Changeset 201589 in webkit

Timestamp:

Jun 1, 2016, 9:07:14 PM (10 years ago)

Author:

msaboff@apple.com

Message:

Runaway WebContent process CPU & memory @ foxnews.com
​https://bugs.webkit.org/show_bug.cgi?id=158290

Reviewed by Mark Lam.

Clear the thrown value at the end of the catch block so that the stack scanner won't
find the value during GC.

Added a new stress test.

• bytecompiler/NodesCodegen.cpp:

(JSC::TryNode::emitBytecode):

• tests/stress/recursive-try-catch.js: Added.

(logError):
(tryCallingBadFunction):
(recurse):
(test):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecompiler/NodesCodegen.cpp (modified) (1 diff)
• tests/stress/recursive-try-catch.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-06-01  Michael Saboff  <msaboff@apple.com>
+
+        Runaway WebContent process CPU & memory @ foxnews.com
+        https://bugs.webkit.org/show_bug.cgi?id=158290
+
+        Reviewed by Mark Lam.
+
+        Clear the thrown value at the end of the catch block so that the stack scanner won't
+        find the value during GC.
+
+        Added a new stress test.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::TryNode::emitBytecode):
+        * tests/stress/recursive-try-catch.js: Added.
+        (logError):
+        (tryCallingBadFunction):
+        (recurse):
+        (test):
+
 2016-06-01  Benjamin Poulain  <bpoulain@apple.com>
 

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -3128 +3128 @@
         else
             generator.emitNodeInTailPosition(dst, m_catchBlock);
+        generator.emitLoad(thrownValueRegister.get(), jsUndefined());
         generator.emitPopCatchScope(m_lexicalVariables);
         generator.emitLabel(catchEndLabel.get());