Changeset 154817 in webkit for trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

Timestamp:

Aug 29, 2013, 10:03:32 AM (12 years ago)

Author:

[email protected]

Message:

Source/JavaScriptCore: VM::throwException() crashes reproducibly in testapi with !ENABLE(JIT)
​https://bugs.webkit.org/show_bug.cgi?id=120472

Patch by Chris Curtis <​[email protected]> on 2013-08-29
Reviewed by Filip Pizlo.

With the JIT disabled, interpreterThrowInCaller was attempting to throw an error,
but the topCallFrame was not set yet. By passing the error object into interpreterThrowInCaller
throwException can be called when topCallFrame is set.

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

• runtime/CommonSlowPathsExceptions.cpp:

(JSC::CommonSlowPaths::interpreterThrowInCaller):

• runtime/CommonSlowPathsExceptions.h:

Renamed genericThrow -> genericUnwind, because this function no longer has the ability
to throw errors. It unwinds the stack in order to report them.

• dfg/DFGOperations.cpp:
• jit/JITExceptions.cpp:

(JSC::genericUnwind):
(JSC::jitThrowNew):
(JSC::jitThrow):

• jit/JITExceptions.h:
• llint/LLIntExceptions.cpp:

(JSC::LLInt::doThrow):

LayoutTests: VM::throwException() crashes reproducibly in testapi with !ENABLE(JIT)
​https://bugs.webkit.org/show_bug.cgi?id=120472

Patch by Chris Curtis <​[email protected]> on 2013-08-29
Reviewed by Filip Pizlo.
An error that was not being reported before is now caught and being reported.

• media/track/track-cue-rendering-on-resize-expected.txt:

File:

• trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -1900 +1900 @@
     
     unsigned vPCIndex = exec->codeBlock()->bytecodeOffsetForCallAtIndex(callIndex);
-    ExceptionHandler handler = genericThrow(vm, exec, exceptionValue, vPCIndex);
+    ExceptionHandler handler = genericUnwind(vm, exec, exceptionValue, vPCIndex);
     ASSERT(handler.catchRoutine);
     return dfgHandlerEncoded(handler.callFrame, handler.catchRoutine);
@@ -1917 +1917 @@
         codeOrigin = codeOrigin.inlineCallFrame->caller;
     
-    ExceptionHandler handler = genericThrow(vm, exec, exceptionValue, codeOrigin.bytecodeIndex);
+    ExceptionHandler handler = genericUnwind(vm, exec, exceptionValue, codeOrigin.bytecodeIndex);
     ASSERT(handler.catchRoutine);
     return dfgHandlerEncoded(handler.callFrame, handler.catchRoutine);