Bug 129134 - virtualForWithFunction() should not throw an exception with a partially initialized frame
Summary: virtualForWithFunction() should not throw an exception with a partially initi...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
Keywords: InRadar
Depends on:
Reported: 2014-02-20 17:55 PST by Mark Lam
Modified: 2014-02-20 22:02 PST (History)
7 users (show)

See Also:

The patch (1.95 KB, patch)
2014-02-20 19:52 PST, Mark Lam
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2014-02-20 17:55:20 PST
Currently, when JITOperations.cpp’s virtualForWithFunction() fails to prepare the callee function for execution, it proceeds to throw the exception using the callee frame which is only partially initialized thus far.  Instead, we should be throwing the exception using the caller frame because:
1.  the error happened "in" the caller while preparing the callee for execution i.e. the caller frame is the top fully initialized frame on the stack.
2. the callee frame is not fully initialized yet, and the unwind mechanism cannot depend on the data in it.

This patch will provide the fix.  I’ll work on creating a regression test in another bug.  I’ve been encountering some difficulty composing a regression test for the issue.  So, I’m going to defer it till later.  In the meantime, we can manually test this fix by navigating to jsfiddle.net with a debug build.  It will crash with an assertion almost instantly.

ref: <rdar://problem/15843028>
Comment 1 Mark Lam 2014-02-20 17:59:34 PST
bug for writing the regression test: <https://webkit.org/b/129136>.
Comment 2 Mark Lam 2014-02-20 19:52:31 PST
Created attachment 224822 [details]
The patch
Comment 3 Michael Saboff 2014-02-20 21:30:46 PST
Comment on attachment 224822 [details]
The patch

Comment 4 WebKit Commit Bot 2014-02-20 22:02:18 PST
Comment on attachment 224822 [details]
The patch

Clearing flags on attachment: 224822

Committed r164472: <http://trac.webkit.org/changeset/164472>
Comment 5 WebKit Commit Bot 2014-02-20 22:02:21 PST
All reviewed patches have been landed.  Closing bug.