Changeset 195502 in webkit

Timestamp:

Jan 22, 2016 6:10:17 PM (8 years ago)

Author:

sbarati@apple.com

Message:

genericUnwind might overflow the instructions() vector when catching an FTL exception
​https://bugs.webkit.org/show_bug.cgi?id=153383

Reviewed by Benjamin Poulain.

• jit/JITExceptions.cpp:

(JSC::genericUnwind):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• jit/JITExceptions.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-01-22  Saam barati  <sbarati@apple.com>
+
+        genericUnwind might overflow the instructions() vector when catching an FTL exception
+        https://bugs.webkit.org/show_bug.cgi?id=153383
+
+        Reviewed by Benjamin Poulain.
+
+        * jit/JITExceptions.cpp:
+        (JSC::genericUnwind):
+
 2016-01-22  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/jit/JITExceptions.cpp

@@ -59 +59 @@
     if (handler) {
         // handler->target is meaningless for getting a code offset when catching
-        // the exception in a DFG frame. This bytecode target offset could be
+        // the exception in a DFG/FTL frame. This bytecode target offset could be
         // something that's in an inlined frame, which means an array access
         // with this bytecode offset in the machine frame is utterly meaningless
         // and can cause an overflow. OSR exit properly exits to handler->target
         // in the proper frame.
-        if (callFrame->codeBlock()->jitType() != JITCode::DFGJIT)
+        if (!JITCode::isOptimizingJIT(callFrame->codeBlock()->jitType()))
             catchPCForInterpreter = &callFrame->codeBlock()->instructions()[handler->target];
 #if ENABLE(JIT)