Changeset 206643 in webkit

Timestamp:

Sep 30, 2016 11:15:38 AM (8 years ago)

Author:

mark.lam@apple.com

Message:

Use topVMEntryFrame to determine whether to skip the re-throw of a simulated throw.
​https://bugs.webkit.org/show_bug.cgi?id=162793

Reviewed by Saam Barati.

Change the ThrowScope destructor to use topVMEntryFrame (instead of topCallFrame)
in the determination of whether to skip the re-throw of a simulated throw. This
is needed because the topCallFrame is not updated in operationConstructArityCheck()
(and does not need to be), whereas topVMEntryFrame is always updated properly.
Hence, we should just switch to using the more reliable topVMEntryFrame instead.

This issue was discovered by existing JSC tests when exception check validation
is enabled.

• runtime/ThrowScope.cpp:

(JSC::ThrowScope::~ThrowScope):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/ThrowScope.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-09-30  Mark Lam  <mark.lam@apple.com>
+
+        Use topVMEntryFrame to determine whether to skip the re-throw of a simulated throw.
+        https://bugs.webkit.org/show_bug.cgi?id=162793
+
+        Reviewed by Saam Barati.
+
+        Change the ThrowScope destructor to use topVMEntryFrame (instead of topCallFrame)
+        in the determination of whether to skip the re-throw of a simulated throw.  This
+        is needed because the topCallFrame is not updated in operationConstructArityCheck()
+        (and does not need to be), whereas topVMEntryFrame is always updated properly.
+        Hence, we should just switch to using the more reliable topVMEntryFrame instead.
+
+        This issue was discovered by existing JSC tests when exception check validation
+        is enabled.
+
+        * runtime/ThrowScope.cpp:
+        (JSC::ThrowScope::~ThrowScope):
+
 2016-09-30  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/runtime/ThrowScope.cpp

@@ -58 +58 @@
     bool willBeHandleByLLIntOrJIT = false;
     void* previousScope = m_previousScope;
-    void* topCallFrame = m_vm.topCallFrame;
-    
-    // If the topCallFrame was pushed on the stack after the previousScope was instantiated,
+    void* topVMEntryFrame = m_vm.topVMEntryFrame;
+
+    // If the topVMEntryFrame was pushed on the stack after the previousScope was instantiated,
     // then this throwScope will be returning to LLINT or JIT code that always do an exception
     // check. In that case, skip the simulated throw because the LLInt and JIT will be
     // checking for the exception their own way instead of calling ThrowScope::exception().
-    if (topCallFrame && previousScope > topCallFrame)
+    if (topVMEntryFrame && previousScope > topVMEntryFrame)
         willBeHandleByLLIntOrJIT = true;