Skip to content

Commit

Permalink
Improve Proxy recrusion check in their internal methods.
Browse files Browse the repository at this point in the history 
In some parts of Proxy internal methods the compiler can do a bit of
tail call optimalization which would be ok, but the current stack limit
check framework in Jerry uses the stack pointer to calculate the stack depth.
This way of stack depth calculation is affected by the tail call optimalization
(as the stack does not increase).

By disabling the tail call optimalization at given points the stack limit calculation
will work as expected. This causes a bit of stack overhead, but the Proxy in it self
is a fairly big chunk of code and this stack limit would only be relevant if the Proxy
already does recusion which already very edge case.

The stack limit (--stack-limit=..) should be enabled to correctly report such stack
depth errors.

JerryScript-DCO-1.0-Signed-off-by: Peter Gal [email protected]
  • Loading branch information
@galpeter
galpeter committed Feb 5, 2021
1 parent dd698f8 commit 4c629f4
Show file tree
Hide file tree
Showing 4 changed files with 255 additions and 15 deletions.
2 changes: 1 addition & 1 deletion .github/workflows/gh-actions.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ jobs:
- run: >-
$RUNNER -q --jerry-tests
--buildoptions=--stack-limit=0,--compile-flag=-fsanitize=address,--compile-flag=-m32,--compile-flag=-fno-omit-frame-pointer,--compile-flag=-fno-common,--compile-flag=-O2,--debug,--system-allocator=on,--linker-flag=-fuse-ld=gold
--skip-list=parser-oom.js,parser-oom2.js,stack-limit.js,regression-test-issue-2190.js,regression-test-issue-2258-2963.js,regression-test-issue-2448.js,regression-test-issue-2905.js,regression-test-issue-3785.js
--skip-list=parser-oom.js,parser-oom2.js,stack-limit.js,regression-test-issue-2190.js,regression-test-issue-2258-2963.js,regression-test-issue-2448.js,regression-test-issue-2905.js,regression-test-issue-3785.js,proxy-evil-recursion.js
UBSAN_Tests:
runs-on: ubuntu-latest
Expand Down
70 changes: 56 additions & 14 deletions jerry-core/ecma/operations/ecma-proxy-object.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -263,6 +263,7 @@ ecma_value_t
ecma_proxy_object_get_prototype_of (ecma_object_t *obj_p) /**< proxy object */
{
JERRY_ASSERT (ECMA_OBJECT_IS_PROXY (obj_p));
ECMA_CHECK_STACK_USAGE ();

ecma_proxy_object_t *proxy_obj_p = (ecma_proxy_object_t *) obj_p;

Expand All @@ -284,7 +285,9 @@ ecma_proxy_object_get_prototype_of (ecma_object_t *obj_p) /**< proxy object */
/* 7. */
if (ecma_is_value_undefined (trap))
{
return ecma_builtin_object_object_get_prototype_of (target_obj_p);
ecma_value_t result = ecma_builtin_object_object_get_prototype_of (target_obj_p);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

ecma_object_t *func_obj_p = ecma_get_object_from_value (trap);
Expand Down Expand Up @@ -367,6 +370,7 @@ ecma_proxy_object_set_prototype_of (ecma_object_t *obj_p, /**< proxy object */
ecma_value_t proto) /**< new prototype object */
{
JERRY_ASSERT (ECMA_OBJECT_IS_PROXY (obj_p));
ECMA_CHECK_STACK_USAGE ();

/* 1. */
JERRY_ASSERT (ecma_is_value_object (proto) || ecma_is_value_null (proto));
Expand All @@ -393,10 +397,14 @@ ecma_proxy_object_set_prototype_of (ecma_object_t *obj_p, /**< proxy object */
{
if (ECMA_OBJECT_IS_PROXY (target_obj_p))
{
return ecma_proxy_object_set_prototype_of (target_obj_p, proto);
ecma_value_t result = ecma_proxy_object_set_prototype_of (target_obj_p, proto);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

return ecma_op_ordinary_object_set_prototype_of (target_obj_p, proto);
ecma_value_t result = ecma_op_ordinary_object_set_prototype_of (target_obj_p, proto);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

ecma_object_t *func_obj_p = ecma_get_object_from_value (trap);
Expand Down Expand Up @@ -471,6 +479,7 @@ ecma_value_t
ecma_proxy_object_is_extensible (ecma_object_t *obj_p) /**< proxy object */
{
JERRY_ASSERT (ECMA_OBJECT_IS_PROXY (obj_p));
ECMA_CHECK_STACK_USAGE ();

ecma_proxy_object_t *proxy_obj_p = (ecma_proxy_object_t *) obj_p;

Expand All @@ -492,7 +501,9 @@ ecma_proxy_object_is_extensible (ecma_object_t *obj_p) /**< proxy object */
/* 7. */
if (ecma_is_value_undefined (trap))
{
return ecma_builtin_object_object_is_extensible (target_obj_p);
ecma_value_t result = ecma_builtin_object_object_is_extensible (target_obj_p);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

ecma_object_t *func_obj_p = ecma_get_object_from_value (trap);
Expand Down Expand Up @@ -555,6 +566,7 @@ ecma_value_t
ecma_proxy_object_prevent_extensions (ecma_object_t *obj_p) /**< proxy object */
{
JERRY_ASSERT (ECMA_OBJECT_IS_PROXY (obj_p));
ECMA_CHECK_STACK_USAGE ();

ecma_proxy_object_t *proxy_obj_p = (ecma_proxy_object_t *) obj_p;

Expand Down Expand Up @@ -643,6 +655,8 @@ ecma_proxy_object_get_own_property_descriptor (ecma_object_t *obj_p, /**< proxy
ecma_property_descriptor_t *prop_desc_p) /**< [out] property
* descriptor */
{
ECMA_CHECK_STACK_USAGE ();

ecma_proxy_object_t *proxy_obj_p = (ecma_proxy_object_t *) obj_p;

/* 2. */
Expand All @@ -664,7 +678,9 @@ ecma_proxy_object_get_own_property_descriptor (ecma_object_t *obj_p, /**< proxy
/* 8. */
if (ecma_is_value_undefined (trap))
{
return ecma_op_object_get_own_property_descriptor (target_obj_p, prop_name_p, prop_desc_p);
ecma_value_t result = ecma_op_object_get_own_property_descriptor (target_obj_p, prop_name_p, prop_desc_p);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

ecma_object_t *func_obj_p = ecma_get_object_from_value (trap);
Expand Down Expand Up @@ -826,6 +842,7 @@ ecma_proxy_object_define_own_property (ecma_object_t *obj_p, /**< proxy object *
const ecma_property_descriptor_t *prop_desc_p) /**< property descriptor */
{
JERRY_ASSERT (ECMA_OBJECT_IS_PROXY (obj_p));
ECMA_CHECK_STACK_USAGE ();

ecma_proxy_object_t *proxy_obj_p = (ecma_proxy_object_t *) obj_p;

Expand All @@ -847,7 +864,9 @@ ecma_proxy_object_define_own_property (ecma_object_t *obj_p, /**< proxy object *
/* 8. */
if (ecma_is_value_undefined (trap))
{
return ecma_op_object_define_own_property (target_obj_p, prop_name_p, prop_desc_p);
ecma_value_t result = ecma_op_object_define_own_property (target_obj_p, prop_name_p, prop_desc_p);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

/* 9. */
Expand Down Expand Up @@ -1003,7 +1022,9 @@ ecma_proxy_object_has (ecma_object_t *obj_p, /**< proxy object */
/* 8. */
if (ecma_is_value_undefined (trap))
{
return ecma_op_object_has_property (target_obj_p, prop_name_p);
ecma_value_t result = ecma_op_object_has_property (target_obj_p, prop_name_p);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

ecma_object_t *func_obj_p = ecma_get_object_from_value (trap);
Expand Down Expand Up @@ -1105,7 +1126,10 @@ ecma_proxy_object_get (ecma_object_t *obj_p, /**< proxy object */
if (ecma_is_value_undefined (trap))
{
ecma_object_t *target_obj_p = ecma_get_object_from_value (proxy_obj_p->target);
return ecma_op_object_get_with_receiver (target_obj_p, prop_name_p, receiver);
ecma_value_t result = ecma_op_object_get_with_receiver (target_obj_p, prop_name_p, receiver);

JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

ecma_object_t *func_obj_p = ecma_get_object_from_value (trap);
Expand Down Expand Up @@ -1210,7 +1234,9 @@ ecma_proxy_object_set (ecma_object_t *obj_p, /**< proxy object */
/* 8. */
if (ecma_is_value_undefined (trap))
{
return ecma_op_object_put_with_receiver (target_obj_p, prop_name_p, value, receiver, is_strict);
ecma_value_t result = ecma_op_object_put_with_receiver (target_obj_p, prop_name_p, value, receiver, is_strict);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

ecma_object_t *func_obj_p = ecma_get_object_from_value (trap);
Expand Down Expand Up @@ -1303,6 +1329,7 @@ ecma_proxy_object_delete_property (ecma_object_t *obj_p, /**< proxy object */
bool is_strict) /**< delete in strict mode? */
{
JERRY_ASSERT (ECMA_OBJECT_IS_PROXY (obj_p));
ECMA_CHECK_STACK_USAGE ();

ecma_proxy_object_t *proxy_obj_p = (ecma_proxy_object_t *) obj_p;

Expand All @@ -1324,7 +1351,9 @@ ecma_proxy_object_delete_property (ecma_object_t *obj_p, /**< proxy object */
/* 8. */
if (ecma_is_value_undefined (trap))
{
return ecma_op_object_delete (target_obj_p, prop_name_p, is_strict);
ecma_value_t result = ecma_op_object_delete (target_obj_p, prop_name_p, is_strict);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

ecma_object_t *func_obj_p = ecma_get_object_from_value (trap);
Expand Down Expand Up @@ -1520,7 +1549,12 @@ ecma_collection_t *
ecma_proxy_object_own_property_keys (ecma_object_t *obj_p) /**< proxy object */
{
JERRY_ASSERT (ECMA_OBJECT_IS_PROXY (obj_p));

/* if (++JERRY_CONTEXT (proxy_depth) > ECMA_CONFIG_PROXY_RECURSION_DEPTH)
{
ecma_raise_range_error (ECMA_ERR_MSG ("Maximum call stack size exceeded."));
return NULL;
}
*/
ecma_proxy_object_t *proxy_obj_p = (ecma_proxy_object_t *) obj_p;

/* 1. */
Expand All @@ -1540,7 +1574,9 @@ ecma_proxy_object_own_property_keys (ecma_object_t *obj_p) /**< proxy object */
/* 6. */
if (ecma_is_value_undefined (trap))
{
return ecma_op_object_own_property_keys (target_obj_p);
ecma_collection_t *result = ecma_op_object_own_property_keys (target_obj_p);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

ecma_object_t *func_obj_p = ecma_get_object_from_value (trap);
Expand Down Expand Up @@ -1680,6 +1716,7 @@ ecma_proxy_object_call (ecma_object_t *obj_p, /**< proxy object */
uint32_t argc) /**< number of arguments */
{
JERRY_ASSERT (ECMA_OBJECT_IS_PROXY (obj_p));
ECMA_CHECK_STACK_USAGE ();

ecma_proxy_object_t *proxy_obj_p = (ecma_proxy_object_t *) obj_p;

Expand All @@ -1701,7 +1738,9 @@ ecma_proxy_object_call (ecma_object_t *obj_p, /**< proxy object */
if (ecma_is_value_undefined (trap))
{
ecma_object_t *target_obj_p = ecma_get_object_from_value (target);
return ecma_op_function_call (target_obj_p, this_argument, args_p, argc);
ecma_value_t result = ecma_op_function_call (target_obj_p, this_argument, args_p, argc);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

/* 8. */
Expand Down Expand Up @@ -1734,6 +1773,7 @@ ecma_proxy_object_construct (ecma_object_t *obj_p, /**< proxy object */
uint32_t argc) /**< number of arguments */
{
JERRY_ASSERT (ECMA_OBJECT_IS_PROXY (obj_p));
ECMA_CHECK_STACK_USAGE ();

ecma_proxy_object_t * proxy_obj_p = (ecma_proxy_object_t *) obj_p;

Expand All @@ -1757,7 +1797,9 @@ ecma_proxy_object_construct (ecma_object_t *obj_p, /**< proxy object */
{
JERRY_ASSERT (ecma_object_is_constructor (target_obj_p));

return ecma_op_function_construct (target_obj_p, new_target_p, args_p, argc);
ecma_value_t result = ecma_op_function_construct (target_obj_p, new_target_p, args_p, argc);
JERRY_BLOCK_TAIL_CALL_OPTIMIZATION ();
return result;
}

/* 8. */
Expand Down
32 changes: 32 additions & 0 deletions jerry-core/jrt/jrt.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -150,4 +150,36 @@ void JERRY_ATTR_NORETURN jerry_fatal (jerry_fatal_code_t code);
#define JERRY__LOG2_8(n) (((n) >= 1 << 8) ? (8 + JERRY__LOG2_4 ((n) >> 8)) : JERRY__LOG2_4 (n))
#define JERRY_LOG2(n) (((n) >= 1 << 16) ? (16 + JERRY__LOG2_8 ((n) >> 16)) : JERRY__LOG2_8 (n))

/**
* JERRY_BLOCK_TAIL_CALL_OPTIMIZATION
*
* Adapted from abseil ( https://github.com/abseil/ )
*
* Instructs the compiler to avoid optimizing tail-call recursion. This macro is
* useful when you wish to preserve the existing function order within a stack
* trace for logging, debugging, or profiling purposes.
*
* Example:
*
* int f() {
* int result = g();
* JERRY_BLOCK_TAIL_CALL_OPTIMIZATION();
* return result;
* }
*
* This macro is intentionally here as jerryscript-compiler.h is a public header and
* it does not make sense to expose this macro to the public.
*/
#if defined (__clang__) || defined (__GNUC__)
/* Clang/GCC will not tail call given inline volatile assembly. */
#define JERRY_BLOCK_TAIL_CALL_OPTIMIZATION() __asm__ __volatile__ ("")
#elif defined (_MSC_VER)
#include <intrin.h>
/* The __nop() intrinsic blocks the optimisation. */
#define JERRY_BLOCK_TAIL_CALL_OPTIMIZATION() __nop()
#else /* !defined(__clang__) && !defined(__GNUC__) && !defined(_MSC_VER) */
/* On GCC 10.x this version also works. */
#define JERRY_BLOCK_TAIL_CALL_OPTIMIZATION() do { volatile int _x = 0; (void) _x; } while (0)
#endif /* defined(__clang__) || defined (__GNUC__) */

#endif /* !JRT_H */
Loading

0 comments on commit 4c629f4

Please sign in to comment.