Bug 197749 - parseStatementListItem needs a stack overflow check
Summary: parseStatementListItem needs a stack overflow check
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Keith Miller
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-05-09 12:00 PDT by Keith Miller
Modified: 2019-05-09 16:09 PDT (History)
9 users (show)

See Also:

Attachments
Patch (2.82 KB, patch)
2019-05-09 12:02 PDT, Keith Miller 		no flags Details | Formatted Diff | Diff
Patch (2.85 KB, patch)
2019-05-09 12:03 PDT, Keith Miller 		no flags Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Keith Miller 2019-05-09 12:00:55 PDT 
parseStatementListItem needs a stack overflow check
Comment 1 Keith Miller 2019-05-09 12:02:18 PDT 
Created attachment 369506 [details]
Patch
Comment 2 Keith Miller 2019-05-09 12:03:09 PDT 
Created attachment 369507 [details]
Patch
Comment 3 Keith Miller 2019-05-09 12:03:34 PDT 
rdar://problem/50302697
Comment 4 Yusuke Suzuki 2019-05-09 12:05:07 PDT 
Comment on attachment 369507 [details]
Patch

r=me too :)
Comment 5 WebKit Commit Bot 2019-05-09 12:40:54 PDT 
Comment on attachment 369507 [details]
Patch

Clearing flags on attachment: 369507

Committed r245152: <https://trac.webkit.org/changeset/245152>
Comment 6 WebKit Commit Bot 2019-05-09 12:40:55 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 7 Ryan Haddad 2019-05-09 15:40:39 PDT 
stress/many-nested-functions-parser-stack-overflow.js is failing on the release JSC bot:
https://build.webkit.org/builders/Apple%20High%20Sierra%20Release%20JSC%20(Tests)/builds/9309/steps/jscore-test/logs/stdio
Comment 8 Ryan Haddad 2019-05-09 15:49:52 PDT 
It looks like jsc-ews saw the same:
** The following JSC stress test failures have been introduced:
	stress/many-nested-functions-parser-stack-overflow.js.bytecode-cache
	stress/many-nested-functions-parser-stack-overflow.js.default
	stress/many-nested-functions-parser-stack-overflow.js.dfg-eager
	stress/many-nested-functions-parser-stack-overflow.js.dfg-eager-no-cjit-validate
	stress/many-nested-functions-parser-stack-overflow.js.dfg-maximal-flush-validate-no-cjit
	stress/many-nested-functions-parser-stack-overflow.js.ftl-eager
	stress/many-nested-functions-parser-stack-overflow.js.ftl-eager-no-cjit
	stress/many-nested-functions-parser-stack-overflow.js.ftl-eager-no-cjit-b3o1
	stress/many-nested-functions-parser-stack-overflow.js.ftl-no-cjit-b3o0
	stress/many-nested-functions-parser-stack-overflow.js.ftl-no-cjit-no-inline-validate
	stress/many-nested-functions-parser-stack-overflow.js.ftl-no-cjit-no-put-stack-validate
	stress/many-nested-functions-parser-stack-overflow.js.ftl-no-cjit-small-pool
	stress/many-nested-functions-parser-stack-overflow.js.ftl-no-cjit-validate-sampling-profiler
	stress/many-nested-functions-parser-stack-overflow.js.no-cjit-collect-continuously
	stress/many-nested-functions-parser-stack-overflow.js.no-cjit-validate-phases
	stress/many-nested-functions-parser-stack-overflow.js.no-ftl
	stress/many-nested-functions-parser-stack-overflow.js.no-llint
Comment 9 Keith Miller 2019-05-09 16:09:04 PDT 
(In reply to Ryan Haddad from comment #8)
> It looks like jsc-ews saw the same:
> ** The following JSC stress test failures have been introduced:
> 	stress/many-nested-functions-parser-stack-overflow.js.bytecode-cache
> 	stress/many-nested-functions-parser-stack-overflow.js.default
> 	stress/many-nested-functions-parser-stack-overflow.js.dfg-eager
> 	stress/many-nested-functions-parser-stack-overflow.js.dfg-eager-no-cjit-
> validate
> 	stress/many-nested-functions-parser-stack-overflow.js.dfg-maximal-flush-
> validate-no-cjit
> 	stress/many-nested-functions-parser-stack-overflow.js.ftl-eager
> 	stress/many-nested-functions-parser-stack-overflow.js.ftl-eager-no-cjit
> 	stress/many-nested-functions-parser-stack-overflow.js.ftl-eager-no-cjit-b3o1
> 	stress/many-nested-functions-parser-stack-overflow.js.ftl-no-cjit-b3o0
> 	stress/many-nested-functions-parser-stack-overflow.js.ftl-no-cjit-no-inline-
> validate
> 	stress/many-nested-functions-parser-stack-overflow.js.ftl-no-cjit-no-put-
> stack-validate
> 	stress/many-nested-functions-parser-stack-overflow.js.ftl-no-cjit-small-pool
> 	stress/many-nested-functions-parser-stack-overflow.js.ftl-no-cjit-validate-
> sampling-profiler
> 	stress/many-nested-functions-parser-stack-overflow.js.no-cjit-collect-
> continuously
> 	stress/many-nested-functions-parser-stack-overflow.js.no-cjit-validate-
> phases
> 	stress/many-nested-functions-parser-stack-overflow.js.no-ftl
> 	stress/many-nested-functions-parser-stack-overflow.js.no-llint

Should be fixed with: https://trac.webkit.org/changeset/245163