123209 2013-10-23 08:38:47 -0700 LLInt arity check exception processing should start unwinding from caller 2013-10-23 11:41:15 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 123182 1 msaboff msaboff oldest_to_newest 942695 0 msaboff 2013-10-23 08:38:47 -0700 When an exception is thrown due to stack exhaustion during the call out to slow_path_call_arityCheck(), the exception unwind should start with the caller. 942697 1 214966 msaboff 2013-10-23 08:49:21 -0700 Created attachment 214966 Patch 942726 2 214966 oliver 2013-10-23 10:19:11 -0700 Comment on attachment 214966 Patch Is it possible to make a test that hits this path? 942729 3 msaboff 2013-10-23 10:27:27 -0700 (In reply to comment #2) > (From update of attachment 214966 [details]) > Is it possible to make a test that hits this path? I found it because LayoutTests/js/script-tests/function-apply-aliased.js was hitting it in 32 bit while testing the other changes. The crash I was getting was in unwindCallFrame() wanting to tear off an activation based on the contents of the activation register which hadn't been initialized. A reliable test would need to scribble right at the end of the stack, back up and then cause a stack overflow exception during arity check. 942765 4 msaboff 2013-10-23 11:41:15 -0700 Committed r157875: <http://trac.webkit.org/changeset/157875> 214966 2013-10-23 08:49:21 -0700 2013-10-23 10:19:11 -0700 Patch 123209.patch text/plain 2059 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTU3ODU3KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDEzLTEwLTIzICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIExMSW50IGFyaXR5IGNoZWNrIGV4Y2VwdGlvbiBwcm9jZXNzaW5nIHNob3VsZCBzdGFydCB1 bndpbmRpbmcgZnJvbSBjYWxsZXIKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hv d19idWcuY2dpP2lkPTEyMzIwOQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp LgorCisgICAgICAgIFVzZSB0aGUgY2FsbGVyIGZyYW1lIHJldHVybmVkIGZyb20gc2xvd19wYXRo X2NhbGxfYXJpdHlDaGVjayB0byBwcm9jZXNzIGV4Y2VwdGlvbnMuCisKKyAgICAgICAgKiBsbGlu dC9Mb3dMZXZlbEludGVycHJldGVyMzJfNjQuYXNtOgorICAgICAgICAqIGxsaW50L0xvd0xldmVs SW50ZXJwcmV0ZXI2NC5hc206CisKIDIwMTMtMTAtMjIgIEFuZHJlYXMgS2xpbmcgIDxha2xpbmdA YXBwbGUuY29tPgogCiAgICAgICAgIE1pbm9yIFZNKiAtPiBWTSYgY2xlYW51cHMgaW4gSGFzaFRh YmxlIGFuZCBLZXl3b3Jkcy4KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dM ZXZlbEludGVycHJldGVyMzJfNjQuYXNtCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyMzJfNjQuYXNtCShyZXZpc2lvbiAxNTc4NTcp CisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvbGxpbnQvTG93TGV2ZWxJbnRlcnByZXRlcjMyXzY0 LmFzbQkod29ya2luZyBjb3B5KQpAQCAtMzA3LDYgKzMwNyw3IEBAIG1hY3JvIGZ1bmN0aW9uQXJp dHlDaGVjayhkb25lTGFiZWwsIHNsb3cKICAgICBiaWFlcSB0MCwgQ29kZUJsb2NrOjptX251bVBh cmFtZXRlcnNbdDFdLCBkb25lTGFiZWwKICAgICBjQ2FsbDIoc2xvd19wYXRoLCBjZnIsIFBDKSAg ICMgVGhpcyBzbG93X3BhdGggaGFzIGEgc2ltcGxlIHByb3RvY29sOiB0MCA9IDAgPT4gbm8gZXJy b3IsIHQwICE9IDAgPT4gZXJyb3IKICAgICBidGl6IHQwLCAuaXNBcml0eUZpeHVwTmVlZGVkCisg ICAgbW92ZSB0MSwgY2ZyICAgIyB0MSBjb250YWlucyBjYWxsZXIgZnJhbWUKICAgICBqbXAgX2xs aW50X3Rocm93X2Zyb21fc2xvd19wYXRoX3RyYW1wb2xpbmUKIAogLmlzQXJpdHlGaXh1cE5lZWRl ZDoKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVy NjQuYXNtCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZl bEludGVycHJldGVyNjQuYXNtCShyZXZpc2lvbiAxNTc4NTcpCisrKyBTb3VyY2UvSmF2YVNjcmlw dENvcmUvbGxpbnQvTG93TGV2ZWxJbnRlcnByZXRlcjY0LmFzbQkod29ya2luZyBjb3B5KQpAQCAt MjAzLDYgKzIwMyw3IEBAIG1hY3JvIGZ1bmN0aW9uQXJpdHlDaGVjayhkb25lTGFiZWwsIHNsb3cK ICAgICBwcmVwYXJlU3RhdGVGb3JDQ2FsbCgpCiAgICAgY0NhbGwyKHNsb3dfcGF0aCwgY2ZyLCBQ QykgICAjIFRoaXMgc2xvd19wYXRoIGhhcyBhIHNpbXBsZSBwcm90b2NvbDogdDAgPSAwID0+IG5v IGVycm9yLCB0MCAhPSAwID0+IGVycm9yCiAgICAgYnRpeiB0MCwgLmlzQXJpdHlGaXh1cE5lZWRl ZAorICAgIG1vdmUgdDEsIGNmciAgICMgdDEgY29udGFpbnMgY2FsbGVyIGZyYW1lCiAgICAgam1w IF9sbGludF90aHJvd19mcm9tX3Nsb3dfcGF0aF90cmFtcG9saW5lCiAKIC5pc0FyaXR5Rml4dXBO ZWVkZWQ6Cg==