Summary: | StackVisitor::unwindToMachineCodeBlockFrame() may unwind past a VM entry frame when catching an exception and the frame has inlined tail calls | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Saam Barati <saam> | ||||||
Component: | JavaScriptCore | Assignee: | Saam Barati <saam> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | benjamin, commit-queue, fpizlo, ggaren, gskachkov, keith_miller, mark.lam, msaboff, oliver, sukolsak, webkit-bug-importer, ysuzuki | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | WebKit Nightly Build | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
Attachments: |
|
Description
Saam Barati
2016-07-05 18:36:28 PDT
Created attachment 282838 [details]
WIP
Pretty sure this fixes the bug. Need to write up a changelog.
Comment on attachment 282838 [details] WIP View in context: https://bugs.webkit.org/attachment.cgi?id=282838&action=review > Source/JavaScriptCore/tests/stress/dont-unwind-past-vm-entry-frame.js:35 > + for (i = 0; i < 10000; i++) { > + try { > + p(); > + } catch(e) { } > + } I presume the expectation here is that this test should not crash. Can you add a comment indicating that at the top of the file? Created attachment 282844 [details]
patch
Comment on attachment 282844 [details]
patch
r=me
Comment on attachment 282844 [details] patch Clearing flags on attachment: 282844 Committed r202847: <http://trac.webkit.org/changeset/202847> All reviewed patches have been landed. Closing bug. |