YourWishes/jerryscript
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix rare crash caused by get method of proxy object (#5129)

Browse Source 
This fixes #5101
In rare cases the proxy object could get used after
being incorrectly removed by the gc

Add stack checks to the start of all function calls

JerryScript-DCO-1.0-Signed-off-by: Máté Tokodi mate.tokodi@szteszoftver.hu
This commit is contained in:
Máté Tokodi
2024-03-13 12:08:41 +01:00
committed by GitHub
parent bac7ee3acd
commit cefd391772
4 changed files with 44 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
jerry-core/ecma/operations/ecma-function-object.c
+8
View File
@@ -1010,6 +1010,8 @@ ecma_op_function_call_constructor (vm_frame_ctx_shared_args_t *shared_args_p, /*
ecma_object_t *scope_p, /**< lexical environment to use */
ecma_value_t this_binding) /**< value of 'ThisBinding' */
{
ECMA_CHECK_STACK_USAGE ();
shared_args_p->header.status_flags |= VM_FRAME_CTX_SHARED_NON_ARROW_FUNC;
ecma_value_t ret_value;
@@ -1080,6 +1082,8 @@ ecma_op_function_call_simple (ecma_object_t *func_obj_p, /**< Function object */
{
JERRY_ASSERT (ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_FUNCTION);
ECMA_CHECK_STACK_USAGE ();
vm_frame_ctx_shared_args_t shared_args;
shared_args.header.status_flags = VM_FRAME_CTX_SHARED_HAS_ARG_LIST;
shared_args.header.function_object_p = func_obj_p;
@@ -1205,6 +1209,8 @@ ecma_op_function_call_native_built_in (ecma_object_t *func_obj_p, /**< Function
{
JERRY_ASSERT (ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_BUILT_IN_FUNCTION);
ECMA_CHECK_STACK_USAGE ();
#if JERRY_BUILTIN_REALMS
ecma_global_object_t *saved_global_object_p = JERRY_CONTEXT (global_object_p);
@@ -1235,6 +1241,8 @@ ecma_op_function_call_native (ecma_object_t *func_obj_p, /**< Function object */
{
JERRY_ASSERT (ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_NATIVE_FUNCTION);
ECMA_CHECK_STACK_USAGE ();
ecma_native_function_t *native_function_p = (ecma_native_function_t *) func_obj_p;
#if JERRY_BUILTIN_REALMS
jerry-core/ecma/operations/ecma-proxy-object.c
+2
View File
@@ -1170,7 +1170,9 @@ ecma_proxy_object_get (ecma_object_t *obj_p, /**< proxy object */
ecma_value_t args[] = { proxy_obj_p->target, prop_value, receiver };
/* 9. */
ecma_ref_object (obj_p);
ecma_value_t trap_result = ecma_op_function_call (func_obj_p, handler, args, 3);
ecma_deref_object (obj_p);
ecma_deref_object (func_obj_p);