Bug 158131 – ShadowChicken/DebuggerCallFrame don't properly handle when the entry stack frame is a tail deleted frame

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Saam Barati]

They both fail for various reasons

[Saam Barati]

Created attachment 279915 [details]
patch

[WebKit Commit Bot]

Attachment 279915 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/interpreter/ShadowChicken.cpp:298:  Multi line control clauses should use braces.  [whitespace/braces] [4]
Total errors found: 1 in 7 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Yusuke Suzuki]

Comment on attachment 279915 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=279915&action=review

r=me

> Source/JavaScriptCore/ChangeLog:17
> +        ```

Nice catch.

> Source/JavaScriptCore/ChangeLog:25
> +        current machine frame. This is wrong because if the entry frames

OK. Previously, if there are the logical / physical stack as follows,

logical: [F1][TD2][TD3][TD4][F2] =>
physical: [F1][F2] =>

First, we record [F2], and when visiting [F1], we push [TD4][TD3][TD2] (by retrieving them from the log) and push [F1].

But this assumes that TD frames are always between non TD frames.
In tail deleted entry case, that becomes as follows,

logical: [TD1][TD2][TD3][TD4][F1] =>
physical: [F1] =>

In that case, before this patch, we just record [F1] and finish.

> Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp:-81
> -        ASSERT(exec);

OK, so the exec of the entry tail deleted frame becomes `callFrame->lexicalGlobalObject()->globalExec()`.

[Saam Barati]

Thanks for the review. landed in:
http://trac.webkit.org/changeset/201465