Bug 22504 – Crashes during code generation occur due to refing of ignoredResult()

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Cameron Zwarich (cpst)]

One thing seems to have been slightly overlooked in the handling of ignoredResult(). Many functions pass their value of dst to BytecodeGenerator::emitNode() and then put its return value into a RefPtr. Unfortunately, many emitBytecode() Node member functions return their passed value of dst, which leads to a crash when attempting to increase the reference count of ignoredResult(). Here is an example of this:

function f()
{
    do
        try { } catch (o) { }
    while (false) { }
}

It seems that this problem was known, because there are many emitBytecode() functions that do something like

    if (dst == ignoredResult())
        dst = 0;

However, this seems like a suboptimal solution to the problem.

[Cameron Zwarich (cpst)]

Geoff told me a pretty good solution to this bug. Make ignoredResult() an instance-specific register off of BytecodeGenerator, so that reffing it is legal. I think I will implement that.

[Cameron Zwarich (cpst)]

Created attachment 25556 [details]
Proposed patch (without tests)

I'm gonna make some tests now.

[Cameron Zwarich (cpst)]

Created attachment 25586 [details]
Proposed patch

This includes all of the cases that will crash that I am aware of.

[Eric Seidel (no email)]

Comment on attachment 25586 [details]
Proposed patch

This looks sane to me.  But one of the SFX folks should probably review it.

[Geoffrey Garen]

Comment on attachment 25586 [details]
Proposed patch

r=me

[Cameron Zwarich (cpst)]

Landed in r38930.