If we see that we have a sequence of tail calls that were inlined into a single machine frame, gotoNextFrame() will step over the machine callee and go to its caller (because it made a tail call, we treat the callee as logically not on the stack). This is a huge bug if we're unwinding from an exception where it's illegal to skip over VM entry frames. The machine caller of this tail called machine frame might be the VM entry frame. I think because unwindToMachineCodeBlockFrame() has sufficiently specific behavior, it should just do its own special unwinding.
<rdar://problem/27084459>
Created attachment 282838 [details] WIP Pretty sure this fixes the bug. Need to write up a changelog.
Comment on attachment 282838 [details] WIP View in context: https://bugs.webkit.org/attachment.cgi?id=282838&action=review > Source/JavaScriptCore/tests/stress/dont-unwind-past-vm-entry-frame.js:35 > + for (i = 0; i < 10000; i++) { > + try { > + p(); > + } catch(e) { } > + } I presume the expectation here is that this test should not crash. Can you add a comment indicating that at the top of the file?
Created attachment 282844 [details] patch
Comment on attachment 282844 [details] patch r=me
Comment on attachment 282844 [details] patch Clearing flags on attachment: 282844 Committed r202847: <http://trac.webkit.org/changeset/202847>
All reviewed patches have been landed. Closing bug.