Bug 113952 - Exception stack unwinding doesn't handle inline callframes correctly
Summary: Exception stack unwinding doesn't handle inline callframes correctly
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Oliver Hunt
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-04-04 13:19 PDT by Oliver Hunt
Modified: 2013-04-04 14:23 PDT (History)
0 users

See Also:


Attachments
Patch (9.32 KB, patch)
2013-04-04 13:26 PDT, Oliver Hunt
no flags Details | Formatted Diff | Diff
Patch (12.23 KB, patch)
2013-04-04 13:49 PDT, Oliver Hunt
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2013-04-04 13:19:38 PDT
Exception stack unwinding doesn't handle inline callframes correctly
Comment 1 Oliver Hunt 2013-04-04 13:26:46 PDT
Created attachment 196513 [details]
Patch
Comment 2 Oliver Hunt 2013-04-04 13:49:53 PDT
Created attachment 196519 [details]
Patch
Comment 3 Geoffrey Garen 2013-04-04 14:06:47 PDT
Comment on attachment 196519 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=196519&action=review

r=me

> Source/JavaScriptCore/ChangeLog:15
> +        This used to be safe as the exception handling machinery was
> +        designed to fail gently and just claim that no handler existed.
> +        This was "safe" and even "correct" inasmuch as we currently
> +        don't run any code with exception handlers through the dfg.

So, why did it turn out not to be safe or correct?

> Source/JavaScriptCore/bytecode/CodeBlock.cpp:2734
> +    while (InlineCallFrame* icf = origin.inlineCallFrame) {

Let's call this "inlineCallFrame".
Comment 4 Oliver Hunt 2013-04-04 14:23:46 PDT
Committed r147670: <http://trac.webkit.org/changeset/147670>