Changeset 195502 in webkit for trunk/Source/JavaScriptCore/jit/JITExceptions.cpp

Timestamp:

Jan 22, 2016, 6:10:17 PM (9 years ago)

Author:

[email protected]

Message:

genericUnwind might overflow the instructions() vector when catching an FTL exception
​https://bugs.webkit.org/show_bug.cgi?id=153383

Reviewed by Benjamin Poulain.

• jit/JITExceptions.cpp:

(JSC::genericUnwind):

File:

• trunk/Source/JavaScriptCore/jit/JITExceptions.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/jit/JITExceptions.cpp

@@ -59 +59 @@
     if (handler) {
         // handler->target is meaningless for getting a code offset when catching
-        // the exception in a DFG frame. This bytecode target offset could be
+        // the exception in a DFG/FTL frame. This bytecode target offset could be
         // something that's in an inlined frame, which means an array access
         // with this bytecode offset in the machine frame is utterly meaningless
         // and can cause an overflow. OSR exit properly exits to handler->target
         // in the proper frame.
-        if (callFrame->codeBlock()->jitType() != JITCode::DFGJIT)
+        if (!JITCode::isOptimizingJIT(callFrame->codeBlock()->jitType()))
             catchPCForInterpreter = &callFrame->codeBlock()->instructions()[handler->target];
 #if ENABLE(JIT)