|Summary:||StackVisitor::unwindToMachineCodeBlockFrame() may unwind past a VM entry frame when catching an exception and the frame has inlined tail calls|
|Product:||WebKit||Reporter:||Saam Barati <sbarati>|
|Severity:||Normal||CC:||benjamin, commit-queue, fpizlo, ggaren, gskachkov, keith_miller, mark.lam, msaboff, oliver, sukolsak, webkit-bug-importer, ysuzuki|
|Version:||WebKit Nightly Build|
Description Saam Barati 2016-07-05 18:36:28 PDT
If we see that we have a sequence of tail calls that were inlined into a single machine frame, gotoNextFrame() will step over the machine callee and go to its caller (because it made a tail call, we treat the callee as logically not on the stack). This is a huge bug if we're unwinding from an exception where it's illegal to skip over VM entry frames. The machine caller of this tail called machine frame might be the VM entry frame. I think because unwindToMachineCodeBlockFrame() has sufficiently specific behavior, it should just do its own special unwinding.
Comment 2 Saam Barati 2016-07-05 19:16:26 PDT
Created attachment 282838 [details] WIP Pretty sure this fixes the bug. Need to write up a changelog.
Comment 3 Mark Lam 2016-07-05 19:36:57 PDT
Comment 6 WebKit Commit Bot 2016-07-05 22:25:41 PDT
Comment on attachment 282844 [details] patch Clearing flags on attachment: 282844 Committed r202847: <http://trac.webkit.org/changeset/202847>
Comment 7 WebKit Commit Bot 2016-07-05 22:25:46 PDT
All reviewed patches have been landed. Closing bug.