, jsUndefined()); } However, CallFrame::setArgument() takes an arg index that starts from 0 and does not include the 'this' value. Since both argumentCountIncludingThis and parameterCountIncludingThis, we need to subtract 1 from both values in order to make the iterator i be a valid arg index for setArgument(). If this is not corrected, then the last setArgument() would be writing to the stack slot before the beginning of the current frame (i.e. corruption the last stack of the previous frame). In addition, it is also not properly initializing the 1st un-passed argument to 'undefined'. 730067 1 166106 mark.lam 2012-09-27 17:49:30 -0700 Created attachment 166106 Fix. 730070 2 mark.lam 2012-09-27 17:51:38 -0700 Landed in http://trac.webkit.org/changeset/129827. 730123 3 ggaren 2012-09-27 19:16:18 -0700 > In addition, it is also not properly initializing the 1st un-passed argument to 'undefined'. Please add a regression test for this. 730293 4 mark.lam 2012-09-27 23:53:50 -0700 Reopening to add a regression test. 730294 5 166156 mark.lam 2012-09-27 23:54:28 -0700 Created attachment 166156 Adding regression test. 730688 6 166156 ggaren 2012-09-28 08:43:26 -0700 Comment on attachment 166156 Adding regression test. r=me 730702 7 mark.lam 2012-09-28 08:51:50 -0700 Regression test landed in http://trac.webkit.org/changeset/129902. 166106 2012-09-27 17:49:30 -0700 2012-09-27 17:49:30 -0700 Fix. bug-97836.patch text/plain 2768 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTI5ODI1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA CisyMDEyLTA5LTI3ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBG aXhlZCBDYWxsRnJhbWVDbG9zdXJlOjpyZXNldENhbGxGcmFtZSgpIHRvIHVzZSB0aGUgdmFsaWQK KyAgICAgICAgcmFuZ2Ugb2YgYXJndW1lbnQgaW5kZXggdmFsdWVzLgorICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9OTc4MzYuCisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgR2F2aW4gQmFycmFjbG91Z2guCisKKyAgICAgICAgKiBpbnRlcnByZXRlci9DYWxsRnJh bWUuaDoKKyAgICAgICAgKEV4ZWNTdGF0ZSk6CisgICAgICAgICogaW50ZXJwcmV0ZXIvQ2FsbEZy YW1lQ2xvc3VyZS5oOgorICAgICAgICAoSlNDOjpDYWxsRnJhbWVDbG9zdXJlOjpyZXNldENhbGxG cmFtZSk6CisKIDIwMTItMDktMjcgIFBhdHJpY2sgR2Fuc3RlcmVyICA8cGFyb2dhQHdlYmtpdC5v cmc+CiAKICAgICAgICAgRml4IHVzYWdlIG9mIENPTVBJTEVSKCkgbWFjcm9zCkluZGV4OiBTb3Vy Y2UvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvQ2FsbEZyYW1lLmgKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g U291cmNlL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0NhbGxGcmFtZS5oCShyZXZpc2lvbiAx Mjk4MjMpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvQ2FsbEZyYW1lLmgJ KHdvcmtpbmcgY29weSkKQEAgLTE5MCw2ICsxOTAsMTUgQEAgbmFtZXNwYWNlIEpTQyAgewogICAg ICAgICBzdGF0aWMgaW50IGFyZ3VtZW50T2Zmc2V0KGludCBhcmd1bWVudCkgeyByZXR1cm4gc19m aXJzdEFyZ3VtZW50T2Zmc2V0IC0gYXJndW1lbnQ7IH0KICAgICAgICAgc3RhdGljIGludCBhcmd1 bWVudE9mZnNldEluY2x1ZGluZ1RoaXMoaW50IGFyZ3VtZW50KSB7IHJldHVybiBzX3RoaXNBcmd1 bWVudE9mZnNldCAtIGFyZ3VtZW50OyB9CiAKKyAgICAgICAgLy8gSW4gdGhlIGZvbGxvd2luZyAo YXJndW1lbnQoKSBhbmQgc2V0QXJndW1lbnQoKSksIHRoZSAnYXJndW1lbnQnCisgICAgICAgIC8v IHBhcmFtZXRlciBpcyB0aGUgaW5kZXggb2YgdGhlIGFyZ3VtZW50cyBvZiB0aGUgdGFyZ2V0IGZ1 bmN0aW9uIG9mCisgICAgICAgIC8vIHRoaXMgZnJhbWUuIFRoZSBpbmRleCBzdGFydHMgYXQgMCBm b3IgdGhlIGZpcnN0IGFyZywgMSBmb3IgdGhlCisgICAgICAgIC8vIHNlY29uZCwgZXRjLgorICAg ICAgICAvLworICAgICAgICAvLyBUaGUgYXJndW1lbnRzIChpbiB0aGlzIGNhc2UpIGRvIG5vdCBp bmNsdWRlIHRoZSAndGhpcycgdmFsdWUuCisgICAgICAgIC8vIGFyZ3VtZW50cygwKSB3aWxsIG5v dCBmZXRjaCB0aGUgJ3RoaXMnIHZhbHVlLiBUbyBnZXQvc2V0ICd0aGlzJywKKyAgICAgICAgLy8g dXNlIHRoaXNWYWx1ZSgpIGFuZCBzZXRUaGlzVmFsdWUoKSBiZWxvdy4KKwogICAgICAgICBKU1Zh bHVlIGFyZ3VtZW50KHNpemVfdCBhcmd1bWVudCkKICAgICAgICAgewogICAgICAgICAgICAgaWYg KGFyZ3VtZW50ID49IGFyZ3VtZW50Q291bnQoKSkKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29y ZS9pbnRlcnByZXRlci9DYWxsRnJhbWVDbG9zdXJlLmgKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0ph dmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0NhbGxGcmFtZUNsb3N1cmUuaAkocmV2aXNpb24gMTI5 ODIzKQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL0NhbGxGcmFtZUNsb3N1 cmUuaAkod29ya2luZyBjb3B5KQpAQCAtNTIsNyArNTIsMTEgQEAgc3RydWN0IENhbGxGcmFtZUNs b3N1cmUgewogICAgIHZvaWQgcmVzZXRDYWxsRnJhbWUoKQogICAgIHsKICAgICAgICAgbmV3Q2Fs bEZyYW1lLT5zZXRTY29wZShzY29wZSk7Ci0gICAgICAgIGZvciAoaW50IGkgPSBhcmd1bWVudENv dW50SW5jbHVkaW5nVGhpczsgaSA8IHBhcmFtZXRlckNvdW50SW5jbHVkaW5nVGhpczsgKytpKQor ICAgICAgICAvLyBzZXRBcmd1bWVudCgpIHRha2VzIGFuIGFyZyBpbmRleCB0aGF0IHN0YXJ0cyBm cm9tIDAgZm9yIHRoZSBmaXJzdAorICAgICAgICAvLyBhcmd1bWVudCBhZnRlciB0aGUgJ3RoaXMn IHZhbHVlLiBTaW5jZSBib3RoIGFyZ3VtZW50Q291bnRJbmNsdWRpbmdUaGlzCisgICAgICAgIC8v IGFuZCBwYXJhbWV0ZXJDb3VudEluY2x1ZGluZ1RoaXMgaW5jbHVkZXMgdGhlICd0aGlzJyB2YWx1 ZSwgd2UgbmVlZCB0bworICAgICAgICAvLyBzdWJ0cmFjdCAxIGZyb20gdGhlbSB0byBtYWtlIGkg YSB2YWxpZCBhcmd1bWVudCBpbmRleCBmb3Igc2V0QXJndW1lbnQoKS4KKyAgICAgICAgZm9yIChp bnQgaSA9IGFyZ3VtZW50Q291bnRJbmNsdWRpbmdUaGlzLTE7IGkgPCBwYXJhbWV0ZXJDb3VudElu Y2x1ZGluZ1RoaXMtMTsgKytpKQogICAgICAgICAgICAgbmV3Q2FsbEZyYW1lLT5zZXRBcmd1bWVu dChpLCBqc1VuZGVmaW5lZCgpKTsKICAgICB9CiB9Owo= 166156 2012-09-27 23:54:28 -0700 2012-09-28 08:43:26 -0700 Adding regression test. bug-97836-test.patch text/plain 3699 mark.lam SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDEyOTg1NCkKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29y a2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBACisyMDEyLTA5LTI3ICBNYXJrIExhbSAgPG1hcmsu bGFtQGFwcGxlLmNvbT4KKworICAgICAgICBBZGRpbmcgcmVncmVzc2lvbiB0ZXN0IHRvIGVuc3Vy ZSB0aGF0IGNhY2hlZCBjYWxsIHVuaW5pdGlhbGl6ZWQgYXJndW1lbnRzCisgICAgICAgIGNvcnJl Y3RseSBkZWZhdWx0cyB0byB1bmRlZmluZWQuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD05NzgzNi4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICAqIGZhc3QvanMvY2FjaGVkLWNhbGwtdW5pbml0aWFsaXplZC1h cmd1bWVudHMtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2pzL2NhY2hlZC1j YWxsLXVuaW5pdGlhbGl6ZWQtYXJndW1lbnRzLmh0bWw6IEFkZGVkLgorICAgICAgICAqIGZhc3Qv anMvc2NyaXB0LXRlc3RzL2NhY2hlZC1jYWxsLXVuaW5pdGlhbGl6ZWQtYXJndW1lbnRzLmpzOiBB ZGRlZC4KKyAgICAgICAgKGRvRm9yRWFjaC5jYWxsYmFjay5zaG91bGRCZVVuZGVmaW5lZCk6Cisg ICAgICAgIChkb0ZvckVhY2guY2FsbGJhY2spOgorICAgICAgICAoZG9Gb3JFYWNoKToKKyAgICAg ICAgKGNhbGxBZnRlclJlY3Vyc2luZ0ZvckRlcHRoKToKKwogMjAxMi0wOS0yNyAgS2VudCBUYW11 cmEgIDx0a2VudEBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgRGF0ZVRpbWVOdW1lcmljRmllbGRF bGVtZW50IHNob3VsZCB1c2UgTG9jYWxpemVyIGZ1bmN0aW9ucy4KSW5kZXg6IExheW91dFRlc3Rz L2Zhc3QvanMvY2FjaGVkLWNhbGwtdW5pbml0aWFsaXplZC1hcmd1bWVudHMtZXhwZWN0ZWQudHh0 Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvanMvY2FjaGVkLWNhbGwtdW5pbml0aWFs aXplZC1hcmd1bWVudHMtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMv ZmFzdC9qcy9jYWNoZWQtY2FsbC11bmluaXRpYWxpemVkLWFyZ3VtZW50cy1leHBlY3RlZC50eHQJ KHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTIgQEAKK1RoaXMgdGVzdCBjaGVja3MgdGhhdCB1bmlu aXRpYWxpemVkIHBhcmFtZXRlcnMgZm9yIGNhY2hlZCBjYWxsIGZ1bmN0aW9ucyBjb3JyZWN0bHkg ZGVmYXVsdHMgdG8gdW5kZWZpbmVkLgorCitPbiBzdWNjZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJp ZXMgb2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBieSAiVEVTVCBDT01QTEVURSIuCisKKwor UEFTUyBhcmc0IGlzIHVuZGVmaW5lZC4KK1BBU1MgYXJnNSBpcyB1bmRlZmluZWQuCitQQVNTIGFy ZzYgaXMgdW5kZWZpbmVkLgorUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1ZQorCitURVNU IENPTVBMRVRFCisKSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvanMvY2FjaGVkLWNhbGwtdW5pbml0 aWFsaXplZC1hcmd1bWVudHMuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2pz L2NhY2hlZC1jYWxsLXVuaW5pdGlhbGl6ZWQtYXJndW1lbnRzLmh0bWwJKHJldmlzaW9uIDApCisr KyBMYXlvdXRUZXN0cy9mYXN0L2pzL2NhY2hlZC1jYWxsLXVuaW5pdGlhbGl6ZWQtYXJndW1lbnRz Lmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTAgQEAKKzwhRE9DVFlQRSBIVE1MIFBVQkxJ QyAiLS8vSUVURi8vRFREIEhUTUwvL0VOIj4KKzxodG1sPgorPGhlYWQ+Cis8c2NyaXB0IHNyYz0i cmVzb3VyY2VzL2pzLXRlc3QtcHJlLmpzIj48L3NjcmlwdD4KKzwvaGVhZD4KKzxib2R5PgorPHNj cmlwdCBzcmM9InNjcmlwdC10ZXN0cy9jYWNoZWQtY2FsbC11bmluaXRpYWxpemVkLWFyZ3VtZW50 cy5qcyI+PC9zY3JpcHQ+Cis8c2NyaXB0IHNyYz0icmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+ PC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+CkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2pzL3Nj cmlwdC10ZXN0cy9jYWNoZWQtY2FsbC11bmluaXRpYWxpemVkLWFyZ3VtZW50cy5qcwo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2pzL3NjcmlwdC10ZXN0cy9jYWNoZWQtY2FsbC11bmlu aXRpYWxpemVkLWFyZ3VtZW50cy5qcwkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3Qv anMvc2NyaXB0LXRlc3RzL2NhY2hlZC1jYWxsLXVuaW5pdGlhbGl6ZWQtYXJndW1lbnRzLmpzCShy ZXZpc2lvbiAwKQpAQCAtMCwwICsxLDQzIEBACitkZXNjcmlwdGlvbigKKyJUaGlzIHRlc3QgY2hl Y2tzIHRoYXQgdW5pbml0aWFsaXplZCBwYXJhbWV0ZXJzIGZvciBjYWNoZWQgY2FsbCBmdW5jdGlv bnMgY29ycmVjdGx5IGRlZmF1bHRzIHRvIHVuZGVmaW5lZC4iCisKKyk7CisKK2Z1bmN0aW9uIGRv Rm9yRWFjaChhcnIpIHsKKyAgICBmdW5jdGlvbiBjYWxsYmFjayhlbGVtZW50LCBpbmRleCwgYXJy YXksIGFyZzQsIGFyZzUsIGFyZzYpIHsKKworICAgICAgICBmdW5jdGlvbiBzaG91bGRCZVVuZGVm aW5lZChfYSkgeworICAgICAgICAgICAgdmFyIGV4Y2VwdGlvbjsKKyAgICAgICAgICAgIHZhciBf YXY7CisgICAgICAgICAgICB0cnkgeworICAgICAgICAgICAgICAgIF9hdiA9IGV2YWwoX2EpOwor ICAgICAgICAgICAgfSBjYXRjaCAoZSkgeworICAgICAgICAgICAgICAgIGV4Y2VwdGlvbiA9IGU7 CisgICAgICAgICAgICB9CisKKyAgICAgICAgICAgIGlmIChleGNlcHRpb24pCisgICAgICAgICAg ICAgICAgdGVzdEZhaWxlZChfYSArICIgc2hvdWxkIGJlIHVuZGVmaW5lZC4gVGhyZXcgZXhjZXB0 aW9uICIgKyBleGNlcHRpb24pOworICAgICAgICAgICAgZWxzZSBpZiAodHlwZW9mIF9hdiA9PSAi dW5kZWZpbmVkIikKKyAgICAgICAgICAgICAgICB0ZXN0UGFzc2VkKF9hICsgIiBpcyB1bmRlZmlu ZWQuIik7CisgICAgICAgICAgICBlbHNlCisgICAgICAgICAgICAgICAgdGVzdEZhaWxlZChfYSAr ICIgc2hvdWxkIGJlIHVuZGVmaW5lZC4gV2FzICIgKyBfYXYpOworICAgICAgICB9CisKKyAgICAg ICAgc2hvdWxkQmVVbmRlZmluZWQoImFyZzQiKTsKKyAgICAgICAgc2hvdWxkQmVVbmRlZmluZWQo ImFyZzUiKTsKKyAgICAgICAgc2hvdWxkQmVVbmRlZmluZWQoImFyZzYiKTsKKyAgICB9CisKKyAg ICBhcnIuZm9yRWFjaChjYWxsYmFjayk7Cit9CisKK2Z1bmN0aW9uIGNhbGxBZnRlclJlY3Vyc2lu Z0ZvckRlcHRoKGRlcHRoLCBmdW5jLCBhcnIpIHsKKyAgICBpZiAoZGVwdGggPiAwKSB7CisgICAg ICAgIGNhbGxBZnRlclJlY3Vyc2luZ0ZvckRlcHRoKGRlcHRoIC0gMSwgZnVuYywgYXJyKTsKKyAg ICB9IGVsc2UgeworICAgICAgICBmdW5jKGFycik7CisgICAgfQorfQorCit2YXIgYXJyID0gWzFd OworY2FsbEFmdGVyUmVjdXJzaW5nRm9yRGVwdGgoMjAsIGRvRm9yRWFjaCwgYXJyKTsK