[Webkit-unassigned] [Bug 113907] New: Closure caching causes crash in exception handling

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=113907

           Summary: Closure caching causes crash in exception handling
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: oliver at apple.com
                CC: fpizlo at apple.com


This piece of code crashes, as far as i can tell it appears to be due to CodeBlock::bytecodeOffset(CallFrame, ReturnAddressPtr) returning the  bytecodeOffset from a ClosureCallStubRoutine that isn't in the target code block:
var value = 0;
function f(x) {
    var result = 0;
    function g(a) {
        function throwEventually() {
            if (value++ > 10000)
                throw new Error;
            return 5;
        }
        return a * throwEventually();
    }
    for (var i = 0; i < 3; i++)
        i += g(x);
    return i;
}

while (true)
    f(5)

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.