Changeset 154156 in webkit for trunk/Source/JavaScriptCore


Ignore:
Timestamp:
Aug 15, 2013, 6:47:41 PM (12 years ago)
Author:
[email protected]
Message:

Fix crash when performing activation tearoff.
​https://bugs.webkit.org/show_bug.cgi?id=119848

Reviewed by Oliver Hunt.

The activation tearoff crash was due to a bug in the baseline JIT.
If we have a scenario where the a baseline JIT frame calls a LLINT
frame, an exception may be thrown while in the LLINT.

Interpreter::throwException() which handles the exception will unwind
all frames until it finds a catcher or sees a host frame. When we
return from the LLINT to the baseline JIT code, the baseline JIT code
errorneously sets topCallFrame to the value in its call frame register,
and starts unwinding the stack frames that have already been unwound.

The fix is:

  1. Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException. This is a more accurate description of what this runtime function is supposed to do i.e. it handles the exception which include doing nothing (if there are no more frames to unwind).
  2. Fix up topCallFrame values so that the HostCallFrameFlag is never set on it.
  3. Reloading the call frame register from topCallFrame when we're returning from a callee and detect exception handling in progress.
  • interpreter/Interpreter.cpp:

(JSC::Interpreter::unwindCallFrame):

  • Ensure that topCallFrame is not set with the HostCallFrameFlag.

(JSC::Interpreter::getStackTrace):

  • interpreter/Interpreter.h:

(JSC::TopCallFrameSetter::TopCallFrameSetter):
(JSC::TopCallFrameSetter::~TopCallFrameSetter):
(JSC::NativeCallFrameTracer::NativeCallFrameTracer):

  • Ensure that topCallFrame is not set with the HostCallFrameFlag.
  • jit/JIT.h:
  • jit/JITExceptions.cpp:

(JSC::uncaughtExceptionHandler):

  • Convenience function to get the handler for uncaught exceptions.
  • jit/JITExceptions.h:
  • jit/JITInlines.h:

(JSC::JIT::reloadCallFrameFromTopCallFrame):

  • jit/JITOpcodes32_64.cpp:

(JSC::JIT::privateCompileCTINativeCall):

  • Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
  • jit/JITStubs.cpp:

(JSC::throwExceptionFromOpCall):

  • Ensure that topCallFrame is not set with the HostCallFrameFlag.

(JSC::cti_vm_handle_exception):

  • Check for the case when there are no more frames to unwind.
  • jit/JITStubs.h:
  • jit/JITStubsARM.h:
  • jit/JITStubsARMv7.h:
  • jit/JITStubsMIPS.h:
  • jit/JITStubsSH4.h:
  • jit/JITStubsX86.h:
  • jit/JITStubsX86_64.h:
  • Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
  • jit/SlowPathCall.h:

(JSC::JITSlowPathCall::call):

  • reload cfr from topcallFrame when handling an exception.
  • Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
  • jit/ThunkGenerators.cpp:

(JSC::nativeForGenerator):

  • llint/LowLevelInterpreter32_64.asm:
  • llint/LowLevelInterpreter64.asm:
  • reload cfr from topcallFrame when handling an exception.
  • runtime/VM.cpp:

(JSC::VM::VM):

  • Ensure that topCallFrame is not set with the HostCallFrameFlag.
Location:
trunk/Source/JavaScriptCore
Files:
21 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r154143 r154156  
     12013-08-15  Mark Lam  <[email protected]>
     2
     3        Fix crash when performing activation tearoff.
     4        https://bugs.webkit.org/show_bug.cgi?id=119848
     5
     6        Reviewed by Oliver Hunt.
     7
     8        The activation tearoff crash was due to a bug in the baseline JIT.
     9        If we have a scenario where the a baseline JIT frame calls a LLINT
     10        frame, an exception may be thrown while in the LLINT.
     11
     12        Interpreter::throwException() which handles the exception will unwind
     13        all frames until it finds a catcher or sees a host frame. When we
     14        return from the LLINT to the baseline JIT code, the baseline JIT code
     15        errorneously sets topCallFrame to the value in its call frame register,
     16        and starts unwinding the stack frames that have already been unwound.
     17
     18        The fix is:
     19        1. Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
     20           This is a more accurate description of what this runtime function
     21           is supposed to do i.e. it handles the exception which include doing
     22           nothing (if there are no more frames to unwind).
     23        2. Fix up topCallFrame values so that the HostCallFrameFlag is never
     24           set on it.
     25        3. Reloading the call frame register from topCallFrame when we're
     26           returning from a callee and detect exception handling in progress.
     27
     28        * interpreter/Interpreter.cpp:
     29        (JSC::Interpreter::unwindCallFrame):
     30        - Ensure that topCallFrame is not set with the HostCallFrameFlag.
     31        (JSC::Interpreter::getStackTrace):
     32        * interpreter/Interpreter.h:
     33        (JSC::TopCallFrameSetter::TopCallFrameSetter):
     34        (JSC::TopCallFrameSetter::~TopCallFrameSetter):
     35        (JSC::NativeCallFrameTracer::NativeCallFrameTracer):
     36        - Ensure that topCallFrame is not set with the HostCallFrameFlag.
     37        * jit/JIT.h:
     38        * jit/JITExceptions.cpp:
     39        (JSC::uncaughtExceptionHandler):
     40        - Convenience function to get the handler for uncaught exceptions.
     41        * jit/JITExceptions.h:
     42        * jit/JITInlines.h:
     43        (JSC::JIT::reloadCallFrameFromTopCallFrame):
     44        * jit/JITOpcodes32_64.cpp:
     45        (JSC::JIT::privateCompileCTINativeCall):
     46        - Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
     47        * jit/JITStubs.cpp:
     48        (JSC::throwExceptionFromOpCall):
     49        - Ensure that topCallFrame is not set with the HostCallFrameFlag.
     50        (JSC::cti_vm_handle_exception):
     51        - Check for the case when there are no more frames to unwind.
     52        * jit/JITStubs.h:
     53        * jit/JITStubsARM.h:
     54        * jit/JITStubsARMv7.h:
     55        * jit/JITStubsMIPS.h:
     56        * jit/JITStubsSH4.h:
     57        * jit/JITStubsX86.h:
     58        * jit/JITStubsX86_64.h:
     59        - Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
     60        * jit/SlowPathCall.h:
     61        (JSC::JITSlowPathCall::call):
     62        - reload cfr from topcallFrame when handling an exception.
     63        - Rename ctiVMThrowTrampolineSlowpath to ctiVMHandleException.
     64        * jit/ThunkGenerators.cpp:
     65        (JSC::nativeForGenerator):
     66        * llint/LowLevelInterpreter32_64.asm:
     67        * llint/LowLevelInterpreter64.asm:
     68        - reload cfr from topcallFrame when handling an exception.
     69        * runtime/VM.cpp:
     70        (JSC::VM::VM):
     71        - Ensure that topCallFrame is not set with the HostCallFrameFlag.
     72
    1732013-08-15  Filip Pizlo  <[email protected]>
    274

  • trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

    r154038 r154156  
    399399
    400400    CallFrame* callerFrame = callFrame->callerFrame();
    401     callFrame->vm().topCallFrame = callerFrame;
     401    callFrame->vm().topCallFrame = callerFrame->removeHostCallFrameFlag();
    402402    return !callerFrame->hasHostCallFrameFlag();
    403403}
    … …  
    532532{
    533533    VM& vm = m_vm;
    534     CallFrame* callFrame = vm.topCallFrame->removeHostCallFrameFlag();
     534    ASSERT(!vm.topCallFrame->hasHostCallFrameFlag());
     535    CallFrame* callFrame = vm.topCallFrame;
    535536    if (!callFrame)
    536537        return;

  • trunk/Source/JavaScriptCore/interpreter/Interpreter.h

    r153825 r154156  
    136136    class TopCallFrameSetter {
    137137    public:
    138         TopCallFrameSetter(VM& global, CallFrame* callFrame)
    139             : vm(global)
    140             , oldCallFrame(global.topCallFrame)
    141         {
    142             global.topCallFrame = callFrame;
     138        TopCallFrameSetter(VM& currentVM, CallFrame* callFrame)
     139            : vm(currentVM)
     140            , oldCallFrame(currentVM.topCallFrame)
     141        {
     142            ASSERT(!callFrame->hasHostCallFrameFlag());
     143            currentVM.topCallFrame = callFrame;
    143144        }
    144145       
    145146        ~TopCallFrameSetter()
    146147        {
     148            ASSERT(!oldCallFrame->hasHostCallFrameFlag());
    147149            vm.topCallFrame = oldCallFrame;
    148150        }
    … …  
    154156    class NativeCallFrameTracer {
    155157    public:
    156         ALWAYS_INLINE NativeCallFrameTracer(VM* global, CallFrame* callFrame)
    157         {
    158             ASSERT(global);
     158        ALWAYS_INLINE NativeCallFrameTracer(VM* vm, CallFrame* callFrame)
     159        {
     160            ASSERT(vm);
    159161            ASSERT(callFrame);
    160             global->topCallFrame = callFrame;
     162            ASSERT(!callFrame->hasHostCallFrameFlag());
     163            vm->topCallFrame = callFrame;
    161164        }
    162165    };

  • trunk/Source/JavaScriptCore/jit/JIT.h

    r154127 r154156  
    839839        void restoreArgumentReferenceForTrampoline();
    840840        void updateTopCallFrame();
     841        void reloadCallFrameFromTopCallFrame();
    841842
    842843        Call emitNakedCall(CodePtr function = CodePtr());

  • trunk/Source/JavaScriptCore/jit/JITExceptions.cpp

    r153646 r154156  
    6161#endif
    6262
     63ExceptionHandler uncaughtExceptionHandler()
     64{
     65    void* catchRoutine = FunctionPtr(LLInt::getCodePtr(ctiOpThrowNotCaught)).value();
     66    ExceptionHandler exceptionHandler = { 0, catchRoutine};
     67    return exceptionHandler;
     68}
     69
    6370ExceptionHandler genericThrow(VM* vm, ExecState* callFrame, JSValue exceptionValue, unsigned vPCIndex)
    6471{

  • trunk/Source/JavaScriptCore/jit/JITExceptions.h

    r153646 r154156  
    5858#endif
    5959
     60ExceptionHandler uncaughtExceptionHandler();
    6061ExceptionHandler genericThrow(VM*, ExecState*, JSValue exceptionValue, unsigned vPCIndex);
    6162

  • trunk/Source/JavaScriptCore/jit/JITInlines.h

    r153231 r154156  
    192192}
    193193
     194ALWAYS_INLINE void JIT::reloadCallFrameFromTopCallFrame()
     195{
     196    loadPtr(&m_vm->topCallFrame, callFrameRegister);
     197}
     198
    194199ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
    195200{

  • trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp

    r153237 r154156  
    171171    storePtr(callFrameRegister, &m_vm->topCallFrame);
    172172
    173     move(TrustedImmPtr(FunctionPtr(ctiVMThrowTrampolineSlowpath).value()), regT1);
     173    move(TrustedImmPtr(FunctionPtr(ctiVMHandleException).value()), regT1);
    174174    jump(regT1);
    175175

  • trunk/Source/JavaScriptCore/jit/JITStubs.cpp

    r154016 r154156  
    418418template<typename T> static T throwExceptionFromOpCall(JITStackFrame& jitStackFrame, CallFrame* newCallFrame, ReturnAddressPtr& returnAddressSlot, ErrorFunctor& createError )
    419419{
    420     CallFrame* callFrame = newCallFrame->callerFrame();
     420    CallFrame* callFrame = newCallFrame->callerFrame()->removeHostCallFrameFlag();
    421421    jitStackFrame.callFrame = callFrame;
    422422    callFrame->vm().topCallFrame = callFrame;
    … …  
    21602160
    21612161#if USE(JSVALUE32_64)
    2162 EncodedExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame* callFrame)
    2163 {
     2162EncodedExceptionHandler JIT_STUB cti_vm_handle_exception(CallFrame* callFrame)
     2163{
     2164    ASSERT(!callFrame->hasHostCallFrameFlag());
     2165    if (!callFrame) {
     2166        // The entire stack has already been unwound. Nothing more to handle.
     2167        return uncaughtExceptionHandler();
     2168    }
     2169
    21642170    VM* vm = callFrame->codeBlock()->vm();
    21652171    vm->topCallFrame = callFrame;
    … …  
    21672173}
    21682174#else
    2169 ExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame* callFrame)
    2170 {
     2175ExceptionHandler JIT_STUB cti_vm_handle_exception(CallFrame* callFrame)
     2176{
     2177    ASSERT(!callFrame->hasHostCallFrameFlag());
     2178    if (!callFrame) {
     2179        // The entire stack has already been unwound. Nothing more to handle.
     2180        return uncaughtExceptionHandler();
     2181    }
     2182
    21712183    VM* vm = callFrame->codeBlock()->vm();
    21722184    vm->topCallFrame = callFrame;

  • trunk/Source/JavaScriptCore/jit/JITStubs.h

    r154052 r154156  
    311311
    312312extern "C" void ctiVMThrowTrampoline();
    313 extern "C" void ctiVMThrowTrampolineSlowpath();
     313extern "C" void ctiVMHandleException();
    314314extern "C" void ctiOpThrowNotCaught();
    315315extern "C" EncodedJSValue ctiTrampoline(void* code, JSStack*, CallFrame*, void* /*unused1*/, void* /*unused2*/, VM*);
    … …  
    424424
    425425#if USE(JSVALUE32_64)
    426 EncodedExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame*) REFERENCED_FROM_ASM WTF_INTERNAL;
     426EncodedExceptionHandler JIT_STUB cti_vm_handle_exception(CallFrame*) REFERENCED_FROM_ASM WTF_INTERNAL;
    427427#else
    428 ExceptionHandler JIT_STUB cti_vm_throw_slowpath(CallFrame*) REFERENCED_FROM_ASM WTF_INTERNAL;
     428ExceptionHandler JIT_STUB cti_vm_handle_exception(CallFrame*) REFERENCED_FROM_ASM WTF_INTERNAL;
    429429#endif
    430430

  • trunk/Source/JavaScriptCore/jit/JITStubsARM.h

    r153745 r154156  
    199199asm (
    200200".text" "\n"
    201 ".globl " SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) "\n"
    202 HIDE_SYMBOL(ctiVMThrowTrampolineSlowpath) "\n"
    203 INLINE_ARM_FUNCTION(ctiVMThrowTrampolineSlowpath)
    204 SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) ":" "\n"
     201".globl " SYMBOL_STRING(ctiVMHandleException) "\n"
     202HIDE_SYMBOL(ctiVMHandleException) "\n"
     203INLINE_ARM_FUNCTION(ctiVMHandleException)
     204SYMBOL_STRING(ctiVMHandleException) ":" "\n"
    205205    "mov r0, r5" "\n"
    206     "bl " SYMBOL_STRING(cti_vm_throw_slowpath) "\n"
    207     // When cti_vm_throw_slowpath returns, r0 has callFrame and r1 has handler address
     206    "bl " SYMBOL_STRING(cti_vm_handle_exception) "\n"
     207    // When cti_vm_handle_exception returns, r0 has callFrame and r1 has handler address
    208208    "mov r5, r0" "\n"
    209209    "bx r1" "\n"
    … …  
    460460MSVC_BEGIN(    EXPORT ctiVMThrowTrampoline)
    461461MSVC_BEGIN(    EXPORT ctiOpThrowNotCaught)
    462 MSVC_BEGIN(    EXPORT ctiVMThrowTrampolineSlowpath)
    463 MSVC_BEGIN(    IMPORT cti_vm_throw_slowpath)
     462MSVC_BEGIN(    EXPORT ctiVMHandleException)
     463MSVC_BEGIN(    IMPORT cti_vm_handle_exception)
    464464MSVC_BEGIN()
    465465MSVC_BEGIN(ctiTrampoline PROC)
    … …  
    489489MSVC_BEGIN(ctiVMThrowTrampoline ENDP)
    490490MSVC_BEGIN()
    491 MSVC_BEGIN(ctiVMThrowTrampolineSlowpath PROC)
     491MSVC_BEGIN(ctiVMHandleException PROC)
    492492MSVC_BEGIN(    mov r0, r5)
    493 MSVC_BEGIN(    bl cti_vm_throw_slowpath)
     493MSVC_BEGIN(    bl cti_vm_handle_exception)
    494494MSVC_BEGIN(    mov r5, r0)
    495495MSVC_BEGIN(    bx r1)
    496 MSVC_BEGIN(ctiVMThrowTrampolineSlowpath ENDP)
     496MSVC_BEGIN(ctiVMHandleException ENDP)
    497497MSVC_BEGIN()
    498498

  • trunk/Source/JavaScriptCore/jit/JITStubsARMv7.h

    r153762 r154156  
    271271".text" "\n"
    272272".align 2" "\n"
    273 ".globl " SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) "\n"
    274 HIDE_SYMBOL(ctiVMThrowTrampolineSlowpath) "\n"
     273".globl " SYMBOL_STRING(ctiVMHandleException) "\n"
     274HIDE_SYMBOL(ctiVMHandleException) "\n"
    275275".thumb" "\n"
    276 ".thumb_func " THUMB_FUNC_PARAM(ctiVMThrowTrampolineSlowpath) "\n"
    277 SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) ":" "\n"
     276".thumb_func " THUMB_FUNC_PARAM(ctiVMHandleException) "\n"
     277SYMBOL_STRING(ctiVMHandleException) ":" "\n"
    278278    "mov r0, r5" "\n"
    279     "bl " LOCAL_REFERENCE(cti_vm_throw_slowpath) "\n"
    280     // When cti_vm_throw_slowpath returns, r0 has callFrame and r1 has handler address
     279    "bl " LOCAL_REFERENCE(cti_vm_handle_exception) "\n"
     280    // When cti_vm_handle_exception returns, r0 has callFrame and r1 has handler address
    281281    "mov r5, r0" "\n"
    282282    "bx r1" "\n"

  • trunk/Source/JavaScriptCore/jit/JITStubsMIPS.h

    r153659 r154156  
    135135".set nomacro" "\n"
    136136".set nomips16" "\n"
    137 ".globl " SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) "\n"
    138 ".ent " SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) "\n"
    139 SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) ":" "\n"
     137".globl " SYMBOL_STRING(ctiVMHandleException) "\n"
     138".ent " SYMBOL_STRING(ctiVMHandleException) "\n"
     139SYMBOL_STRING(ctiVMHandleException) ":" "\n"
    140140#if WTF_MIPS_PIC
    141141".set macro" "\n"
    142142".cpload $25" "\n"
    143     "la    $25," SYMBOL_STRING(cti_vm_throw_slowpath) "\n"
    144 ".set nomacro" "\n"
    145     "bal " SYMBOL_STRING(cti_vm_throw_slowpath) "\n"
     143    "la    $25," SYMBOL_STRING(cti_vm_handle_exception) "\n"
     144".set nomacro" "\n"
     145    "bal " SYMBOL_STRING(cti_vm_handle_exception) "\n"
    146146    "move  $4,$16" "\n"
    147147#else
    148     "jal " SYMBOL_STRING(cti_vm_throw_slowpath) "\n"
     148    "jal " SYMBOL_STRING(cti_vm_handle_exception) "\n"
    149149    "move  $4,$16" "\n"
    150150#endif
    151     // When cti_vm_throw_slowpath returns, v0 has callFrame and v1 has handler address
     151    // When cti_vm_handle_exception returns, v0 has callFrame and v1 has handler address
    152152    "move  $16,$2 " "\n"
    153153    "jr    $3" "\n"
    … …  
    155155".set reorder" "\n"
    156156".set macro" "\n"
    157 ".end " SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) "\n"
     157".end " SYMBOL_STRING(ctiVMHandleException) "\n"
    158158);
    159159

  • trunk/Source/JavaScriptCore/jit/JITStubsSH4.h

    r154052 r154156  
    108108
    109109asm volatile (
    110 ".globl " SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) "\n"
    111 HIDE_SYMBOL(ctiVMThrowTrampolineSlowpath) "\n"
    112 SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) ":" "\n"
    113     "mov.l .L2"SYMBOL_STRING(cti_vm_throw_slowpath)",r0" "\n"
     110".globl " SYMBOL_STRING(ctiVMHandleExceptiom) "\n"
     111HIDE_SYMBOL(ctiVMHandleExceptiom) "\n"
     112SYMBOL_STRING(ctiVMHandleExceptiom) ":" "\n"
     113    "mov.l .L2"SYMBOL_STRING(cti_vm_handle_exception)",r0" "\n"
    114114    "mov r14, r4" "\n"
    115115    "mov.l @(r0,r12),r11" "\n"
    116116    "jsr @r11" "\n"
    117     // When cti_vm_throw_slowpath returns, r0 has callFrame and r1 has handler address
     117    // When cti_vm_handle_exception returns, r0 has callFrame and r1 has handler address
    118118    "nop" "\n"
    119119    "mov r0, r14" "\n"
    … …  
    122122    "nop" "\n"
    123123    ".align 2" "\n"
    124     ".L2"SYMBOL_STRING(cti_vm_throw_slowpath)":.long " SYMBOL_STRING(cti_vm_throw_slowpath)"@GOT \n"
     124    ".L2"SYMBOL_STRING(cti_vm_handle_exception)":.long " SYMBOL_STRING(cti_vm_handle_exception)"@GOT \n"
    125125);
    126126

  • trunk/Source/JavaScriptCore/jit/JITStubsX86.h

    r153527 r154156  
    8787
    8888asm (
    89 ".globl " SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) "\n"
    90 HIDE_SYMBOL(ctiVMThrowTrampolineSlowpath) "\n"
    91 SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) ":" "\n"
     89".globl " SYMBOL_STRING(ctiVMHandleException) "\n"
     90HIDE_SYMBOL(ctiVMHandleException) "\n"
     91SYMBOL_STRING(ctiVMHandleException) ":" "\n"
    9292    "movl %edi, %ecx" "\n"
    93     "call " LOCAL_REFERENCE(cti_vm_throw_slowpath) "\n"
    94     // When cti_vm_throw_slowpath returns, eax has callFrame and edx has handler address
     93    "call " LOCAL_REFERENCE(cti_vm_handle_exception) "\n"
     94    // When cti_vm_handle_exception returns, eax has callFrame and edx has handler address
    9595    "jmp *%edx" "\n"
    9696);
    … …  
    305305    }
    306306
    307     __declspec(naked) void ctiVMThrowTrampolineSlowpath()
     307    __declspec(naked) void ctiVMHandleException()
    308308    {
    309309        __asm {
    310310            mov ecx, edi;
    311             call cti_vm_throw_slowpath;
    312             // When cti_vm_throw_slowpath returns, eax has callFrame and edx has handler address
     311            call cti_vm_handle_exception;
     312            // When cti_vm_handle_exception returns, eax has callFrame and edx has handler address
    313313            jmp edx
    314314        }

  • trunk/Source/JavaScriptCore/jit/JITStubsX86_64.h

    r153222 r154156  
    100100
    101101asm (
    102 ".globl " SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) "\n"
    103 HIDE_SYMBOL(ctiVMThrowTrampolineSlowpath) "\n"
    104 SYMBOL_STRING(ctiVMThrowTrampolineSlowpath) ":" "\n"
     102".globl " SYMBOL_STRING(ctiVMHandleException) "\n"
     103HIDE_SYMBOL(ctiVMHandleException) "\n"
     104SYMBOL_STRING(ctiVMHandleException) ":" "\n"
    105105    "movq %r13, %rdi" "\n"
    106     "call " LOCAL_REFERENCE(cti_vm_throw_slowpath) "\n"
    107     // When cti_vm_throw_slowpath returns, rax has callFrame and rdx has handler address
     106    "call " LOCAL_REFERENCE(cti_vm_handle_exception) "\n"
     107    // When cti_vm_handle_exception returns, rax has callFrame and rdx has handler address
    108108    "jmp *%rdx" "\n"
    109109);

  • trunk/Source/JavaScriptCore/jit/SlowPathCall.h

    r154075 r154156  
    8989        JIT::Jump noException = m_jit->branchTest64(JIT::Zero, JIT::AbsoluteAddress(&m_jit->m_codeBlock->vm()->exception));
    9090#endif
    91         m_jit->move(JIT::TrustedImmPtr(FunctionPtr(ctiVMThrowTrampolineSlowpath).value()), JIT::regT1);
     91        m_jit->reloadCallFrameFromTopCallFrame();
     92        m_jit->move(JIT::TrustedImmPtr(FunctionPtr(ctiVMHandleException).value()), JIT::regT1);
    9293        m_jit->jump(JIT::regT1);
    9394        noException.link(m_jit);

  • trunk/Source/JavaScriptCore/jit/ThunkGenerators.cpp

    r153232 r154156  
    403403    jit.storePtr(JSInterfaceJIT::callFrameRegister, &vm->topCallFrame);
    404404
    405     jit.move(JSInterfaceJIT::TrustedImmPtr(FunctionPtr(ctiVMThrowTrampolineSlowpath).value()), JSInterfaceJIT::regT1);
     405    jit.move(JSInterfaceJIT::TrustedImmPtr(FunctionPtr(ctiVMHandleException).value()), JSInterfaceJIT::regT1);
    406406    jit.jump(JSInterfaceJIT::regT1);
    407407

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm

    r154095 r154156  
    17811781    # This essentially emulates the JIT's throwing protocol.
    17821782    loadp JITStackFrame::vm[sp], t1
     1783    loadp VM::topCallFrame[t1], cfr
    17831784    loadp VM::callFrameForThrow[t1], t0
    17841785    jmp VM::targetMachinePCForThrow[t1]
    … …  
    17881789    preserveReturnAddressAfterCall(t2)
    17891790    loadp JITStackFrame::vm[sp], t1
     1791    loadp VM::topCallFrame[t1], cfr
    17901792    loadp VM::callFrameForThrow[t1], t0
    17911793    jmp VM::targetMachinePCForThrow[t1]

  • trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

    r154095 r154156  
    15951595    # This essentially emulates the JIT's throwing protocol.
    15961596    loadp JITStackFrame::vm[sp], t1
     1597    loadp VM::topCallFrame[t1], cfr
    15971598    loadp VM::callFrameForThrow[t1], t0
    15981599    jmp VM::targetMachinePCForThrow[t1]
    … …  
    16021603    preserveReturnAddressAfterCall(t2)
    16031604    loadp JITStackFrame::vm[sp], t1
     1605    loadp VM::topCallFrame[t1], cfr
    16041606    loadp VM::callFrameForThrow[t1], t0
    16051607    jmp VM::targetMachinePCForThrow[t1]

  • trunk/Source/JavaScriptCore/runtime/VM.cpp

    r154127 r154156  
    144144    , vmType(vmType)
    145145    , clientData(0)
    146     , topCallFrame(CallFrame::noCaller())
     146    , topCallFrame(CallFrame::noCaller()->removeHostCallFrameFlag())
    147147    , arrayConstructorTable(fastNew<HashTable>(JSC::arrayConstructorTable))
    148148    , arrayPrototypeTable(fastNew<HashTable>(JSC::arrayPrototypeTable))
Note: See TracChangeset for help on using the changeset viewer.