ShadowChicken crashes with stack overflow in the LLInt
https://bugs.webkit.org/show_bug.cgi?id=186540
<rdar://problem/
39682133>
Patch by Tadeu Zagallo <tzagallo@apple.com> on 2018-06-19
Reviewed by Saam Barati.
JSTests:
Add test that stack overflows and crashes on ShadowChicken when JIT is
disabled and forceDebuggerBytecodeGeneration is enabled.
* stress/llint-stack-overflow-debugging-opcodes.js: Added.
(foo):
(catch):
Source/JavaScriptCore:
Stack overflows in the LLInt were crashing in ShadowChicken when compiling
with debug opcodes because it was accessing the scope of the incomplete top
frame, which hadn't been set yet. Check that we have moved past the first
opcode (enter) and that the scope is not undefined (enter will
initialize it to undefined).
* interpreter/ShadowChicken.cpp:
(JSC::ShadowChicken::update):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232983
268f45cc-cd09-0410-ab3c-
d52691b4dbfc