Summary: | [jsfunfuzz] unwind logic for exceptions in eval fails to account for dynamic scope external to the eval | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Oliver Hunt <oliver> | ||||
Component: | JavaScriptCore | Assignee: | Oliver Hunt <oliver> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | ||||||
Priority: | P1 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Mac | ||||||
OS: | OS X 10.5 | ||||||
Bug Depends on: | |||||||
Bug Blocks: | 13638 | ||||||
Attachments: |
|
Description
Oliver Hunt
2009-01-02 08:56:59 PST
Finally worked out the cause of this. in the expression eval("try { throw } catch(e){ /* handler */ }") The eval code will be compiled such that the handler will have an expected scope depth of 0. However if we place the eval inside a with() (or similar), with({}) eval("try { throw } catch(e){ /* handler */ }") We encounter a problem -- eval works in the local scope of the function the calls it -- eg. the base of the eval scope is the top of the scope chain at the point it is called. This means we get the following scope chain behaviour: [G] -- global object [G,activation] -- enter the function [G,activation, {}] -- enter with [G,activation, {}] -- call eval [G,activation, {}] -- throw. At this point we find the exception handler and it says the expected scope depth is *zero* [G,activation] -- unwound the stack [G] -- exit with, and whoops, we have just dropped the activation :-O Created attachment 26388 [details]
Fixerate the accursed thing
Fixed
Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/bytecompiler/BytecodeGenerator.cpp M JavaScriptCore/bytecompiler/BytecodeGenerator.h M JavaScriptCore/interpreter/Interpreter.cpp M JavaScriptCore/runtime/ScopeChain.cpp M JavaScriptCore/runtime/ScopeChain.h M LayoutTests/ChangeLog A LayoutTests/fast/js/exception-with-handler-inside-eval-with-dynamic-scope-expected.txt A LayoutTests/fast/js/exception-with-handler-inside-eval-with-dynamic-scope.html A LayoutTests/fast/js/resources/exception-with-handler-inside-eval-with-dynamic-scope.js Committed r39571 |