Changeset 70673 in webkit

Timestamp:

Oct 27, 2010 10:59:57 AM (14 years ago)

Author:

ggaren@apple.com

Message:

JavaScriptCore: ​https://bugs.webkit.org/show_bug.cgi?id=41948
REGRESSION(r60392): Registerfile can be unwound too far following an exception

Reviewed by Oliver Hunt.

SunSpider reports no change.

• interpreter/Interpreter.cpp:

(JSC::Interpreter::throwException): Walk the stack to calculate the high
water mark currently in use. It's not safe to assume that the current
CallFrame's high water mark is the highest high water mark because
calls do not always set up at the end of a CallFrame. A large caller
CallFrame can encompass a small callee CallFrame.

• jit/JITOpcodes.cpp:

(JSC::JIT::privateCompileCTINativeCall):

• jit/JITOpcodes32_64.cpp:

(JSC::JIT::privateCompileCTINativeCall): Make sure to set a 0 CodeBlock
in the CallFrame of a host call, like the Interpreter does, instead of
leaving the CodeBlock field uninitialized. The backtracing code requires
a valid CodeBlock field in each CallFrame.

LayoutTests: Added a test for:

Reviewed by Oliver Hunt.

​https://bugs.webkit.org/show_bug.cgi?id=41948
REGRESSION(r60392): Registerfile can be unwound too far following an exception

• fast/js/exception-registerfile-shrink-expected.txt: Added.
• fast/js/exception-registerfile-shrink.html: Added.
• fast/js/script-tests/exception-registerfile-shrink.js: Added.

Location:

trunk

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/interpreter/Interpreter.cpp (modified) (3 diffs)
• JavaScriptCore/jit/JITOpcodes.cpp (modified) (1 diff)
• JavaScriptCore/jit/JITOpcodes32_64.cpp (modified) (2 diffs)
• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/exception-registerfile-shrink-expected.txt (added)
• LayoutTests/fast/js/exception-registerfile-shrink.html (added)
• LayoutTests/fast/js/script-tests/exception-registerfile-shrink.js (added)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2010-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+        REGRESSION(r60392): Registerfile can be unwound too far following an exception
+        
+        SunSpider reports no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Walk the stack to calculate the high
+        water mark currently in use. It's not safe to assume that the current
+        CallFrame's high water mark is the highest high water mark because
+        calls do not always set up at the end of a CallFrame. A large caller
+        CallFrame can encompass a small callee CallFrame.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::privateCompileCTINativeCall): Make sure to set a 0 CodeBlock
+        in the CallFrame of a host call, like the Interpreter does, instead of
+        leaving the CodeBlock field uninitialized. The backtracing code requires
+        a valid CodeBlock field in each CallFrame.
+
 2010-10-27  Gabor Loki  <loki@webkit.org>
 

trunk/JavaScriptCore/interpreter/Interpreter.cpp

@@ -677 +677 @@
 
     // Shrink the JS stack, in case stack overflow made it huge.
-    m_registerFile.shrink(callFrame->registers() + callFrame->codeBlock()->m_numCalleeRegisters);
+    Register* highWaterMark = 0;
+    for (CallFrame* callerFrame = callFrame; callerFrame; callerFrame = callerFrame->callerFrame()->removeHostCallFrameFlag()) {
+        CodeBlock* codeBlock = callerFrame->codeBlock();
+        if (!codeBlock)
+            continue;
+        Register* callerHighWaterMark = callerFrame->registers() + codeBlock->m_numCalleeRegisters;
+        highWaterMark = max(highWaterMark, callerHighWaterMark);
+    }
+    m_registerFile.shrink(highWaterMark);
 
     // Unwind the scope chain within the exception handler's call frame.
@@ -1002 +1010 @@
         return CallFrameClosure();
     }
-    // a 0 codeBlock indicates a built-in caller
     newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), argc, function);  
     CallFrameClosure result = { callFrame, newCallFrame, function, FunctionExecutable, scopeChain->globalData, oldEnd, scopeChain, codeBlock->m_numParameters, argc };
@@ -1122 +1129 @@
     CallFrame* newCallFrame = CallFrame::create(m_registerFile.start() + globalRegisterOffset);
 
-    // a 0 codeBlock indicates a built-in caller
     ASSERT(codeBlock->m_numParameters == 1); // 1 parameter for 'this'.
     newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), codeBlock->m_numParameters, 0);

trunk/JavaScriptCore/jit/JITOpcodes.cpp

@@ -199 +199 @@
 
     Label nativeCallThunk = align();
+    
+    emitPutImmediateToCallFrameHeader(0, RegisterFile::CodeBlock);
 
 #if CPU(X86_64)

trunk/JavaScriptCore/jit/JITOpcodes32_64.cpp

@@ -199 +199 @@
     Label nativeCallThunk = align();
 
+    emitPutImmediateToCallFrameHeader(0, RegisterFile::CodeBlock);
+
 #if CPU(X86)
     // Load caller frame's scope chain into this callframe so that whatever we call can
@@ -312 +314 @@
     Call nativeCall;
     Label nativeCallThunk = align();
+
+    emitPutImmediateToCallFrameHeader(0, RegisterFile::CodeBlock);
 
 #if CPU(X86)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added a test for:
+
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+        REGRESSION(r60392): Registerfile can be unwound too far following an exception
+
+        * fast/js/exception-registerfile-shrink-expected.txt: Added.
+        * fast/js/exception-registerfile-shrink.html: Added.
+        * fast/js/script-tests/exception-registerfile-shrink.js: Added.
+
 2010-10-27  Ryosuke Niwa  <rniwa@webkit.org>