Bug 129134

Summary: virtualForWithFunction() should not throw an exception with a partially initialized frame
Product: WebKit Reporter: Mark Lam <mark.lam>
Component: JavaScriptCoreAssignee: Mark Lam <mark.lam>
Severity: Normal CC: commit-queue, fpizlo, ggaren, mhahnenberg, mmirman, msaboff, oliver
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Description Flags
The patch none

Description Mark Lam 2014-02-20 17:55:20 PST
Currently, when JITOperations.cpp’s virtualForWithFunction() fails to prepare the callee function for execution, it proceeds to throw the exception using the callee frame which is only partially initialized thus far.  Instead, we should be throwing the exception using the caller frame because:
1.  the error happened "in" the caller while preparing the callee for execution i.e. the caller frame is the top fully initialized frame on the stack.
2. the callee frame is not fully initialized yet, and the unwind mechanism cannot depend on the data in it.

This patch will provide the fix.  I’ll work on creating a regression test in another bug.  I’ve been encountering some difficulty composing a regression test for the issue.  So, I’m going to defer it till later.  In the meantime, we can manually test this fix by navigating to jsfiddle.net with a debug build.  It will crash with an assertion almost instantly.

ref: <rdar://problem/15843028>
Comment 1 Mark Lam 2014-02-20 17:59:34 PST
bug for writing the regression test: <https://webkit.org/b/129136>.
Comment 2 Mark Lam 2014-02-20 19:52:31 PST
Created attachment 224822 [details]
The patch
Comment 3 Michael Saboff 2014-02-20 21:30:46 PST
Comment on attachment 224822 [details]
The patch

Comment 4 WebKit Commit Bot 2014-02-20 22:02:18 PST
Comment on attachment 224822 [details]
The patch

Clearing flags on attachment: 224822

Committed r164472: <http://trac.webkit.org/changeset/164472>
Comment 5 WebKit Commit Bot 2014-02-20 22:02:21 PST
All reviewed patches have been landed.  Closing bug.