RESOLVED FIXED 210126
[JSC] ScopedArgumentsTable should handle OOM in tolerant manner 
https://bugs.webkit.org/show_bug.cgi?id=210126
Summary [JSC] ScopedArgumentsTable should handle OOM in tolerant manner
Yusuke Suzuki
Reported 2020-04-07 09:50:12 PDT
[JSC] ScopedArgumentsTable should handle OOM in tolerant manner
Attachments
Patch (12.36 KB, patch)
2020-04-07 09:53 PDT, Yusuke Suzuki 		mark.lam: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Yusuke Suzuki
Comment 1 2020-04-07 09:53:26 PDT
Created attachment 395690 [details] Patch
Yusuke Suzuki
Comment 2 2020-04-07 09:54:03 PDT
<rdar://problem/61385114>
Mark Lam
Comment 3 2020-04-07 10:02:41 PDT
Comment on attachment 395690 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395690&action=review r=me > Source/JavaScriptCore/runtime/ScopedArguments.cpp:146 > + auto scope = DECLARE_THROW_SCOPE(vm); You’re adding a ThrowScope. Make sure to run JSC stress tests with a debug build (use --force-opt=O3 to run faster) to make sure there’s no new missing exception check failures.
Yusuke Suzuki
Comment 4 2020-04-07 10:04:00 PDT
Comment on attachment 395690 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=395690&action=review >> Source/JavaScriptCore/runtime/ScopedArguments.cpp:146 >> + auto scope = DECLARE_THROW_SCOPE(vm); > > You’re adding a ThrowScope. Make sure to run JSC stress tests with a debug build (use --force-opt=O3 to run faster) to make sure there’s no new missing exception check failures. I think this is OK since caller of unmapArgument has proper exception checks.
Yusuke Suzuki
Comment 5 2020-04-07 11:05:05 PDT
Committed r259646: <https://trac.webkit.org/changeset/259646>
Note You need to log in before you can comment on or make changes to this bug.