Status: Accepted
Owner: ----
Labels: Type-Bug Priority-High
New issue 1079 by [email protected]: Handling of optimized frames which
have called without deoptimization index is unsafe
http://code.google.com/p/v8/issues/detail?id=1079
It is possible for optimized functions to call out with a safepoint which
has no deoptimization id. This can happen for the deferred code parts and
when handling throw. However this is unsafe as other parts of the system
relies on frame iteration having a deoptimization id available.
This is causing problems in the following cases:
1. Generation of stack traces
The test test-api/CaptureStackTraceForUncaughtException reveals this
2. Handling of Function.arguments
Iteration the stack expects a safepoint with a deoptimization id
3. Lazy deoptimization
The lazy deoptimizer which destructively patches the optimizaed does not
touch calls without a deoptimization id and execution can then continue in
this patched code which is not supposed to run anymore except for
deoptimizing right away when control returns.
When an optimized frame on the stack has called out from a place where
there is a safepoint without deoptimization index
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
