Title: [249577] trunk
Revision
249577
Author
ryanhad...@apple.com
Date
2019-09-06 10:03:28 -0700 (Fri, 06 Sep 2019)

Log Message

Unreviewed, rolling out r249566.

Causes inspector layout test crashes under GuardMalloc

Reverted changeset:

"Tail Deleted Frames shown in Web Inspector are sometimes
incorrect (Shadow Chicken)"
https://bugs.webkit.org/show_bug.cgi?id=201366
https://trac.webkit.org/changeset/249566

Modified Paths

Added Paths

Removed Paths

  • trunk/LayoutTests/inspector/debugger/tail-deleted-frames/

Diff

Modified: trunk/LayoutTests/ChangeLog (249576 => 249577)


--- trunk/LayoutTests/ChangeLog	2019-09-06 16:56:21 UTC (rev 249576)
+++ trunk/LayoutTests/ChangeLog	2019-09-06 17:03:28 UTC (rev 249577)
@@ -1,3 +1,16 @@
+2019-09-06  Ryan Haddad  <ryanhad...@apple.com>
+
+        Unreviewed, rolling out r249566.
+
+        Causes inspector layout test crashes under GuardMalloc
+
+        Reverted changeset:
+
+        "Tail Deleted Frames shown in Web Inspector are sometimes
+        incorrect (Shadow Chicken)"
+        https://bugs.webkit.org/show_bug.cgi?id=201366
+        https://trac.webkit.org/changeset/249566
+
 2019-09-06  Rob Buis  <rb...@igalia.com>
 
         Implement MathML DOM

Modified: trunk/LayoutTests/inspector/debugger/evaluateOnCallFrame-exception.html (249576 => 249577)


--- trunk/LayoutTests/inspector/debugger/evaluateOnCallFrame-exception.html	2019-09-06 16:56:21 UTC (rev 249576)
+++ trunk/LayoutTests/inspector/debugger/evaluateOnCallFrame-exception.html	2019-09-06 17:03:28 UTC (rev 249577)
@@ -13,6 +13,7 @@
     const includeCommandLineAPI = true;
     const returnByValue = true;
 
+    InspectorTest.debug();
     let suite = InspectorTest.createAsyncSuite("Debugger.evaluateOnCallFrame.Exception");
 
     suite.addTestCase({

Copied: trunk/LayoutTests/inspector/debugger/resources/tail-deleted-frames-from-vm-entry.js (from rev 249576, trunk/LayoutTests/inspector/debugger/tail-deleted-frames/resources/tail-deleted-frames-vm-entry.js) (0 => 249577)


--- trunk/LayoutTests/inspector/debugger/resources/tail-deleted-frames-from-vm-entry.js	                        (rev 0)
+++ trunk/LayoutTests/inspector/debugger/resources/tail-deleted-frames-from-vm-entry.js	2019-09-06 17:03:28 UTC (rev 249577)
@@ -0,0 +1,9 @@
+"use strict";
+function timeout(foo = 25) {
+    return bar();
+}
+function bar(i = 9) {
+    if (i > 0)
+        return bar(i - 1);
+    return 25;
+}

Copied: trunk/LayoutTests/inspector/debugger/resources/tail-deleted-frames.js (from rev 249576, trunk/LayoutTests/inspector/debugger/tail-deleted-frames/resources/tail-deleted-frames-scopes.js) (0 => 249577)


--- trunk/LayoutTests/inspector/debugger/resources/tail-deleted-frames.js	                        (rev 0)
+++ trunk/LayoutTests/inspector/debugger/resources/tail-deleted-frames.js	2019-09-06 17:03:28 UTC (rev 249577)
@@ -0,0 +1,17 @@
+"use strict";
+function a() {
+    let x = 20;
+    x;
+    return x;
+}
+function b() {
+    let y = 40;
+    return a();
+}
+function c() {
+    let z = 60;
+    return b(); 
+}
+function startABC() {
+    c();
+}

Added: trunk/LayoutTests/inspector/debugger/tail-deleted-frames-expected.txt (0 => 249577)


--- trunk/LayoutTests/inspector/debugger/tail-deleted-frames-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/inspector/debugger/tail-deleted-frames-expected.txt	2019-09-06 17:03:28 UTC (rev 249577)
@@ -0,0 +1,19 @@
+Testing that we keep around tail deleted frames in the inspector.
+
+Starting Test
+
+
+------------------------------------
+Hit breakpoint at line: 3, column: 4
+------------------------------------
+Expected frame: {"functionName":"a","scope":["x",20],"isTailDeleted":false}
+Expected frame: {"functionName":"b","scope":["y",40],"isTailDeleted":true}
+Expected frame: {"functionName":"c","scope":["z",60],"isTailDeleted":true}
+Looking at frame number: 0
+    variable 'x': {"_type":"number","_description":"20","_hasChildren":false,"_value":20}
+Looking at frame number: 1
+    variable 'y': {"_type":"number","_description":"40","_hasChildren":false,"_value":40}
+Looking at frame number: 2
+    variable 'z': {"_type":"number","_description":"60","_hasChildren":false,"_value":60}
+Tests done
+

Added: trunk/LayoutTests/inspector/debugger/tail-deleted-frames-from-vm-entry-expected.txt (0 => 249577)


--- trunk/LayoutTests/inspector/debugger/tail-deleted-frames-from-vm-entry-expected.txt	                        (rev 0)
+++ trunk/LayoutTests/inspector/debugger/tail-deleted-frames-from-vm-entry-expected.txt	2019-09-06 17:03:28 UTC (rev 249577)
@@ -0,0 +1,98 @@
+Testing that we keep around tail deleted frames that are entry frames.
+
+Starting Test
+
+
+------------------------------------
+Hit breakpoint at line: 7, column: 4
+------------------------------------
+Expected frame: {"functionName":"bar","scope":["i",0],"isTailDeleted":false}
+PASS: Function name: bar is correct.
+PASS: Tail deleted expectation correct: false
+Expected frame: {"functionName":"bar","scope":["i",1],"isTailDeleted":true}
+PASS: Function name: bar is correct.
+PASS: Tail deleted expectation correct: true
+Expected frame: {"functionName":"bar","scope":["i",2],"isTailDeleted":true}
+PASS: Function name: bar is correct.
+PASS: Tail deleted expectation correct: true
+Expected frame: {"functionName":"bar","scope":["i",3],"isTailDeleted":true}
+PASS: Function name: bar is correct.
+PASS: Tail deleted expectation correct: true
+Expected frame: {"functionName":"bar","scope":["i",4],"isTailDeleted":true}
+PASS: Function name: bar is correct.
+PASS: Tail deleted expectation correct: true
+Expected frame: {"functionName":"bar","scope":["i",5],"isTailDeleted":true}
+PASS: Function name: bar is correct.
+PASS: Tail deleted expectation correct: true
+Expected frame: {"functionName":"bar","scope":["i",6],"isTailDeleted":true}
+PASS: Function name: bar is correct.
+PASS: Tail deleted expectation correct: true
+Expected frame: {"functionName":"bar","scope":["i",7],"isTailDeleted":true}
+PASS: Function name: bar is correct.
+PASS: Tail deleted expectation correct: true
+Expected frame: {"functionName":"bar","scope":["i",8],"isTailDeleted":true}
+PASS: Function name: bar is correct.
+PASS: Tail deleted expectation correct: true
+Expected frame: {"functionName":"bar","scope":["i",9],"isTailDeleted":true}
+PASS: Function name: bar is correct.
+PASS: Tail deleted expectation correct: true
+Expected frame: {"functionName":"timeout","scope":["foo",25],"isTailDeleted":true}
+PASS: Function name: timeout is correct.
+PASS: Tail deleted expectation correct: true
+Looking at frame number: 0
+    variable 'i': {"_type":"number","_description":"0","_hasChildren":false,"_value":0}
+PASS: Variable is a number.
+PASS: Found scope value: 0
+PASS: Did not find variable we were looking for: i
+Looking at frame number: 1
+    variable 'i': {"_type":"number","_description":"1","_hasChildren":false,"_value":1}
+PASS: Variable is a number.
+PASS: Found scope value: 1
+PASS: Did not find variable we were looking for: i
+Looking at frame number: 2
+    variable 'i': {"_type":"number","_description":"2","_hasChildren":false,"_value":2}
+PASS: Variable is a number.
+PASS: Found scope value: 2
+PASS: Did not find variable we were looking for: i
+Looking at frame number: 3
+    variable 'i': {"_type":"number","_description":"3","_hasChildren":false,"_value":3}
+PASS: Variable is a number.
+PASS: Found scope value: 3
+PASS: Did not find variable we were looking for: i
+Looking at frame number: 4
+    variable 'i': {"_type":"number","_description":"4","_hasChildren":false,"_value":4}
+PASS: Variable is a number.
+PASS: Found scope value: 4
+PASS: Did not find variable we were looking for: i
+Looking at frame number: 5
+    variable 'i': {"_type":"number","_description":"5","_hasChildren":false,"_value":5}
+PASS: Variable is a number.
+PASS: Found scope value: 5
+PASS: Did not find variable we were looking for: i
+Looking at frame number: 6
+    variable 'i': {"_type":"number","_description":"6","_hasChildren":false,"_value":6}
+PASS: Variable is a number.
+PASS: Found scope value: 6
+PASS: Did not find variable we were looking for: i
+Looking at frame number: 7
+    variable 'i': {"_type":"number","_description":"7","_hasChildren":false,"_value":7}
+PASS: Variable is a number.
+PASS: Found scope value: 7
+PASS: Did not find variable we were looking for: i
+Looking at frame number: 8
+    variable 'i': {"_type":"number","_description":"8","_hasChildren":false,"_value":8}
+PASS: Variable is a number.
+PASS: Found scope value: 8
+PASS: Did not find variable we were looking for: i
+Looking at frame number: 9
+    variable 'i': {"_type":"number","_description":"9","_hasChildren":false,"_value":9}
+PASS: Variable is a number.
+PASS: Found scope value: 9
+PASS: Did not find variable we were looking for: i
+Looking at frame number: 10
+    variable 'foo': {"_type":"number","_description":"25","_hasChildren":false,"_value":25}
+PASS: Variable is a number.
+PASS: Found scope value: 25
+PASS: Did not find variable we were looking for: foo
+Tests done
+

Added: trunk/LayoutTests/inspector/debugger/tail-deleted-frames-from-vm-entry.html (0 => 249577)


--- trunk/LayoutTests/inspector/debugger/tail-deleted-frames-from-vm-entry.html	                        (rev 0)
+++ trunk/LayoutTests/inspector/debugger/tail-deleted-frames-from-vm-entry.html	2019-09-06 17:03:28 UTC (rev 249577)
@@ -0,0 +1,105 @@
+<!doctype html>
+<html>
+<head>
+<script src=""
+<script src=""
+<script src=""
+<script>
+
+function test()
+{
+    let scriptObject;
+
+    function remoteObjectJSONFilter(key, value) {
+        if (key === "_target" || key === "_listeners")
+            return undefined;
+        if (key === "_objectId" || key === "_stackTrace")
+            return "<filtered>";
+        return value;
+    }
+
+    function startTest() {
+        InspectorTest.log("Starting Test");
+        // 0 based indices.
+        let testInfo = {line: 7, column: 4};
+        let location = scriptObject.createSourceCodeLocation(testInfo.line, testInfo.column);
+        let breakpoint = new WI.Breakpoint(location);
+        WI.debuggerManager.addBreakpoint(breakpoint);
+        InspectorTest.evaluateInPage("setTimeout(timeout, 0);");
+    }
+
+    WI.debuggerManager.addEventListener(WI.DebuggerManager.Event.CallFramesDidChange, function(event) {
+        var activeCallFrame = WI.debuggerManager.activeCallFrame;
+
+        if (!activeCallFrame)
+            return;
+
+        var stopLocation = "line: " + activeCallFrame.sourceCodeLocation.lineNumber + ", column: " + activeCallFrame.sourceCodeLocation.columnNumber;
+
+        InspectorTest.log("\n\n------------------------------------");
+        InspectorTest.log("Hit breakpoint at " + stopLocation);
+        InspectorTest.log("------------------------------------");
+
+        // top down list
+        let expectedFrames = [];
+        for (let i = 0; i < 10; i++)
+            expectedFrames.push({functionName: 'bar', scope: ['i', i], isTailDeleted: i > 0 ? true : false});
+        expectedFrames.push({functionName: 'timeout', scope: ['foo', 25], isTailDeleted: true});
+
+        let targetData = WI.debuggerManager.dataForTarget(WI.debuggerManager.activeCallFrame.target);
+        let callFrames = targetData.callFrames;
+
+        InspectorTest.assert(callFrames.length >= expectedFrames.length);
+
+        for (let i = 0; i < expectedFrames.length; i++) {
+            let callFrame = callFrames[i];
+            let expectedFrame = expectedFrames[i];
+            InspectorTest.log("Expected frame: " + JSON.stringify(expectedFrame));
+            InspectorTest.expectThat(callFrame.functionName === expectedFrame.functionName, `Function name: ${callFrame.functionName} is correct.`);
+
+            InspectorTest.expectThat(callFrame.isTailDeleted === expectedFrame.isTailDeleted, `Tail deleted expectation correct: ${callFrame.isTailDeleted}`);
+            let scope = callFrame.scopeChain[1];
+
+            scope.objects[0].getPropertyDescriptors(function(properties) {
+                let found = false;
+                let variableName = expectedFrame.scope[0];
+                let variableValue = expectedFrame.scope[1];
+                for (let propertyDescriptor of properties) {
+                    if (propertyDescriptor.name === variableName) {
+                        found = true;
+                        InspectorTest.log("Looking at frame number: " + i);
+                        InspectorTest.log(`    variable '${variableName}': ${JSON.stringify(propertyDescriptor.value, remoteObjectJSONFilter)}`);
+                        InspectorTest.expectThat(propertyDescriptor.value.type === 'number', "Variable is a number.");
+                        InspectorTest.expectThat(propertyDescriptor.value.value === variableValue, `Found scope value: ${variableValue}`);
+                    }
+                }
+                InspectorTest.expectThat(!!found, `Did not find variable we were looking for: ${variableName}`);
+            });
+        }
+
+        WI.debuggerManager.resume();
+    });
+
+    WI.debuggerManager.addEventListener(WI.DebuggerManager.Event.Resumed, function(event) {
+        InspectorTest.log("Tests done");
+        InspectorTest.completeTest();
+    });
+
+    WI.debuggerManager.addEventListener(WI.DebuggerManager.Event.ScriptAdded, function(event) {
+        let eventScriptObject = event.data.script;
+        if (/tail-deleted-frames-from-vm-entry\.js$/.test(eventScriptObject.url)) {
+            scriptObject = eventScriptObject;
+            startTest();
+            return;
+        }
+
+    });
+
+    InspectorTest.reloadPage();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+    <p>Testing that we keep around tail deleted frames that are entry frames. </p>
+</body>
+</html>

Added: trunk/LayoutTests/inspector/debugger/tail-deleted-frames.html (0 => 249577)


--- trunk/LayoutTests/inspector/debugger/tail-deleted-frames.html	                        (rev 0)
+++ trunk/LayoutTests/inspector/debugger/tail-deleted-frames.html	2019-09-06 17:03:28 UTC (rev 249577)
@@ -0,0 +1,107 @@
+<!doctype html>
+<html>
+<head>
+<script src=""
+<script src=""
+<script src=""
+<script>
+
+function test()
+{
+    var scriptObject;
+
+    function remoteObjectJSONFilter(key, value) {
+        if (key === "_target" || key === "_listeners")
+            return undefined;
+        if (key === "_objectId" || key === "_stackTrace")
+            return "<filtered>";
+        return value;
+    }
+
+    function startTest() {
+        InspectorTest.log("Starting Test");
+        // 0 based indices.
+        let testInfo = {line: 3, column: 4};
+        let location = scriptObject.createSourceCodeLocation(testInfo.line, testInfo.column);
+        let breakpoint = new WI.Breakpoint(location);
+        WI.debuggerManager.addBreakpoint(breakpoint);
+        InspectorTest.evaluateInPage("startABC()");
+    }
+
+    WI.debuggerManager.addEventListener(WI.DebuggerManager.Event.CallFramesDidChange, function(event) {
+        var activeCallFrame = WI.debuggerManager.activeCallFrame;
+
+        if (!activeCallFrame)
+            return;
+
+        var stopLocation = "line: " + activeCallFrame.sourceCodeLocation.lineNumber + ", column: " + activeCallFrame.sourceCodeLocation.columnNumber;
+
+        InspectorTest.log("\n\n------------------------------------");
+        InspectorTest.log("Hit breakpoint at " + stopLocation);
+        InspectorTest.log("------------------------------------");
+
+        // top down list
+        let expectedFrames = [
+            {functionName: 'a', scope: ['x', 20], isTailDeleted: false},
+            {functionName: 'b', scope: ['y', 40], isTailDeleted: true},
+            {functionName: 'c', scope: ['z', 60], isTailDeleted: true}
+        ];
+
+        let targetData = WI.debuggerManager.dataForTarget(WI.debuggerManager.activeCallFrame.target);
+        let callFrames = targetData.callFrames;
+
+        InspectorTest.assert(callFrames.length >= expectedFrames.length);
+
+        for (let i = 0; i < expectedFrames.length; i++) {
+            let callFrame = callFrames[i];
+            let expectedFrame = expectedFrames[i];
+            InspectorTest.log("Expected frame: " + JSON.stringify(expectedFrame));
+            InspectorTest.assert(callFrame.functionName === expectedFrame.functionName);
+
+            InspectorTest.assert(callFrame.isTailDeleted === expectedFrame.isTailDeleted);
+            let topScope = callFrame.scopeChain[0];
+
+            topScope.objects[0].getPropertyDescriptors(function(properties) {
+                let found = false;
+                let variableName = expectedFrame.scope[0];
+                let variableValue = expectedFrame.scope[1];
+                for (let propertyDescriptor of properties) {
+                    if (propertyDescriptor.name === variableName) {
+                        found = true;
+                        InspectorTest.log("Looking at frame number: " + i);
+                        InspectorTest.log(`    variable '${variableName}': ${JSON.stringify(propertyDescriptor.value, remoteObjectJSONFilter)}`);
+                        InspectorTest.assert(propertyDescriptor.value.type === 'number');
+                        InspectorTest.assert(propertyDescriptor.value.value === variableValue);
+                    }
+                }
+                InspectorTest.assert(found);
+            });
+        }
+
+        WI.debuggerManager.resume();
+    });
+
+    WI.debuggerManager.addEventListener(WI.DebuggerManager.Event.Resumed, function(event) {
+        InspectorTest.log("Tests done");
+        InspectorTest.completeTest();
+    });
+
+    WI.debuggerManager.addEventListener(WI.DebuggerManager.Event.ScriptAdded, function(event) {
+        eventScriptObject = event.data.script;
+        
+        if (/tail-deleted-frames\.js$/.test(eventScriptObject.url)) {
+            scriptObject = eventScriptObject;
+            startTest();
+            return;
+        }
+
+    });
+
+    InspectorTest.reloadPage();
+}
+</script>
+</head>
+<body _onload_="runTest()">
+    <p>Testing that we keep around tail deleted frames in the inspector. </p>
+</body>
+</html>

Modified: trunk/LayoutTests/platform/mac/TestExpectations (249576 => 249577)


--- trunk/LayoutTests/platform/mac/TestExpectations	2019-09-06 16:56:21 UTC (rev 249576)
+++ trunk/LayoutTests/platform/mac/TestExpectations	2019-09-06 17:03:28 UTC (rev 249577)
@@ -1059,7 +1059,8 @@
 webkit.org/b/161951 [ Release ] inspector/debugger/breakpoints/resolved-dump-each-line.html [ Pass Timeout ]
 webkit.org/b/167711 [ Debug ] inspector/debugger/probe-manager-add-remove-actions.html [ Slow ]
 webkit.org/b/168399 [ Debug ] inspector/debugger/search-scripts.html [ Pass Timeout ]
-webkit.org/b/181952 [ Debug ] inspector/debugger/tail-deleted-frames/tail-deleted-frames-vm-entry.html [ Slow ]
+webkit.org/b/181952 [ Debug ] inspector/debugger/tail-deleted-frames-from-vm-entry.html [ Slow ]
+webkit.org/b/169119 [ Debug ] inspector/debugger/tail-deleted-frames-this-value.html [ Pass Timeout ]
 webkit.org/b/168387 [ Debug ] inspector/debugger/tail-recursion.html [ Pass Timeout ]
 webkit.org/b/170127 inspector/dom-debugger/dom-breakpoints.html [ Pass Timeout ]
 webkit.org/b/148636 inspector/dom/getAccessibilityPropertiesForNode.html [ Pass Timeout ]

Modified: trunk/Source/_javascript_Core/ChangeLog (249576 => 249577)


--- trunk/Source/_javascript_Core/ChangeLog	2019-09-06 16:56:21 UTC (rev 249576)
+++ trunk/Source/_javascript_Core/ChangeLog	2019-09-06 17:03:28 UTC (rev 249577)
@@ -1,3 +1,16 @@
+2019-09-06  Ryan Haddad  <ryanhad...@apple.com>
+
+        Unreviewed, rolling out r249566.
+
+        Causes inspector layout test crashes under GuardMalloc
+
+        Reverted changeset:
+
+        "Tail Deleted Frames shown in Web Inspector are sometimes
+        incorrect (Shadow Chicken)"
+        https://bugs.webkit.org/show_bug.cgi?id=201366
+        https://trac.webkit.org/changeset/249566
+
 2019-09-06  Guillaume Emont  <guijem...@igalia.com>
 
         testmasm: save r6 in JIT'ed code on ARM_THUMB2

Modified: trunk/Source/_javascript_Core/interpreter/ShadowChicken.cpp (249576 => 249577)


--- trunk/Source/_javascript_Core/interpreter/ShadowChicken.cpp	2019-09-06 16:56:21 UTC (rev 249576)
+++ trunk/Source/_javascript_Core/interpreter/ShadowChicken.cpp	2019-09-06 17:03:28 UTC (rev 249577)
@@ -45,16 +45,9 @@
     }
     
     if (isPrologue()) {
-        String name = "?"_s;
-        if (auto* function = jsDynamicCast<JSFunction*>(callee->vm(), callee)) {
-            name = function->name(callee->vm());
-            if (name.isEmpty())
-                name = "?"_s;
-        }
-
         out.print(
             "{callee = ", RawPointer(callee), ", frame = ", RawPointer(frame), ", callerFrame = ",
-            RawPointer(callerFrame), ", name = ", name, "}");
+            RawPointer(callerFrame), "}");
         return;
     }
     
@@ -69,27 +62,15 @@
 
 void ShadowChicken::Frame::dump(PrintStream& out) const
 {
-    String name = "?"_s;
-    if (auto* function = jsDynamicCast<JSFunction*>(callee->vm(), callee)) {
-        name = function->name(callee->vm());
-        if (name.isEmpty())
-            name = "?"_s;
-    }
-
     out.print(
-        "{callee = ", *callee, ", frame = ", RawPointer(frame), ", isTailDeleted = ",
-        isTailDeleted, ", name = ", name, "}");
+        "{callee = ", RawPointer(callee), ", frame = ", RawPointer(frame), ", isTailDeleted = ",
+        isTailDeleted, "}");
 }
 
 ShadowChicken::ShadowChicken()
     : m_logSize(Options::shadowChickenLogSize())
 {
-    // Allow one additional packet beyond m_logEnd. This is useful for the moment we
-    // log a packet when the log is full and force an update. At that moment the packet
-    // that is being logged should be included in the update because it may be
-    // a critical prologue needed to rationalize the current machine stack with the
-    // shadow stack.
-    m_log = static_cast<Packet*>(fastZeroedMalloc(sizeof(Packet) * m_logSize + 1));
+    m_log = static_cast<Packet*>(fastZeroedMalloc(sizeof(Packet) * m_logSize));
     m_logCursor = m_log;
     m_logEnd = m_log + m_logSize;
 }
@@ -101,9 +82,8 @@
 
 void ShadowChicken::log(VM& vm, ExecState* exec, const Packet& packet)
 {
-    // This write is allowed because we construct the log with space for 1 additional packet.
+    update(vm, exec);
     *m_logCursor++ = packet;
-    update(vm, exec);
 }
 
 void ShadowChicken::update(VM& vm, ExecState* exec)
@@ -162,6 +142,7 @@
         }
     }
 
+    
     if (ShadowChickenInternal::verbose)
         dataLog("    Revised stack: ", listDump(m_stack), "\n");
     
@@ -307,21 +288,11 @@
             }
 
             CallFrame* callFrame = visitor->callFrame();
-            if (ShadowChickenInternal::verbose) {
-                dataLog("    Examining callFrame:", RawPointer(callFrame), ", callee:", RawPointer(callFrame->jsCallee()), ", callerFrame:", RawPointer(callFrame->callerFrame()), "\n");
-                JSObject* callee = callFrame->jsCallee();
-                if (auto* function = jsDynamicCast<JSFunction*>(callee->vm(), callee))
-                    dataLog("      Function = ", function->name(callee->vm()), "\n");
-            }
-
+            if (ShadowChickenInternal::verbose)
+                dataLog("    Examining ", RawPointer(callFrame), "\n");
             if (callFrame == highestPointSinceLastTime) {
                 if (ShadowChickenInternal::verbose)
-                    dataLog("    Bailing at ", RawPointer(callFrame), " because it's the highest point since last time\n");
-
-                // FIXME: At this point the shadow stack may still have tail deleted frames
-                // that do not run into the current call frame but are left in the shadow stack.
-                // Those tail deleted frames should be validated somehow.
-
+                    dataLog("    Bailing at ", RawPointer(callFrame), " because it's the highest point since last time.\n");
                 return StackVisitor::Done;
             }
 
@@ -347,7 +318,7 @@
                 // anything.
                 && m_log[indexInLog].frame == toPush.last().frame) {
                 if (ShadowChickenInternal::verbose)
-                    dataLog("    Going to loop through to find tail deleted frames using ", RawPointer(callFrame), " with indexInLog = ", indexInLog, " and push-stack top = ", toPush.last(), "\n");
+                    dataLog("    Going to loop through to find tail deleted frames with indexInLog = ", indexInLog, " and push-stack top = ", toPush.last(), "\n");
                 for (;;) {
                     ASSERT(m_log[indexInLog].frame == toPush.last().frame);
                     
@@ -369,10 +340,6 @@
                         break;
                     }
                     indexInLog--; // Skip over the tail packet.
-
-                    // FIXME: After a few iterations the tail packet referenced frame may not be the
-                    // same as the original callFrame for the real stack frame we started with.
-                    // It is unclear when we should break.
                     
                     if (!advanceIndexInLogTo(tailPacket.frame, nullptr, nullptr)) {
                         if (ShadowChickenInternal::verbose)
@@ -412,7 +379,7 @@
         m_logCursor = m_log;
 
     if (ShadowChickenInternal::verbose)
-        dataLog("    After pushing: ", listDump(m_stack), "\n");
+        dataLog("    After pushing: ", *this, "\n");
 
     // Remove tail frames until the number of tail deleted frames is small enough.
     const unsigned maxTailDeletedFrames = Options::shadowChickenMaxTailDeletedFramesSize();
@@ -480,7 +447,7 @@
     unsigned limit = static_cast<unsigned>(m_logCursor - m_log);
     out.print("\n");
     for (unsigned i = 0; i < limit; ++i)
-        out.print("\t", comma, "[", i, "] ", m_log[i], "\n");
+        out.print("\t", comma, m_log[i], "\n");
     out.print("]}");
 }
 
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to