Bug 159448 – StackVisitor::unwindToMachineCodeBlockFrame() may unwind past a VM entry frame when catching an exception and the frame has inlined tail calls

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

If we see that we have a sequence of tail calls that were inlined into a single machine frame, gotoNextFrame()
will step over the machine callee and go to its caller (because it made a tail call, we treat the callee
as logically not on the stack). This is a huge bug if we're unwinding from an exception where it's illegal
to skip over VM entry frames. The machine caller of this tail called machine frame might be the VM entry frame.
I think because unwindToMachineCodeBlockFrame() has sufficiently specific behavior, it should just do its own special unwinding.

[Saam Barati]

<rdar://problem/27084459>

[Saam Barati]

Created attachment 282838 [details]
WIP

Pretty sure this fixes the bug. Need to write up a changelog.

[Mark Lam]

Comment on attachment 282838 [details]
WIP

View in context: https://bugs.webkit.org/attachment.cgi?id=282838&action=review

> Source/JavaScriptCore/tests/stress/dont-unwind-past-vm-entry-frame.js:35
> +    for (i = 0; i < 10000; i++) {
> +        try {
> +            p();
> +        } catch(e) { }
> +    }

I presume the expectation here is that this test should not crash.  Can you add a comment indicating that at the top of the file?

[Saam Barati]

Created attachment 282844 [details]
patch

[Mark Lam]

Comment on attachment 282844 [details]
patch

r=me

[WebKit Commit Bot]

Comment on attachment 282844 [details]
patch

Clearing flags on attachment: 282844

Committed r202847: <http://trac.webkit.org/changeset/202847>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.