Title: [223102] branches/safari-604-branch/Source/_javascript_Core
- Revision
- 223102
- Author
- [email protected]
- Date
- 2017-10-09 17:08:21 -0700 (Mon, 09 Oct 2017)
Log Message
Cherry-pick r222748. rdar://problem/34820919
Modified Paths
Diff
Modified: branches/safari-604-branch/Source/_javascript_Core/ChangeLog (223101 => 223102)
--- branches/safari-604-branch/Source/_javascript_Core/ChangeLog 2017-10-10 00:08:19 UTC (rev 223101)
+++ branches/safari-604-branch/Source/_javascript_Core/ChangeLog 2017-10-10 00:08:21 UTC (rev 223102)
@@ -1,3 +1,23 @@
+2017-10-08 Jason Marcell <[email protected]>
+
+ Cherry-pick r222748. rdar://problem/34820919
+
+ 2017-10-02 Keith Miller <[email protected]>
+
+ VMTraps shouldn't crash if it sees an exception it doesn't understand.
+ https://bugs.webkit.org/show_bug.cgi?id=177780
+
+ Reviewed by Mark Lam.
+
+ VMTraps could see a JIT breakpoint (SegV) for any number of
+ reasons it doesn't understand. e.g. a bug in JIT code, Wasm OOB,
+ etc. This patch makes it handle that case gracefully. It's worth
+ noting that this means there's no way to know if, due to a bug, we
+ didn't accurately track all the VMTraps we installed. I'm not sure
+ if there is a good solution to that problem though.
+
+ * runtime/VMTraps.cpp:
+
2017-10-02 Jason Marcell <[email protected]>
Cherry-pick r222598. rdar://problem/34771434
Modified: branches/safari-604-branch/Source/_javascript_Core/runtime/VMTraps.cpp (223101 => 223102)
--- branches/safari-604-branch/Source/_javascript_Core/runtime/VMTraps.cpp 2017-10-10 00:08:19 UTC (rev 223101)
+++ branches/safari-604-branch/Source/_javascript_Core/runtime/VMTraps.cpp 2017-10-10 00:08:21 UTC (rev 223102)
@@ -211,6 +211,10 @@
return SignalAction::NotHandled;
CodeBlock* currentCodeBlock = DFG::codeBlockForVMTrapPC(context.trapPC);
+ if (!currentCodeBlock) {
+ // Either we trapped for some other reason, e.g. Wasm OOB, or we didn't properly monitor the PC. Regardless, we can't do much now...
+ return SignalAction::NotHandled;
+ }
ASSERT(currentCodeBlock->hasInstalledVMTrapBreakpoints());
VM& vm = *currentCodeBlock->vm();
ASSERT(vm.traps().needTrapHandling()); // We should have already jettisoned this code block when we handled the trap.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
