JSC shouldn't crash when we run out of structure address space but throw OOM

[Keith Miller]

JSC shouldn't crash when we run out of structure address space but throw OOM

[Keith Miller]

Created attachment 458392 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 458392 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=458392&action=review

> Source/JavaScriptCore/runtime/JSObjectInlines.h:421
> +    if (!newStructure) {

Currently, caller of putDirect etc. does not check exception. So I don’t think we can throw it safely without changing all the callers of putDirect.

[Mark Lam]

Comment on attachment 458392 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=458392&action=review

> Source/JavaScriptCore/runtime/JSObjectInlines.h:422
> +        auto scope = DECLARE_THROW_SCOPE(vm);

The proper idiom would be to put this decl at the top of the function.  Otherwise, callers won't always be informed that this function may throw.

[Keith Miller]

Created attachment 458412 [details]
Patch

[Michael Saboff]

Comment on attachment 458412 [details]
Patch

r=me

[Mark Lam]

Comment on attachment 458412 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=458412&action=review

> Source/JavaScriptCore/runtime/JSObjectInlines.h:423
> +        auto scope = DECLARE_THROW_SCOPE(vm);

This is still in the wrong place.  This means there will be fall out from unchecked exceptions that go undetected.

[Saam Barati]

Comment on attachment 458412 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=458412&action=review

>> Source/JavaScriptCore/runtime/JSObjectInlines.h:423
>> +        auto scope = DECLARE_THROW_SCOPE(vm);
> 
> This is still in the wrong place.  This means there will be fall out from unchecked exceptions that go undetected.

yes, agreed.

[Yusuke Suzuki]

There are many places we cannot fail. One example is JSGlobalObject initialization, which will create bunch of Structures. I wonder if throwing OOM will cause fallout in various places.

[Radar WebKit Bug Importer]

<rdar://problem/92688938>