Bug 191579 - LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
Summary: LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
URL:
Keywords: InRadar
Depends on:
Blocks: 191594
  Show dependency treegraph
 
Reported: 2018-11-12 23:51 PST by Mark Lam
Modified: 2018-11-27 11:09 PST (History)
5 users (show)

See Also:


Attachments
proposed patch. (9.50 KB, patch)
2018-11-13 00:11 PST, Mark Lam
no flags Details | Formatted Diff | Diff
proposed patch. (9.56 KB, patch)
2018-11-13 00:22 PST, Mark Lam
no flags Details | Formatted Diff | Diff
proposed patch. (9.56 KB, patch)
2018-11-13 00:50 PST, Mark Lam
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2018-11-12 23:51:18 PST
Both of these functions do a lot of work.  It would be good for the topCallFrame to be correct should we need to throw an exception.

<rdar://problem/45942472>
Comment 1 Mark Lam 2018-11-13 00:11:42 PST
Created attachment 354655 [details]
proposed patch.
Comment 2 Mark Lam 2018-11-13 00:22:20 PST
Created attachment 354656 [details]
proposed patch.
Comment 3 Mark Lam 2018-11-13 00:50:37 PST
Created attachment 354658 [details]
proposed patch.
Comment 4 Saam Barati 2018-11-13 07:36:39 PST
Comment on attachment 354658 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=354658&action=review

> Source/JavaScriptCore/ChangeLog:39
> +            frame #25: JSC::ProxyObject::getOwnPropertySlotCommon(this=0x000062d000200e40, exec=0x000062d00002c048, propertyName=PropertyName @ 0x00007ffeefbbba80, slot=0x00007ffeefbbc720) at ProxyObject.cpp:372

Can you also file a bug and assign it to me with a reproducible test case. calculatedClassName should not do anything effectful. So it’s wrong that it calls into JS
Comment 5 Saam Barati 2018-11-13 07:37:09 PST
r=me if you want to land this patch
Comment 6 Mark Lam 2018-11-13 12:53:43 PST
(In reply to Saam Barati from comment #4)
> Can you also file a bug and assign it to me with a reproducible test case.
> calculatedClassName should not do anything effectful. So it’s wrong that it
> calls into JS

I've filed https://bugs.webkit.org/show_bug.cgi?id=191594 to capture this issue.

Thanks for the review.  Landed in r238141: <http://trac.webkit.org/r238141>.