2008-06-23 Cameron Zwarich <cwzwarich@uwaterloo.ca>

        Reviewed by Oliver.

        Bug 19716: REGRESSION (SquirrelFish): Reproducible crash after entering a username at mint.com
        <https://bugs.webkit.org/show_bug.cgi?id=19716>

        When unwinding callframes for exceptions, check whether the callframe
        was created by a reentrant native call to JavaScript after tearing off
        the local variables instead of before.

        JavaScriptCore:

        * VM/Machine.cpp:
        (KJS::Machine::unwindCallFrame):

        LayoutTests:

        * fast/js/reentrant-call-unwind-expected.txt: Added.
        * fast/js/reentrant-call-unwind.html: Added.
        * fast/js/resources/reentrant-call-unwind.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34751 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 2f82503de06091bd49a6b9115007bbe02cf90f28..963f4f852d27334290c3fc2cd819f196bdc3e395 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,17 @@
+2008-06-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Bug 19716: REGRESSION (SquirrelFish): Reproducible crash after entering a username at mint.com
+        <https://bugs.webkit.org/show_bug.cgi?id=19716>
+
+        When unwinding callframes for exceptions, check whether the callframe
+        was created by a reentrant native call to JavaScript after tearing off
+        the local variables instead of before.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::unwindCallFrame):
+
 2008-06-23  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Oliver Hunt.

diff --git a/JavaScriptCore/VM/Machine.cpp b/JavaScriptCore/VM/Machine.cpp
index 3f73568926108a4182eb2bda458a628fe210472e..7e3436786df62d13970382bd59fc19dbc6be6c9d 100644 (file)
--- a/JavaScriptCore/VM/Machine.cpp
+++ b/JavaScriptCore/VM/Machine.cpp
@@ -575,16 +575,16 @@ NEVER_INLINE bool Machine::unwindCallFrame(ExecState* exec, JSValue* exceptionVa
 
     if (isGlobalCallFrame(registerBase, r))
         return false;
-
-    codeBlock = callFrame[CallerCodeBlock].u.codeBlock;
-    if (!codeBlock)
-        return false;
-
+    
     // If this call frame created an activation, tear it off.
     if (JSActivation* activation = static_cast<JSActivation*>(callFrame[OptionalCalleeActivation].u.jsValue)) {
         ASSERT(activation->isActivationObject());
         activation->copyRegisters();
     }
+    
+    codeBlock = callFrame[CallerCodeBlock].u.codeBlock;
+    if (!codeBlock)
+        return false;
 
     k = codeBlock->jsValues.data();
     scopeChain = callFrame[CallerScopeChain].u.scopeChain;

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index c4414e91741051b0b531db101d499fd1709436af..b6dc2247b6a57d28c5b2b441e4ae68695afebf2f 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2008-06-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Tests for:
+
+        Bug 19716: REGRESSION (SquirrelFish): Reproducible crash after entering a username at mint.com
+        <https://bugs.webkit.org/show_bug.cgi?id=19716>
+
+        * fast/js/reentrant-call-unwind-expected.txt: Added.
+        * fast/js/reentrant-call-unwind.html: Added.
+        * fast/js/resources/reentrant-call-unwind.js: Added.
+
 2008-06-23  David Kilzer  <ddkilzer@apple.com>
 
         Updated test for Bug 15823: getPropertyValue for border returns null, should compute the shorthand value

diff --git a/LayoutTests/fast/js/reentrant-call-unwind-expected.txt b/LayoutTests/fast/js/reentrant-call-unwind-expected.txt
new file mode 100644 (file)
index 0000000..08a5b95
--- /dev/null
+++ b/LayoutTests/fast/js/reentrant-call-unwind-expected.txt
@@ -0,0 +1,10 @@
+This test checks that unwinding of exceptions properly copies registers of activation frames created by reentrant calls to JavaScript.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS f() is 0
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

diff --git a/LayoutTests/fast/js/reentrant-call-unwind.html b/LayoutTests/fast/js/reentrant-call-unwind.html
new file mode 100644 (file)
index 0000000..57c4e20
--- /dev/null
+++ b/LayoutTests/fast/js/reentrant-call-unwind.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="resources/js-test-style.css">
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="resources/reentrant-call-unwind.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>

diff --git a/LayoutTests/fast/js/resources/reentrant-call-unwind.js b/LayoutTests/fast/js/resources/reentrant-call-unwind.js
new file mode 100644 (file)
index 0000000..ebb02b1
--- /dev/null
+++ b/LayoutTests/fast/js/resources/reentrant-call-unwind.js
@@ -0,0 +1,19 @@
+description(
+"This test checks that unwinding of exceptions properly copies registers of activation frames created by reentrant calls to JavaScript."
+);
+
+var f;
+
+try {
+    (function() {
+        var j = 0;
+        f = function() { return j; };
+        throw new Object();
+    }).apply();
+} catch (e) {
+    (function() {
+        shouldBe("f()", "0");
+    }).apply();
+}
+
+var successfullyParsed = true;