159448 2016-07-05 18:36:28 -0700 StackVisitor::unwindToMachineCodeBlockFrame() may unwind past a VM entry frame when catching an exception and the frame has inlined tail calls 2016-07-05 22:25:46 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 saam saam benjamin commit-queue fpizlo ggaren gskachkov keith_miller mark.lam msaboff oliver sukolsak webkit-bug-importer ysuzuki oldest_to_newest 1208024 0 saam 2016-07-05 18:36:28 -0700 If we see that we have a sequence of tail calls that were inlined into a single machine frame, gotoNextFrame() will step over the machine callee and go to its caller (because it made a tail call, we treat the callee as logically not on the stack). This is a huge bug if we're unwinding from an exception where it's illegal to skip over VM entry frames. The machine caller of this tail called machine frame might be the VM entry frame. I think because unwindToMachineCodeBlockFrame() has sufficiently specific behavior, it should just do its own special unwinding. 1208025 1 saam 2016-07-05 18:37:37 -0700 <rdar://problem/27084459> 1208037 2 282838 saam 2016-07-05 19:16:26 -0700 Created attachment 282838 WIP Pretty sure this fixes the bug. Need to write up a changelog. 1208045 3 282838 mark.lam 2016-07-05 19:36:57 -0700 Comment on attachment 282838 WIP View in context: https://bugs.webkit.org/attachment.cgi?id=282838&action=review > Source/JavaScriptCore/tests/stress/dont-unwind-past-vm-entry-frame.js:35 > + for (i = 0; i < 10000; i++) { > + try { > + p(); > + } catch(e) { } > + } I presume the expectation here is that this test should not crash. Can you add a comment indicating that at the top of the file? 1208052 4 282844 saam 2016-07-05 19:45:52 -0700 Created attachment 282844 patch 1208055 5 282844 mark.lam 2016-07-05 19:48:57 -0700 Comment on attachment 282844 patch r=me 1208075 6 282844 commit-queue 2016-07-05 22:25:41 -0700 Comment on attachment 282844 patch Clearing flags on attachment: 282844 Committed r202847: <http://trac.webkit.org/changeset/202847> 1208076 7 commit-queue 2016-07-05 22:25:46 -0700 All reviewed patches have been landed. Closing bug. 282838 2016-07-05 19:16:26 -0700 2016-07-05 19:45:52 -0700 WIP a-backup.diff text/plain 1820 saam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9pbnRlcnByZXRlci9TdGFja1Zpc2l0b3IuY3Bw Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9pbnRlcnByZXRlci9TdGFja1Zp c2l0b3IuY3BwCShyZXZpc2lvbiAyMDI4MjUpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaW50 ZXJwcmV0ZXIvU3RhY2tWaXNpdG9yLmNwcAkod29ya2luZyBjb3B5KQpAQCAtODEsOCArODEsMTIg QEAgdm9pZCBTdGFja1Zpc2l0b3I6OmdvdG9OZXh0RnJhbWUoKQogdm9pZCBTdGFja1Zpc2l0b3I6 OnVud2luZFRvTWFjaGluZUNvZGVCbG9ja0ZyYW1lKCkKIHsKICNpZiBFTkFCTEUoREZHX0pJVCkK LSAgICB3aGlsZSAobV9mcmFtZS5pc0lubGluZWRGcmFtZSgpKQotICAgICAgICBnb3RvTmV4dEZy YW1lKCk7CisgICAgaWYgKG1fZnJhbWUuaXNJbmxpbmVkRnJhbWUoKSkgeworICAgICAgICBDb2Rl T3JpZ2luIGNvZGVPcmlnaW4gPSBtX2ZyYW1lLmlubGluZUNhbGxGcmFtZSgpLT5kaXJlY3RDYWxs ZXI7CisgICAgICAgIHdoaWxlIChjb2RlT3JpZ2luLmlubGluZUNhbGxGcmFtZSkKKyAgICAgICAg ICAgIGNvZGVPcmlnaW4gPSBjb2RlT3JpZ2luLmlubGluZUNhbGxGcmFtZS0+ZGlyZWN0Q2FsbGVy OworICAgICAgICByZWFkTm9uSW5saW5lZEZyYW1lKG1fZnJhbWUuY2FsbEZyYW1lKCksICZjb2Rl T3JpZ2luKTsKKyAgICB9CiAjZW5kaWYKIH0KIApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3Jl L3Rlc3RzL3N0cmVzcy9kb250LXVud2luZC1wYXN0LXZtLWVudHJ5LWZyYW1lLmpzCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9zdHJlc3MvZG9udC11bndpbmQtcGFz dC12bS1lbnRyeS1mcmFtZS5qcwkobm9uZXhpc3RlbnQpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENv cmUvdGVzdHMvc3RyZXNzL2RvbnQtdW53aW5kLXBhc3Qtdm0tZW50cnktZnJhbWUuanMJKHdvcmtp bmcgY29weSkKQEAgLTAsMCArMSwzNyBAQAorInVzZSBzdHJpY3QiOworCitsZXQgcCA9IG5ldyBQ cm94eShmdW5jdGlvbigpIHsgfSwgeworICAgIGFwcGx5OiBmdW5jdGlvbigpIHsKKyAgICAgICAg cmV0dXJuIGJhcigpOworICAgIH0KK30pOworCitmdW5jdGlvbiBiYXIoKSB7CisgICAgbGV0IGl0 ZW0gPSBnZXRJdGVtKCk7CisgICAgcmV0dXJuIGl0ZW0uZm9vOworfQorCitsZXQgaTsKK2xldCBz aG91bGRSZXR1cm5CYWQgPSBmYWxzZTsKK2xldCBnb29kID0gW2Z1bmN0aW9uKCkge3JldHVybiAx fSwge2I6IDIwfSwge2M6IDQwfSwge2Q6NTB9XQorbGV0IGJhZCA9IFt7YXNkZmhhc2Y6IDIwfSwg e2U6NTB9LCB7ajo3MH0sIHtrOjEwMH0sIG51bGxdOworZnVuY3Rpb24gZ2V0SXRlbSgpIHsKKyAg ICBpZiAoc2hvdWxkUmV0dXJuQmFkKQorICAgICAgICByZXR1cm4gYmFkW2kgJSBiYWQubGVuZ3Ro XTsKKyAgICByZXR1cm4gZ29vZFtpICUgZ29vZC5sZW5ndGhdOworfQorbm9JbmxpbmUoZ2V0SXRl bSk7CisKK2Z1bmN0aW9uIHN0YXJ0KCkgeworICAgIGZvciAoaSA9IDA7IGkgPCAxMDAwOyBpKysp IHsKKyAgICAgICAgcCgpOworICAgIH0KKworICAgIHNob3VsZFJldHVybkJhZCA9IHRydWU7Cisg ICAgZm9yIChpID0gMDsgaSA8IDEwMDAwOyBpKyspIHsKKyAgICAgICAgdHJ5IHsKKyAgICAgICAg ICAgIHAoKTsKKyAgICAgICAgfSBjYXRjaChlKSB7IH0KKyAgICB9Cit9CitzdGFydCgpOwo= 282844 2016-07-05 19:45:52 -0700 2016-07-05 22:25:41 -0700 patch a-backup.diff text/plain 4512 saam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjAyODQzKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDM3IEBA CisyMDE2LTA3LTA1ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAg IFN0YWNrVmlzaXRvcjo6dW53aW5kVG9NYWNoaW5lQ29kZUJsb2NrRnJhbWUoKSBtYXkgdW53aW5k IHBhc3QgYSBWTSBlbnRyeSBmcmFtZSB3aGVuIGNhdGNoaW5nIGFuIGV4Y2VwdGlvbiBhbmQgdGhl IGZyYW1lIGhhcyBpbmxpbmVkIHRhaWwgY2FsbHMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTE1OTQ0OAorICAgICAgICA8cmRhcjovL3Byb2JsZW0vMjcw ODQ0NTk+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg Q29uc2lkZXIgdGhlIGZvbGxvd2luZyBzdGFjayB0cmFjZToKKyAgICAgICAgKG1hY2hpbmUpIGZv byAtPiBWTSBlbnRyeSBmcmFtZSAtPiAobWFjaGluZSkgYmFyIC0+IChpbmxpbmVkIHRhaWxjYWxs KSBiYXoKKworICAgICAgICBJZiBhbiBleGNlcHRpb24gaXMgdGhyb3duIGF0ICdiYXonLCB3ZSB3 aWxsIGRvIGV4Y2VwdGlvbiB1bndpbmRpbmcsCisgICAgICAgIHdoaWNoIHdpbGwgZXZlbnR1YWxs eSBjYWxsIHVud2luZFRvTWFjaGluZUNvZGVCbG9ja0ZyYW1lKCkgd2hpY2ggd2lsbCBjYWxsCisg ICAgICAgIGdvdG9OZXh0RnJhbWUoKSBvbiB0aGUgJ2JheicgZnJhbWUuIFRoZSBuZXh0IGxvZ2lj YWwgZnJhbWUgZm9yICdiYXonIGlzICdmb28nIGJlY2F1c2UKKyAgICAgICAgJ2JhcicgdGFpbCBj YWxsZWQgJ2JheicgZXZlbiB0aG91Z2ggdGhlcmUgaXMgYSBtYWNoaW5lIGZyYW1lIGZvciAnYmFy JyBvbiB0aGUgc3RhY2suCisgICAgICAgIFRoaXMgaXMgYSBidWcuIHVud2luZFRvTWFjaGluZUNv ZGVCbG9ja0ZyYW1lKCkgc2hvdWxkIG5vdCBjYXJlIGFib3V0IHRoZSBuZXh0CisgICAgICAgIGxv Z2ljYWwgZnJhbWUsIGl0IGp1c3Qgd2FudHMgdG8gbW92ZSBTdGFja1Zpc2l0b3IncyBzdGF0ZSB0 byB0aGUgY3VycmVudCBtYWNoaW5lCisgICAgICAgIGZyYW1lLiBUaGUgYnVnIGhlcmUgaXMgdGhh dCB3ZSB3b3VsZCBlbmQgdXAgdW53aW5kaW5nIHBhc3QgdGhlIFZNIGVudHJ5IGZyYW1lCisgICAg ICAgIHdoaWNoIGNhbiBoYXZlIGFsbCBraW5kcyBvZiB0ZXJyaWJsZSBjb25zZXF1ZW5jZXMuCisK KyAgICAgICAgVGhpcyBidWcgZml4ZXMgdW53aW5kVG9NYWNoaW5lQ29kZUJsb2NrRnJhbWUoKSBi eSBoYXZpbmcgaXQgbm90IHJlbHkKKyAgICAgICAgb24gZ290b05leHRGcmFtZSgpIGFuZCBpbnN0 ZWFkIHVzaW5nIGl0cyBvd24gbWVjaGFuaXNtIGZvciBzZXR0aW5nCisgICAgICAgIHRoZSBTdGFj a1Zpc290b3IncyBzdGF0ZSB0byB0aGUgY3VycmVudCBtYWNoaW5lIGZyYW1lLgorCisgICAgICAg ICogaW50ZXJwcmV0ZXIvU3RhY2tWaXNpdG9yLmNwcDoKKyAgICAgICAgKEpTQzo6U3RhY2tWaXNp dG9yOjp1bndpbmRUb01hY2hpbmVDb2RlQmxvY2tGcmFtZSk6CisgICAgICAgICogdGVzdHMvc3Ry ZXNzL2RvbnQtdW53aW5kLXBhc3Qtdm0tZW50cnktZnJhbWUuanM6IEFkZGVkLgorICAgICAgICAo bGV0LnAubmV3LlByb3h5KToKKyAgICAgICAgKGxldC5wLm5ldy5Qcm94eS5hcHBseSk6CisgICAg ICAgIChiYXIpOgorICAgICAgICAobGV0Lmdvb2QpOgorICAgICAgICAoZ2V0SXRlbSk6CisgICAg ICAgIChzdGFydCk6CisKIDIwMTYtMDctMDUgIEdlb2ZmcmV5IEdhcmVuICA8Z2dhcmVuQGFwcGxl LmNvbT4KIAogICAgICAgICBDcmFzaCBAIGJhbmtvZmFtZXJpY2EuY29tLCBVbml2ZXJzaXR5IG9m IFZpZW5uYQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVyL1N0YWNrVmlz aXRvci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVy L1N0YWNrVmlzaXRvci5jcHAJKHJldmlzaW9uIDIwMjgyNSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0 Q29yZS9pbnRlcnByZXRlci9TdGFja1Zpc2l0b3IuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC04MSw4 ICs4MSwxMiBAQCB2b2lkIFN0YWNrVmlzaXRvcjo6Z290b05leHRGcmFtZSgpCiB2b2lkIFN0YWNr VmlzaXRvcjo6dW53aW5kVG9NYWNoaW5lQ29kZUJsb2NrRnJhbWUoKQogewogI2lmIEVOQUJMRShE RkdfSklUKQotICAgIHdoaWxlIChtX2ZyYW1lLmlzSW5saW5lZEZyYW1lKCkpCi0gICAgICAgIGdv dG9OZXh0RnJhbWUoKTsKKyAgICBpZiAobV9mcmFtZS5pc0lubGluZWRGcmFtZSgpKSB7CisgICAg ICAgIENvZGVPcmlnaW4gY29kZU9yaWdpbiA9IG1fZnJhbWUuaW5saW5lQ2FsbEZyYW1lKCktPmRp cmVjdENhbGxlcjsKKyAgICAgICAgd2hpbGUgKGNvZGVPcmlnaW4uaW5saW5lQ2FsbEZyYW1lKQor ICAgICAgICAgICAgY29kZU9yaWdpbiA9IGNvZGVPcmlnaW4uaW5saW5lQ2FsbEZyYW1lLT5kaXJl Y3RDYWxsZXI7CisgICAgICAgIHJlYWROb25JbmxpbmVkRnJhbWUobV9mcmFtZS5jYWxsRnJhbWUo KSwgJmNvZGVPcmlnaW4pOworICAgIH0KICNlbmRpZgogfQogCkluZGV4OiBTb3VyY2UvSmF2YVNj cmlwdENvcmUvaml0L0pJVEV4Y2VwdGlvbnMuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZh U2NyaXB0Q29yZS9qaXQvSklURXhjZXB0aW9ucy5jcHAJKHJldmlzaW9uIDIwMjgyNSkKKysrIFNv dXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklURXhjZXB0aW9ucy5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTgxLDYgKzgxLDggQEAgdm9pZCBnZW5lcmljVW53aW5kKFZNKiB2bSwgRXhlY1N0YXRlKiBj YQogICAgIH0gZWxzZQogICAgICAgICBjYXRjaFJvdXRpbmUgPSBMTEludDo6Z2V0Q29kZVB0ciho YW5kbGVVbmNhdWdodEV4Y2VwdGlvbik7CiAgICAgCisgICAgQVNTRVJUKGJpdHdpc2VfY2FzdDx1 aW50cHRyX3Q+KGNhbGxGcmFtZSkgPCBiaXR3aXNlX2Nhc3Q8dWludHB0cl90Pih2bS0+dG9wVk1F bnRyeUZyYW1lKSk7CisKICAgICB2bS0+Y2FsbEZyYW1lRm9yQ2F0Y2ggPSBjYWxsRnJhbWU7CiAg ICAgdm0tPnRhcmdldE1hY2hpbmVQQ0ZvclRocm93ID0gY2F0Y2hSb3V0aW5lOwogICAgIHZtLT50 YXJnZXRJbnRlcnByZXRlclBDRm9yVGhyb3cgPSBjYXRjaFBDRm9ySW50ZXJwcmV0ZXI7CkluZGV4 OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvdGVzdHMvc3RyZXNzL2RvbnQtdW53aW5kLXBhc3Qtdm0t ZW50cnktZnJhbWUuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3Rlc3Rz L3N0cmVzcy9kb250LXVud2luZC1wYXN0LXZtLWVudHJ5LWZyYW1lLmpzCShub25leGlzdGVudCkK KysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS90ZXN0cy9zdHJlc3MvZG9udC11bndpbmQtcGFzdC12 bS1lbnRyeS1mcmFtZS5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDM5IEBACisidXNlIHN0 cmljdCI7CisKKy8vIFRoaXMgdGVzdCBwYXNzZXMgd2hlbiBKU0MgZG9lc24ndCBjcmFzaC4KKwor bGV0IHAgPSBuZXcgUHJveHkoZnVuY3Rpb24oKSB7IH0sIHsKKyAgICBhcHBseTogZnVuY3Rpb24o KSB7CisgICAgICAgIHJldHVybiBiYXIoKTsKKyAgICB9Cit9KTsKKworZnVuY3Rpb24gYmFyKCkg eworICAgIGxldCBpdGVtID0gZ2V0SXRlbSgpOworICAgIHJldHVybiBpdGVtLmZvbzsKK30KKwor bGV0IGk7CitsZXQgc2hvdWxkUmV0dXJuQmFkID0gZmFsc2U7CitsZXQgZ29vZCA9IFtmdW5jdGlv bigpIHtyZXR1cm4gMX0sIHtiOiAyMH0sIHtjOiA0MH0sIHtkOjUwfV0KK2xldCBiYWQgPSBbe2Fz ZGZoYXNmOiAyMH0sIHtlOjUwfSwge2o6NzB9LCB7azoxMDB9LCBudWxsXTsKK2Z1bmN0aW9uIGdl dEl0ZW0oKSB7CisgICAgaWYgKHNob3VsZFJldHVybkJhZCkKKyAgICAgICAgcmV0dXJuIGJhZFtp ICUgYmFkLmxlbmd0aF07CisgICAgcmV0dXJuIGdvb2RbaSAlIGdvb2QubGVuZ3RoXTsKK30KK25v SW5saW5lKGdldEl0ZW0pOworCitmdW5jdGlvbiBzdGFydCgpIHsKKyAgICBmb3IgKGkgPSAwOyBp IDwgMTAwMDsgaSsrKSB7CisgICAgICAgIHAoKTsKKyAgICB9CisKKyAgICBzaG91bGRSZXR1cm5C YWQgPSB0cnVlOworICAgIGZvciAoaSA9IDA7IGkgPCAxMDAwMDsgaSsrKSB7CisgICAgICAgIHRy eSB7CisgICAgICAgICAgICBwKCk7CisgICAgICAgIH0gY2F0Y2goZSkgeyB9CisgICAgfQorfQor c3RhcnQoKTsK