Skip to content

Commit e902b87

Browse files
rerobikarerobika
authored
Limit the call stack size for native/builtin functions as well (#2935)
VM_RECURSION_LIMIT only prevented the recursion of interpreted codeblocks but native/builtin function calls can also create stack overflow due to the too deep recursion. This patch fixes #2905. Co-authored-by: Gabor Loki loki@inf.u-szeged.hu JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
1 parent 8766bb3 commit e902b87

10 files changed

Lines changed: 100 additions & 54 deletions

File tree

‎jerry-core/CMakeLists.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ set(FEATURE_VALGRIND OFF CACHE BOOL "Enable Valgrind suppor
4040
set(FEATURE_VM_EXEC_STOP OFF CACHE BOOL "Enable VM execution stopping?")
4141
set(JERRY_GLOBAL_HEAP_SIZE "512" CACHE STRING "Size of memory heap, in kilobytes")
4242
set(JERRY_REGEXP_RECURSION_LIMIT "0" CACHE STRING "Limit of regexp recursion depth")
43-
set(JERRY_VM_RECURSION_LIMIT "0" CACHE STRING "Limit of VM recursion depth")
43+
set(JERRY_CALL_STACK_LIMIT "0" CACHE STRING "Limit of function call recursion depth")
4444

4545
# Option overrides
4646
if(USING_MSVC)
@@ -103,7 +103,7 @@ message(STATUS "FEATURE_VALGRIND " ${FEATURE_VALGRIND})
103103
message(STATUS "FEATURE_VM_EXEC_STOP " ${FEATURE_VM_EXEC_STOP})
104104
message(STATUS "JERRY_GLOBAL_HEAP_SIZE " ${JERRY_GLOBAL_HEAP_SIZE})
105105
message(STATUS "JERRY_REGEXP_RECURSION_LIMIT " ${JERRY_REGEXP_RECURSION_LIMIT})
106-
message(STATUS "JERRY_VM_RECURSION_LIMIT " ${JERRY_VM_RECURSION_LIMIT})
106+
message(STATUS "JERRY_CALL_STACK_LIMIT " ${JERRY_CALL_STACK_LIMIT})
107107

108108
# Include directories
109109
set(INCLUDE_CORE_PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/include")
@@ -293,9 +293,9 @@ if(JERRY_REGEXP_RECURSION_LIMIT)
293293
set(DEFINES_JERRY ${DEFINES_JERRY} JERRY_REGEXP_RECURSION_LIMIT=${JERRY_REGEXP_RECURSION_LIMIT})
294294
endif()
295295

296-
# VM recursion depth limit
297-
if(JERRY_VM_RECURSION_LIMIT)
298-
set(DEFINES_JERRY ${DEFINES_JERRY} JERRY_VM_RECURSION_LIMIT=${JERRY_VM_RECURSION_LIMIT})
296+
# Function call recursion depth limit
297+
if(JERRY_CALL_STACK_LIMIT)
298+
set(DEFINES_JERRY ${DEFINES_JERRY} JERRY_CALL_STACK_LIMIT=${JERRY_CALL_STACK_LIMIT})
299299
endif()
300300

301301
# RegExp byte-code dumps

‎jerry-core/config.h‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -436,7 +436,7 @@
436436
#endif /* !defined (JERRY_VM_EXEC_STOP) */
437437

438438
/**
439-
* Set the VM execution recursion limit.
439+
* Set the function call recursion limit.
440440
*
441441
* Allowed values:
442442
* 0: Disable recursion limit check.
@@ -447,9 +447,9 @@
447447
*
448448
* Default value: 0
449449
*/
450-
#ifndef JERRY_VM_RECURSION_LIMIT
451-
# define JERRY_VM_RECURSION_LIMIT 0
452-
#endif /* !defined (JERRY_VM_RECURSION_LIMIT) */
450+
#ifndef JERRY_CALL_STACK_LIMIT
451+
# define JERRY_CALL_STACK_LIMIT 0
452+
#endif /* !defined (JERRY_CALL_STACK_LIMIT) */
453453

454454

455455
/**

‎jerry-core/ecma/base/ecma-init-finalize.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,9 @@ ecma_init (void)
4444
JERRY_CONTEXT (status_flags) &= (uint32_t) ~ECMA_STATUS_HIGH_SEV_GC;
4545
#endif /* ENABLED (JERRY_PROPRETY_HASHMAP) */
4646

47-
#if defined (JERRY_VM_RECURSION_LIMIT) && (JERRY_VM_RECURSION_LIMIT != 0)
48-
JERRY_CONTEXT (vm_recursion_counter) = JERRY_VM_RECURSION_LIMIT;
49-
#endif /* defined (JERRY_VM_RECURSION_LIMIT) && (JERRY_VM_RECURSION_LIMIT != 0) */
47+
#if defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0)
48+
JERRY_CONTEXT (function_call_counter) = JERRY_CALL_STACK_LIMIT;
49+
#endif /* defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0) */
5050

5151
#if ENABLED (JERRY_ES2015_BUILTIN_PROMISE)
5252
ecma_job_queue_init ();

‎jerry-core/ecma/operations/ecma-function-object.c‎

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -705,6 +705,17 @@ ecma_op_function_call (ecma_object_t *func_obj_p, /**< Function object */
705705
|| ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_BOUND_FUNCTION
706706
|| !ecma_op_function_has_construct_flag (arguments_list_p));
707707

708+
#if defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0)
709+
if (JERRY_UNLIKELY (JERRY_CONTEXT (function_call_counter) == 0))
710+
{
711+
return ecma_raise_range_error (ECMA_ERR_MSG ("Maximum call stack size is exceeded."));
712+
}
713+
else
714+
{
715+
JERRY_CONTEXT (function_call_counter)--;
716+
}
717+
#endif /* defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0) */
718+
708719
switch (ecma_get_object_type (func_obj_p))
709720
{
710721
case ECMA_OBJECT_TYPE_FUNCTION:
@@ -713,10 +724,16 @@ ecma_op_function_call (ecma_object_t *func_obj_p, /**< Function object */
713724
{
714725
JERRY_ASSERT (!ecma_op_function_has_construct_flag (arguments_list_p));
715726

716-
return ecma_builtin_dispatch_call (func_obj_p,
717-
this_arg_value,
718-
arguments_list_p,
719-
arguments_list_len);
727+
ecma_value_t ret_value = ecma_builtin_dispatch_call (func_obj_p,
728+
this_arg_value,
729+
arguments_list_p,
730+
arguments_list_len);
731+
732+
#if defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0)
733+
JERRY_CONTEXT (function_call_counter)++;
734+
#endif /* defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0) */
735+
736+
return ret_value;
720737
}
721738

722739
/* Entering Function Code (ECMA-262 v5, 10.4.3) */
@@ -806,6 +823,10 @@ ecma_op_function_call (ecma_object_t *func_obj_p, /**< Function object */
806823
ecma_free_value (this_binding);
807824
}
808825

826+
#if defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0)
827+
JERRY_CONTEXT (function_call_counter)++;
828+
#endif /* defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0) */
829+
809830
return ret_value;
810831
}
811832
case ECMA_OBJECT_TYPE_EXTERNAL_FUNCTION:
@@ -816,6 +837,9 @@ ecma_op_function_call (ecma_object_t *func_obj_p, /**< Function object */
816837
this_arg_value,
817838
arguments_list_p,
818839
arguments_list_len);
840+
#if defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0)
841+
JERRY_CONTEXT (function_call_counter)++;
842+
#endif /* defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0) */
819843

820844
if (JERRY_UNLIKELY (ecma_is_value_error_reference (ret_value)))
821845
{
@@ -864,6 +888,10 @@ ecma_op_function_call (ecma_object_t *func_obj_p, /**< Function object */
864888
ecma_deref_object (local_env_p);
865889
}
866890

891+
#if defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0)
892+
JERRY_CONTEXT (function_call_counter)++;
893+
#endif /* defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0) */
894+
867895
return ret_value;
868896
}
869897
#endif /* ENABLED (JERRY_ES2015_ARROW_FUNCTION) */
@@ -874,6 +902,10 @@ ecma_op_function_call (ecma_object_t *func_obj_p, /**< Function object */
874902
}
875903
}
876904

905+
#if defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0)
906+
JERRY_CONTEXT (function_call_counter)++;
907+
#endif /* defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0) */
908+
877909
JERRY_CONTEXT (status_flags) &= (uint32_t) ~ECMA_STATUS_DIRECT_EVAL;
878910

879911
ecma_extended_object_t *ext_function_p;

‎jerry-core/jcontext/jcontext.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -170,9 +170,9 @@ struct jerry_context_t
170170
* ECMAScript execution should be stopped */
171171
#endif /* ENABLED (JERRY_VM_EXEC_STOP) */
172172

173-
#if defined (JERRY_VM_RECURSION_LIMIT) && (JERRY_VM_RECURSION_LIMIT != 0)
174-
uint32_t vm_recursion_counter; /**< VM recursion counter */
175-
#endif /* defined (JERRY_VM_RECURSION_LIMIT) && (JERRY_VM_RECURSION_LIMIT != 0) */
173+
#if defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0)
174+
uint32_t function_call_counter; /**< Function call recursion counter */
175+
#endif /* defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0) */
176176

177177
#if ENABLED (JERRY_DEBUGGER)
178178
uint8_t debugger_send_buffer[JERRY_DEBUGGER_TRANSPORT_MAX_BUFFER_SIZE]; /**< buffer for sending messages */

‎jerry-core/vm/vm.c‎

Lines changed: 3 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,9 @@
4646
/*
4747
* Check VM recursion depth limit
4848
*/
49-
#if defined (JERRY_VM_RECURSION_LIMIT) && (JERRY_VM_RECURSION_LIMIT != 0)
50-
JERRY_STATIC_ASSERT (JERRY_VM_RECURSION_LIMIT > 0, vm_recursion_limit_must_be_greater_than_zero);
51-
#endif /* defined (JERRY_VM_RECURSION_LIMIT) && (JERRY_VM_RECURSION_LIMIT != 0) */
49+
#if defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0)
50+
JERRY_STATIC_ASSERT (JERRY_CALL_STACK_LIMIT > 0, function_call_recursion_limit_must_be_greater_than_zero);
51+
#endif /* defined (JERRY_CALL_STACK_LIMIT) && (JERRY_CALL_STACK_LIMIT != 0) */
5252

5353
/**
5454
* Get the value of object[property].
@@ -3605,10 +3605,6 @@ vm_execute (vm_frame_ctx_t *frame_ctx_p, /**< frame context */
36053605
}
36063606
#endif /* ENABLED (JERRY_DEBUGGER) */
36073607

3608-
#if defined (JERRY_VM_RECURSION_LIMIT) && (JERRY_VM_RECURSION_LIMIT != 0)
3609-
JERRY_CONTEXT (vm_recursion_counter)++;
3610-
#endif /* defined (JERRY_VM_RECURSION_LIMIT) && (JERRY_VM_RECURSION_LIMIT != 0) */
3611-
36123608
JERRY_CONTEXT (vm_top_context_p) = prev_context_p;
36133609
return completion_value;
36143610
}
@@ -3629,17 +3625,6 @@ vm_run (const ecma_compiled_code_t *bytecode_header_p, /**< byte-code data heade
36293625
const ecma_value_t *arg_list_p, /**< arguments list */
36303626
ecma_length_t arg_list_len) /**< length of arguments list */
36313627
{
3632-
#if defined (JERRY_VM_RECURSION_LIMIT) && (JERRY_VM_RECURSION_LIMIT != 0)
3633-
if (JERRY_UNLIKELY (JERRY_CONTEXT (vm_recursion_counter) == 0))
3634-
{
3635-
return ecma_raise_range_error (ECMA_ERR_MSG ("VM recursion limit is exceeded."));
3636-
}
3637-
else
3638-
{
3639-
JERRY_CONTEXT (vm_recursion_counter)--;
3640-
}
3641-
#endif /* defined (JERRY_VM_RECURSION_LIMIT) && (JERRY_VM_RECURSION_LIMIT != 0) */
3642-
36433628
ecma_value_t *literal_p;
36443629
vm_frame_ctx_t frame_ctx;
36453630
uint32_t call_stack_size;

‎tests/jerry/regression-test-issue-2905.js‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/* Copyright JS Foundation and other contributors, http://js.foundation
2+
*
3+
* Licensed under the Apache License, Version 2.0 (the "License");
4+
* you may not use this file except in compliance with the License.
5+
* You may obtain a copy of the License at
6+
*
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
*
9+
* Unless required by applicable law or agreed to in writing, software
10+
* distributed under the License is distributed on an "AS IS" BASIS
11+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
* See the License for the specific language governing permissions and
13+
* limitations under the License.
14+
*/
15+
16+
var func = function () {
17+
foo.prototype = new Array(1, 2, 3);
18+
function foo() {}
19+
var f = new foo();
20+
f.length = f;
21+
try {
22+
var a = "Using f will give an error: " + f;
23+
assert(false);
24+
} catch (e) {
25+
assert(e instanceof RangeError);
26+
}
27+
};
28+
29+
func();

‎tests/jerry/vm-recursion-limit.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
// limitations under the License.
1414

1515
/* Note: if the tests suite vm-recursion-limit changes, this variable must be changed as well */
16-
var limit = 1000;
16+
var limit = 100;
1717
var counter = 0;
1818

1919
function f () {
@@ -26,5 +26,5 @@ try {
2626
assert (false);
2727
} catch (e) {
2828
assert (e instanceof RangeError);
29-
assert (counter === (limit - 1));
29+
assert (counter === limit);
3030
}

‎tools/build.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -130,8 +130,8 @@ def devhelp(helpstring):
130130
help=devhelp('enable regexp strict mode (%(choices)s)'))
131131
coregrp.add_argument('--regexp-recursion-limit', metavar='N', type=int,
132132
help='regexp recursion depth limit')
133-
coregrp.add_argument('--vm-recursion-limit', metavar='N', type=int,
134-
help='VM recursion depth limit')
133+
coregrp.add_argument('--call-stack-limit', metavar='N', type=int,
134+
help='Function call recursion depth limit')
135135
coregrp.add_argument('--show-opcodes', metavar='X', choices=['ON', 'OFF'], type=str.upper,
136136
help=devhelp('enable parser byte-code dumps (%(choices)s)'))
137137
coregrp.add_argument('--show-regexp-opcodes', metavar='X', choices=['ON', 'OFF'], type=str.upper,
@@ -156,9 +156,9 @@ def devhelp(helpstring):
156156
parser.print_help()
157157
sys.exit(0)
158158

159-
if arguments.vm_recursion_limit:
160-
if arguments.vm_recursion_limit < 0:
161-
print ('Configuration error: VM recursion limit must be greater or equal than 0')
159+
if arguments.call_stack_limit:
160+
if arguments.call_stack_limit < 0:
161+
print ('Configuration error: Function call recursion limit must be greater or equal than 0')
162162
sys.exit(1)
163163

164164
return arguments
@@ -207,7 +207,7 @@ def build_options_append(cmakeopt, cliarg):
207207
build_options_append('FEATURE_PROFILE', arguments.profile)
208208
build_options_append('FEATURE_REGEXP_STRICT_MODE', arguments.regexp_strict_mode)
209209
build_options_append('JERRY_REGEXP_RECURSION_LIMIT', arguments.regexp_recursion_limit)
210-
build_options_append('JERRY_VM_RECURSION_LIMIT', arguments.vm_recursion_limit)
210+
build_options_append('JERRY_CALL_STACK_LIMIT', arguments.call_stack_limit)
211211
build_options_append('FEATURE_PARSER_DUMP', arguments.show_opcodes)
212212
build_options_append('FEATURE_REGEXP_DUMP', arguments.show_regexp_opcodes)
213213
build_options_append('FEATURE_SNAPSHOT_EXEC', arguments.snapshot_exec)

‎tools/run-tests.py‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ def skip_if(condition, desc):
3636
OPTIONS_PROFILE_MIN = ['--profile=minimal']
3737
OPTIONS_PROFILE_ES51 = [] # NOTE: same as ['--profile=es5.1']
3838
OPTIONS_PROFILE_ES2015 = ['--profile=es2015-subset']
39-
OPTIONS_VM_RECURSION_LIMIT = ['--vm-recursion-limit=1000']
39+
OPTIONS_CALL_STACK_LIMIT = ['--call-stack-limit=100']
4040
OPTIONS_DEBUG = ['--debug']
4141
OPTIONS_SNAPSHOT = ['--snapshot-save=on', '--snapshot-exec=on', '--jerry-cmdline-snapshot=on']
4242
OPTIONS_UNITTESTS = ['--unittests=on', '--jerry-cmdline=off', '--error-messages=on',
@@ -68,22 +68,22 @@ def skip_if(condition, desc):
6868
# Test options for jerry-tests
6969
JERRY_TESTS_OPTIONS = [
7070
Options('jerry_tests-es5.1',
71-
OPTIONS_PROFILE_ES51 + OPTIONS_VM_RECURSION_LIMIT),
71+
OPTIONS_PROFILE_ES51 + OPTIONS_CALL_STACK_LIMIT),
7272
Options('jerry_tests-es5.1-snapshot',
73-
OPTIONS_PROFILE_ES51 + OPTIONS_SNAPSHOT + OPTIONS_VM_RECURSION_LIMIT,
73+
OPTIONS_PROFILE_ES51 + OPTIONS_SNAPSHOT + OPTIONS_CALL_STACK_LIMIT,
7474
['--snapshot']),
7575
Options('jerry_tests-es5.1-debug',
76-
OPTIONS_PROFILE_ES51 + OPTIONS_DEBUG + OPTIONS_VM_RECURSION_LIMIT),
76+
OPTIONS_PROFILE_ES51 + OPTIONS_DEBUG + OPTIONS_CALL_STACK_LIMIT),
7777
Options('jerry_tests-es5.1-debug-snapshot',
78-
OPTIONS_PROFILE_ES51 + OPTIONS_SNAPSHOT + OPTIONS_DEBUG + OPTIONS_VM_RECURSION_LIMIT,
78+
OPTIONS_PROFILE_ES51 + OPTIONS_SNAPSHOT + OPTIONS_DEBUG + OPTIONS_CALL_STACK_LIMIT,
7979
['--snapshot']),
8080
Options('jerry_tests-es5.1-debug-cpointer_32bit',
81-
OPTIONS_PROFILE_ES51 + OPTIONS_DEBUG + OPTIONS_VM_RECURSION_LIMIT
81+
OPTIONS_PROFILE_ES51 + OPTIONS_DEBUG + OPTIONS_CALL_STACK_LIMIT
8282
+ ['--cpointer-32bit=on', '--mem-heap=1024']),
8383
Options('jerry_tests-es5.1-debug-external_context',
84-
OPTIONS_PROFILE_ES51 + OPTIONS_DEBUG + OPTIONS_VM_RECURSION_LIMIT + ['--external-context=on']),
84+
OPTIONS_PROFILE_ES51 + OPTIONS_DEBUG + OPTIONS_CALL_STACK_LIMIT + ['--external-context=on']),
8585
Options('jerry_tests-es2015_subset-debug',
86-
OPTIONS_PROFILE_ES2015 + OPTIONS_DEBUG + OPTIONS_VM_RECURSION_LIMIT),
86+
OPTIONS_PROFILE_ES2015 + OPTIONS_DEBUG + OPTIONS_CALL_STACK_LIMIT),
8787
]
8888

8989
# Test options for jerry-test-suite
@@ -160,7 +160,7 @@ def skip_if(condition, desc):
160160
Options('buildoption_test-regexp_recursion_limit',
161161
['--regexp-recursion-limit=1000']),
162162
Options('buildoption_test-vm_recursion_limit',
163-
OPTIONS_VM_RECURSION_LIMIT),
163+
OPTIONS_CALL_STACK_LIMIT),
164164
Options('buildoption_test-single-source',
165165
['--cmake-param=-DENABLE_ALL_IN_ONE_SOURCE=ON']),
166166
]

0 commit comments

Comments
 (0)