Changeset 147670 in webkit for trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

Apr 4, 2013, 2:25:26 PM (12 years ago)

Author:

[email protected]

Message:

Exception stack unwinding doesn't handle inline callframes correctly
​https://bugs.webkit.org/show_bug.cgi?id=113952

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

The basic problem here is that the exception stack unwinding was
attempting to be "clever" and avoid doing a correct stack walk
as it "knew" inline callframes couldn't have exception handlers.

This used to be safe as the exception handling machinery was
designed to fail gently and just claim that no handler existed.
This was "safe" and even "correct" inasmuch as we currently
don't run any code with exception handlers through the dfg.

This patch fixes the logic by simply making everything uniformly
use the safe stack walking machinery, and making the correct
boundary checks occur everywhere that they should.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::findClosureCallForReturnPC):
(JSC::CodeBlock::bytecodeOffset):

• interpreter/Interpreter.cpp:

(JSC):
(JSC::Interpreter::dumpRegisters):
(JSC::Interpreter::unwindCallFrame):
(JSC::getCallerInfo):
(JSC::Interpreter::getStackTrace):
(JSC::Interpreter::retrieveCallerFromVMCode):

LayoutTests:

Yay tests!

• fast/js/js-correct-exception-handler-expected.txt: Added.
• fast/js/js-correct-exception-handler.html: Added.
• fast/js/script-tests/js-correct-exception-handler.js: Added.

(throwEventually):
(f.g):
(f):
(test):

File:

• trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (modified) (9 diffs)

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -200 +200 @@
 
 
-static CallFrame* getCallerInfo(JSGlobalData*, CallFrame*, int& lineNumber, unsigned& bytecodeOffset);
+static CallFrame* getCallerInfo(JSGlobalData*, CallFrame*, int& lineNumber, unsigned& bytecodeOffset, CodeBlock*& callerOut);
 
 // Returns the depth of the scope chain within a given call frame.
@@ -423 +423 @@
     unsigned bytecodeOffset = 0;
     int line = 0;
-    getCallerInfo(&callFrame->globalData(), callFrame, line, bytecodeOffset);
+    CodeBlock* unusedCallerCodeBlock = 0;
+    getCallerInfo(&callFrame->globalData(), callFrame, line, bytecodeOffset, unusedCallerCodeBlock);
     dataLogF("[ReturnVPC]                | %10p | %d (line %d)\n", it, bytecodeOffset, line);
     ++it;
@@ -507 +508 @@
     if (callerFrame->hasHostCallFrameFlag())
         return false;
-
-    codeBlock = callerFrame->codeBlock();
-    
-    // Because of how the JIT records call site->bytecode offset
-    // information the JIT reports the bytecodeOffset for the returnPC
-    // to be at the beginning of the opcode that has caused the call.
-#if ENABLE(JIT) || ENABLE(LLINT)
-    bytecodeOffset = codeBlock->bytecodeOffset(callerFrame, callFrame->returnPC());
-#endif
-
-    callFrame = callerFrame;
+    int unusedLineNumber = 0;
+    callFrame = getCallerInfo(&callFrame->globalData(), callFrame, unusedLineNumber, bytecodeOffset, codeBlock);
     return true;
 }
@@ -589 +581 @@
 }
 
-static CallFrame* getCallerInfo(JSGlobalData* globalData, CallFrame* callFrame, int& lineNumber, unsigned& bytecodeOffset)
-{
-    UNUSED_PARAM(globalData);
+static CallFrame* getCallerInfo(JSGlobalData* globalData, CallFrame* callFrame, int& lineNumber, unsigned& bytecodeOffset, CodeBlock*& caller)
+{
+    ASSERT_UNUSED(globalData, globalData);
     bytecodeOffset = 0;
     lineNumber = -1;
@@ -599 +591 @@
     ASSERT(!callerFrame->hasHostCallFrameFlag());
 
-    if (callerFrame == CallFrame::noCaller() || !callerFrame || !callerFrame->codeBlock())
+    if (callerFrame == CallFrame::noCaller() || !callerFrame || !callerFrame->codeBlock()) {
+        caller = 0;
         return callerFrame;
+    }
     
     CodeBlock* callerCodeBlock = callerFrame->codeBlock();
@@ -660 +654 @@
 
     RELEASE_ASSERT(callerCodeBlock);
+    caller = callerCodeBlock;
     lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(bytecodeOffset);
     return callerFrame;
@@ -706 +701 @@
         }
         unsigned unusedBytecodeOffset = 0;
-        callFrame = getCallerInfo(globalData, callFrame, line, unusedBytecodeOffset);
+        CodeBlock* unusedCallerCodeBlock = 0;
+        callFrame = getCallerInfo(globalData, callFrame, line, unusedBytecodeOffset, unusedCallerCodeBlock);
     }
 }
@@ -1382 +1378 @@
     int lineNumber;
     unsigned bytecodeOffset;
-    CallFrame* callerFrame = getCallerInfo(&callFrame->globalData(), functionCallFrame, lineNumber, bytecodeOffset);
+    CodeBlock* unusedCallerCodeBlock = 0;
+    CallFrame* callerFrame = getCallerInfo(&callFrame->globalData(), functionCallFrame, lineNumber, bytecodeOffset, unusedCallerCodeBlock);
     if (!callerFrame)
         return jsNull();
@@ -1392 +1389 @@
     ASSERT(caller.isObject());
     while (asObject(caller)->inherits(&JSBoundFunction::s_info)) {
-        callerFrame = getCallerInfo(&callFrame->globalData(), callerFrame, lineNumber, bytecodeOffset);
+        callerFrame = getCallerInfo(&callFrame->globalData(), callerFrame, lineNumber, bytecodeOffset, unusedCallerCodeBlock);
         if (!callerFrame)
             return jsNull();