Skip to content

Commit 889b576

Browse files
committed
Fix error handling in scanner when in case of OOM
This patch fixes jerryscript-project#3786 and fixes jerryscript-project#3788. JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik [email protected]
1 parent 589af6d commit 889b576

File tree

3 files changed

+108
-1
lines changed

3 files changed

+108
-1
lines changed

Diff for: jerry-core/parser/js/js-scanner.c

+9-1
Original file line numberDiff line numberDiff line change
@@ -3193,7 +3193,7 @@ scanner_scan_all (parser_context_t *context_p, /**< context */
31933193
}
31943194
PARSER_CATCH
31953195
{
3196-
JERRY_ASSERT (context_p->error == PARSER_ERR_NO_ERROR);
3196+
JERRY_ASSERT (context_p->error == PARSER_ERR_NO_ERROR || context_p->error == PARSER_ERR_OUT_OF_MEMORY);
31973197

31983198
while (scanner_context.active_literal_pool_p != NULL)
31993199
{
@@ -3214,6 +3214,14 @@ scanner_scan_all (parser_context_t *context_p, /**< context */
32143214
PARSER_TRY_END
32153215

32163216
context_p->status_flags = scanner_context.context_status_flags;
3217+
3218+
if (JERRY_UNLIKELY (context_p->error == PARSER_ERR_OUT_OF_MEMORY))
3219+
{
3220+
parser_stack_free (context_p);
3221+
scanner_cleanup (context_p);
3222+
return;
3223+
}
3224+
32173225
scanner_reverse_info_list (context_p);
32183226

32193227
#if ENABLED (JERRY_PARSER_DUMP_BYTE_CODE)

Diff for: tests/jerry/es2015/regression-test-issue-3786.js

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
// Copyright JS Foundation and other contributors, http://js.foundation
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
var oom_reached = false;
16+
17+
function main() {
18+
var v2 = new Float64Array(63797);
19+
var v4 = "d".constructor;
20+
var v6 = [1337,1337,1337,1337];
21+
var v7 = [];
22+
var v8 = {constructor:v6,a:v7};
23+
var v9 = v8.a;
24+
var v12 = 0;
25+
v9.toString = v4;
26+
var v14 = new Int16Array();
27+
do {
28+
function v16(v17,v18,v19) {
29+
'use strict'
30+
var v20 = Int16Array.toLocaleString();
31+
try {
32+
var v22 = eval(v20);
33+
assert(false)
34+
} catch (e) {
35+
if (e === null) {
36+
oom_reached = true;
37+
return
38+
}
39+
assert(e instanceof SyntaxError);
40+
}
41+
}
42+
var v24 = new Promise(v16);
43+
var v25 = v12 + 1;
44+
v12 = v25;
45+
v7[v25] = v14;
46+
} while (v12 < 1337);
47+
}
48+
main();
49+
50+
assert(oom_reached);

Diff for: tests/jerry/es2015/regression-test-issue-3788.js

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Copyright JS Foundation and other contributors, http://js.foundation
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
var oom_reached = false;
16+
17+
function main() {
18+
var v2 = [13.37,13.37];
19+
var v4 = [1337,1337,1337];
20+
var v5 = [parseFloat,parseFloat,v2];
21+
var v8 = new Float64Array(63797);
22+
var v10 = "d".constructor;
23+
var v12 = [1337,1337,1337,1337];
24+
var v13 = [];
25+
var v14 = {constructor:v12,a:v13};
26+
var v15 = v14.a;
27+
var v18 = 0;
28+
v15.toString = v10;
29+
var v20 = new Int16Array();
30+
do {
31+
var v25 = String.fromCharCode(1337,128);
32+
try {
33+
var v26 = eval(v25);
34+
assert(false);
35+
} catch(v27) {
36+
if (v27 === null) {
37+
oom_reached = true;
38+
return
39+
}
40+
assert(v27 instanceof SyntaxError);
41+
}
42+
var v28 = v18 + 1;
43+
v18 = v28;
44+
v13[v28] = v20;
45+
} while (v18 < 1337);
46+
}
47+
main();
48+
49+
assert(oom_reached);

0 commit comments

Comments
 (0)