[22] [JSC] Move FTL stack overflow check to prologue

Severity: Medium | Component: JSC FTL JIT | 1b42291

Rated Medium because the diff fixes a JIT prologue-state invariant: the stack-overflow late path popped callee-saves but never restored SP before jumping to ThrowStackOverflowAtPrologue, so the throw thunk ran with SP pointing inside a partially-constructed frame.

The stack overflow patchpoint ran inside the lowered function body — AFTER emitFunctionPrologue, frame allocation, and callee-save spilling — and tried to undo state before jumping to a thunk that expects "at prologue" stack shape.

Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

+ Ref<B3::Air::PrologueGenerator> mainPrologueGenerator = createSharedTask<B3::Air::PrologueGeneratorFunction>(
+     [=](CCallHelpers& jit, B3::Air::Code& code) {
+         jit.emitFunctionPrologue();
+         // Stack overflow check before frame allocation; SP == FP, no callee-saves saved.
+         ...
+         auto stackOverflow = jit.branchPtr(...);
+         stackOverflow.linkThunk(...ThrowStackOverflowAtPrologue...);
+         if (ftlFrameSize)
+             jit.subPtr(CCallHelpers::TrustedImm32(ftlFrameSize), CCallHelpers::stackPointerRegister);
+         jit.emitSave(code.calleeSaveRegisterAtOffsetList());
+     });
+ m_proc.code().setPrologueForEntrypoint(0, WTF::move(mainPrologueGenerator));

Stack-pointer state divergence at a JIT exception edge: an out-of-line thunk was reached from a point that had advanced past the prologue without symmetrically unwinding SP.

The original code carried a FIXME pointing at the very bug number this commit closes — the author knew the stack-check belonged in the Air prologue and that the late-path emitRestore was a workaround.

Reaching the code requires forcing a real stack overflow at FTL function entry, and the resulting misbehavior most plausibly manifests as exception-machinery corruption or a crash rather than a memory-write primitive — but the diff alone does not bound the consequences inside the throw thunk.

This vulnerability weakens an internal invariant the exception-throw path depends on. Moving the check to a custom Air PrologueGenerator eliminates the symmetry requirement entirely.

Audit directions

Late paths attached to patchpoints that jump to ...AtPrologue thunks. Audit every addLatePath in Source/JavaScriptCore/ftl/ and jit/ ending in jumpThunk(...AtPrologue...) and verify it restores both callee-saves and SP.
Shared thunks named ...AtPrologue. Audit CommonJITThunkID entries with the suffix and review every call site for matching stack shape.
Stack-overflow checks placed after frame allocation. Audit other JIT tiers (DFG, baseline, Wasm OMG/BBQ) for stack-limit comparisons emitted after subPtr of the frame size.
Defensive normalization in the thunk. Read ThunkGenerators.cpp for whether ThrowStackOverflowAtPrologue normalises SP from FP on entry.