Attachment 347574 Details for Bug 188577 – patch for EWS testing.

[patch] patch for EWS testing.

bug-188577e.patch (text/plain), 98.62 KB, created by Mark Lam on 2018-08-20 16:57:57 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Lam

Created: 2018-08-20 16:57:57 PDT

Size: 98.62 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 235087)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2018-08-20  Mark Lam  <mark.lam@apple.com>
>+
>+        Fix exception throwing code so that topCallFrame and topEntryFrame stay true to their names.
>+        https://bugs.webkit.org/show_bug.cgi?id=188577
>+        <rdar://problem/42985684>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/regress-188577.js: Added.
>+
> 2018-08-17  Saam barati  <sbarati@apple.com>
> 
>         intersectionOfPastValuesAtHead must filter values after they've observed an invalidation point
>Index: JSTests/stress/regress-188577.js
>===================================================================
>--- JSTests/stress/regress-188577.js	(nonexistent)
>+++ JSTests/stress/regress-188577.js	(working copy)
>@@ -0,0 +1,20 @@
>+//@ requireOptions("--maxPerThreadStackUsage=262144")
>+
>+var exception;
>+try {
>+    var i = 25000;
>+    var args = [];
>+    var v3;
>+    while (i--)
>+        args[i] = "a";
>+    var argsList = args.join();
>+    setter = Function(argsList, "");
>+    Object.defineProperty(args, '0', {set: setter});
>+    args.sort();
>+
>+} catch (e) {
>+    exception = e;
>+}
>+
>+if (exception != "RangeError: Maximum call stack size exceeded.")
>+    throw "FAILED";
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 235087)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,80 @@
>+2018-08-20  Mark Lam  <mark.lam@apple.com>
>+
>+        Fix exception throwing code so that topCallFrame and topEntryFrame stay true to their names.
>+        https://bugs.webkit.org/show_bug.cgi?id=188577
>+        <rdar://problem/42985684>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * JavaScriptCore.xcodeproj/project.pbxproj:
>+        * CMakeLists.txt:
>+        * Sources.txt:
>+        * debugger/Debugger.cpp:
>+        (JSC::Debugger::pauseIfNeeded):
>+        * interpreter/CallFrame.cpp:
>+        (JSC::CallFrame::vmEntryGlobalObject):
>+        (JSC::CallFrame::callerFrame const):
>+        (JSC::CallFrame::unsafeCallerFrame const):
>+        (JSC::CallFrame::convertToSkipFrame):
>+        (JSC::CallFrame::isSkipFrame const):
>+        (JSC::CallFrame::callerFrame): Deleted.
>+        (JSC::CallFrame::unsafeCallerFrame): Deleted.
>+        * interpreter/CallFrame.h:
>+        (JSC::ExecState::noCaller):
>+        (JSC::ExecState::isGlobalExec const):
>+        (JSC::ExecState::iterate):
>+        * interpreter/EntryFrame.h: Added.
>+        (JSC::EntryFrame::vmEntryRecordOffset):
>+        (JSC::EntryFrame::calleeSaveRegistersBufferOffset):
>+        * interpreter/FrameTracers.h:
>+        (JSC::NativeCallFrameTracerWithRestore::NativeCallFrameTracerWithRestore): Deleted.
>+        (JSC::NativeCallFrameTracerWithRestore::~NativeCallFrameTracerWithRestore): Deleted.
>+        * interpreter/Interpreter.cpp:
>+        (JSC::Interpreter::unwind):
>+        (JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
>+        * interpreter/Interpreter.h:
>+        * interpreter/StackVisitor.cpp:
>+        (JSC::StackVisitor::StackVisitor):
>+        * interpreter/StackVisitor.h:
>+        (JSC::StackVisitor::visit):
>+        (JSC::StackVisitor::topEntryFrameIsEmpty const):
>+        * interpreter/VMEntryRecord.h:
>+        (JSC::EntryFrame::vmEntryRecordOffset): Deleted.
>+        (JSC::EntryFrame::calleeSaveRegistersBufferOffset): Deleted.
>+        * jit/AssemblyHelpers.h:
>+        * jit/JITExceptions.cpp:
>+        (JSC::genericUnwind):
>+        * jit/JITExceptions.h:
>+        * jit/JITOperations.cpp:
>+        * llint/LLIntOffsetsExtractor.cpp:
>+        * llint/LLIntSlowPaths.cpp:
>+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
>+        * llint/LowLevelInterpreter.asm:
>+        * llint/LowLevelInterpreter32_64.asm:
>+        * llint/LowLevelInterpreter64.asm:
>+        * runtime/CommonSlowPaths.cpp:
>+        (JSC::slowPathThrowStackOverflowError):
>+        (JSC::SLOW_PATH_DECL):
>+        * runtime/CommonSlowPathsExceptions.cpp: Removed.
>+        * runtime/CommonSlowPathsExceptions.h: Removed.
>+        * runtime/Error.cpp:
>+        (JSC::getStackTrace):
>+        * runtime/ExceptionHelpers.cpp:
>+        (JSC::createStackOverflowError):
>+        * runtime/JSGeneratorFunction.h:
>+        * runtime/JSGlobalObject.cpp:
>+        (JSC::JSGlobalObject::init):
>+        (JSC::JSGlobalObject::visitChildren):
>+        * runtime/JSGlobalObject.h:
>+        (JSC::JSGlobalObject::skipFrameCallee const):
>+        * runtime/VM.cpp:
>+        (JSC::VM::throwException):
>+        (JSC::VM::callerGlobalObjectForThrow const):
>+        (JSC::VM::vmEntryGlobalObject const):
>+        * runtime/VM.h:
>+        * runtime/VMInlines.h:
>+        (JSC::VM::topJSCallFrame const):
>+
> 2018-08-19  Carlos Garcia Campos  <cgarcia@igalia.com>
> 
>         [GLIB] Add API to throw exceptions using printf formatted strings
>Index: Source/JavaScriptCore/CMakeLists.txt
>===================================================================
>--- Source/JavaScriptCore/CMakeLists.txt	(revision 235087)
>+++ Source/JavaScriptCore/CMakeLists.txt	(working copy)
>@@ -611,7 +611,9 @@ set(JavaScriptCore_PRIVATE_FRAMEWORK_HEA
> 
>     interpreter/AbstractPC.h
>     interpreter/CallFrame.h
>+    interpreter/CallFrameInlines.h
>     interpreter/CalleeBits.h
>+    interpreter/EntryFrame.h
>     interpreter/FrameTracers.h
>     interpreter/Register.h
>     interpreter/ShadowChicken.h
>Index: Source/JavaScriptCore/Sources.txt
>===================================================================
>--- Source/JavaScriptCore/Sources.txt	(revision 235087)
>+++ Source/JavaScriptCore/Sources.txt	(working copy)
>@@ -715,7 +715,6 @@ runtime/CodeCache.cpp
> runtime/CodeSpecializationKind.cpp
> runtime/CommonIdentifiers.cpp
> runtime/CommonSlowPaths.cpp
>-runtime/CommonSlowPathsExceptions.cpp
> runtime/CompilationResult.cpp
> tools/CompilerTimingScope.cpp
> runtime/Completion.cpp
>Index: Source/JavaScriptCore/API/APIUtils.h
>===================================================================
>--- Source/JavaScriptCore/API/APIUtils.h	(revision 235087)
>+++ Source/JavaScriptCore/API/APIUtils.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2016-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -45,7 +45,7 @@ inline ExceptionStatus handleExceptionIf
>             *returnedExceptionRef = toRef(exec, exception->value());
>         scope.clearException();
> #if ENABLE(REMOTE_INSPECTOR)
>-        exec->vmEntryGlobalObject()->inspectorController().reportAPIException(exec, exception);
>+        exec->vm().vmEntryGlobalObject(exec)->inspectorController().reportAPIException(exec, exception);
> #endif
>         return ExceptionStatus::DidThrow;
>     }
>@@ -57,7 +57,8 @@ inline void setException(JSC::ExecState*
>     if (returnedExceptionRef)
>         *returnedExceptionRef = toRef(exec, exception);
> #if ENABLE(REMOTE_INSPECTOR)
>-    exec->vmEntryGlobalObject()->inspectorController().reportAPIException(exec, JSC::Exception::create(exec->vm(), exception));
>+    VM& vm = exec->vm();
>+    vm.vmEntryGlobalObject(exec)->inspectorController().reportAPIException(exec, JSC::Exception::create(vm, exception));
> #endif
> }
> 
>Index: Source/JavaScriptCore/API/JSBase.cpp
>===================================================================
>--- Source/JavaScriptCore/API/JSBase.cpp	(revision 235087)
>+++ Source/JavaScriptCore/API/JSBase.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2006, 2007, 2013, 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2006-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -54,14 +54,15 @@ JSValueRef JSEvaluateScript(JSContextRef
>         return 0;
>     }
>     ExecState* exec = toJS(ctx);
>-    JSLockHolder locker(exec);
>+    VM& vm = exec->vm();
>+    JSLockHolder locker(vm);
> 
>     JSObject* jsThisObject = toJS(thisObject);
> 
>     startingLineNumber = std::max(1, startingLineNumber);
> 
>     // evaluate sets "this" to the global object if it is NULL
>-    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
>+    JSGlobalObject* globalObject = vm.vmEntryGlobalObject(exec);
>     auto sourceURLString = sourceURL ? sourceURL->string() : String();
>     SourceCode source = makeSource(script->string(), SourceOrigin { sourceURLString }, sourceURLString, TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
> 
>@@ -105,14 +106,14 @@ bool JSCheckScriptSyntax(JSContextRef ct
>     SourceCode source = makeSource(script->string(), SourceOrigin { sourceURLString }, sourceURLString, TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber()));
>     
>     JSValue syntaxException;
>-    bool isValidSyntax = checkSyntax(exec->vmEntryGlobalObject()->globalExec(), source, &syntaxException);
>+    bool isValidSyntax = checkSyntax(vm.vmEntryGlobalObject(exec)->globalExec(), source, &syntaxException);
> 
>     if (!isValidSyntax) {
>         if (exception)
>             *exception = toRef(exec, syntaxException);
> #if ENABLE(REMOTE_INSPECTOR)
>         Exception* exception = Exception::create(vm, syntaxException);
>-        exec->vmEntryGlobalObject()->inspectorController().reportAPIException(exec, exception);
>+        vm.vmEntryGlobalObject(exec)->inspectorController().reportAPIException(exec, exception);
> #endif
>         return false;
>     }
>Index: Source/JavaScriptCore/API/JSContextRef.cpp
>===================================================================
>--- Source/JavaScriptCore/API/JSContextRef.cpp	(revision 235087)
>+++ Source/JavaScriptCore/API/JSContextRef.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2006, 2007, 2013, 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2006-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -165,7 +165,7 @@ JSGlobalContextRef JSGlobalContextRetain
>     JSLockHolder locker(exec);
> 
>     VM& vm = exec->vm();
>-    gcProtect(exec->vmEntryGlobalObject());
>+    gcProtect(vm.vmEntryGlobalObject(exec));
>     vm.ref();
>     return ctx;
> }
>@@ -176,7 +176,8 @@ void JSGlobalContextRelease(JSGlobalCont
>     JSLockHolder locker(exec);
> 
>     VM& vm = exec->vm();
>-    bool protectCountIsZero = Heap::heap(exec->vmEntryGlobalObject())->unprotect(exec->vmEntryGlobalObject());
>+    JSGlobalObject* globalObject = vm.vmEntryGlobalObject(exec);
>+    bool protectCountIsZero = Heap::heap(globalObject)->unprotect(globalObject);
>     if (protectCountIsZero)
>         vm.heap.reportAbandonedObjectGraph();
>     vm.deref();
>@@ -225,9 +226,10 @@ JSStringRef JSGlobalContextCopyName(JSGl
>     }
> 
>     ExecState* exec = toJS(ctx);
>-    JSLockHolder locker(exec);
>+    VM& vm = exec->vm();
>+    JSLockHolder locker(vm);
> 
>-    String name = exec->vmEntryGlobalObject()->name();
>+    String name = vm.vmEntryGlobalObject(exec)->name();
>     if (name.isNull())
>         return 0;
> 
>@@ -242,9 +244,10 @@ void JSGlobalContextSetName(JSGlobalCont
>     }
> 
>     ExecState* exec = toJS(ctx);
>-    JSLockHolder locker(exec);
>+    VM& vm = exec->vm();
>+    JSLockHolder locker(vm);
> 
>-    exec->vmEntryGlobalObject()->setName(name ? name->string() : String());
>+    vm.vmEntryGlobalObject(exec)->setName(name ? name->string() : String());
> }
> 
> 
>@@ -325,9 +328,10 @@ bool JSGlobalContextGetRemoteInspectionE
>     }
> 
>     ExecState* exec = toJS(ctx);
>+    VM& vm = exec->vm();
>     JSLockHolder lock(exec);
> 
>-    return exec->vmEntryGlobalObject()->remoteDebuggingEnabled();
>+    return vm.vmEntryGlobalObject(exec)->remoteDebuggingEnabled();
> }
> 
> void JSGlobalContextSetRemoteInspectionEnabled(JSGlobalContextRef ctx, bool enabled)
>@@ -338,9 +342,10 @@ void JSGlobalContextSetRemoteInspectionE
>     }
> 
>     ExecState* exec = toJS(ctx);
>+    VM& vm = exec->vm();
>     JSLockHolder lock(exec);
> 
>-    exec->vmEntryGlobalObject()->setRemoteDebuggingEnabled(enabled);
>+    vm.vmEntryGlobalObject(exec)->setRemoteDebuggingEnabled(enabled);
> }
> 
> bool JSGlobalContextGetIncludesNativeCallStackWhenReportingExceptions(JSGlobalContextRef ctx)
>@@ -352,9 +357,10 @@ bool JSGlobalContextGetIncludesNativeCal
>     }
> 
>     ExecState* exec = toJS(ctx);
>+    VM& vm = exec->vm();
>     JSLockHolder lock(exec);
> 
>-    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
>+    JSGlobalObject* globalObject = vm.vmEntryGlobalObject(exec);
>     return globalObject->inspectorController().includesNativeCallStackWhenReportingExceptions();
> #else
>     UNUSED_PARAM(ctx);
>@@ -371,9 +377,10 @@ void JSGlobalContextSetIncludesNativeCal
>     }
> 
>     ExecState* exec = toJS(ctx);
>-    JSLockHolder lock(exec);
>+    VM& vm = exec->vm();
>+    JSLockHolder lock(vm);
> 
>-    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
>+    JSGlobalObject* globalObject = vm.vmEntryGlobalObject(exec);
>     globalObject->inspectorController().setIncludesNativeCallStackWhenReportingExceptions(includesNativeCallStack);
> #else
>     UNUSED_PARAM(ctx);
>@@ -391,9 +398,10 @@ CFRunLoopRef JSGlobalContextGetDebuggerR
>     }
> 
>     ExecState* exec = toJS(ctx);
>+    VM& vm = exec->vm();
>     JSLockHolder lock(exec);
> 
>-    return exec->vmEntryGlobalObject()->inspectorDebuggable().targetRunLoop();
>+    return vm.vmEntryGlobalObject(exec)->inspectorDebuggable().targetRunLoop();
> #else
>     UNUSED_PARAM(ctx);
>     return nullptr;
>@@ -409,9 +417,10 @@ void JSGlobalContextSetDebuggerRunLoop(J
>     }
> 
>     ExecState* exec = toJS(ctx);
>+    VM& vm = exec->vm();
>     JSLockHolder lock(exec);
> 
>-    exec->vmEntryGlobalObject()->inspectorDebuggable().setTargetRunLoop(runLoop);
>+    vm.vmEntryGlobalObject(exec)->inspectorDebuggable().setTargetRunLoop(runLoop);
> #else
>     UNUSED_PARAM(ctx);
>     UNUSED_PARAM(runLoop);
>@@ -428,8 +437,9 @@ Inspector::AugmentableInspectorControlle
>     }
> 
>     ExecState* exec = toJS(ctx);
>-    JSLockHolder lock(exec);
>+    VM& vm = exec->vm();
>+    JSLockHolder lock(vm);
> 
>-    return &exec->vmEntryGlobalObject()->inspectorController();
>+    return &vm.vmEntryGlobalObject(exec)->inspectorController();
> }
> #endif
>Index: Source/JavaScriptCore/API/JSValue.mm
>===================================================================
>--- Source/JavaScriptCore/API/JSValue.mm	(revision 235087)
>+++ Source/JavaScriptCore/API/JSValue.mm	(working copy)
>@@ -674,8 +674,9 @@ JSContainerConvertor::Task JSContainerCo
> static void reportExceptionToInspector(JSGlobalContextRef context, JSC::JSValue exceptionValue)
> {
>     JSC::ExecState* exec = toJS(context);
>-    JSC::Exception* exception = JSC::Exception::create(exec->vm(), exceptionValue);
>-    exec->vmEntryGlobalObject()->inspectorController().reportAPIException(exec, exception);
>+    JSC::VM& vm = exec->vm();
>+    JSC::Exception* exception = JSC::Exception::create(vm, exceptionValue);
>+    vm.vmEntryGlobalObject(exec)->inspectorController().reportAPIException(exec, exception);
> }
> #endif
> 
>Index: Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>===================================================================
>--- Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(revision 235087)
>+++ Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj	(working copy)
>@@ -1076,7 +1076,6 @@
> 		6511230714046B0A002B101D /* testRegExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 651122E5140469BA002B101D /* testRegExp.cpp */; };
> 		6514F21918B3E1670098FF8B /* Bytecodes.h in Headers */ = {isa = PBXBuildFile; fileRef = 6514F21718B3E1670098FF8B /* Bytecodes.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		65303D641447B9E100D3F904 /* ParserTokens.h in Headers */ = {isa = PBXBuildFile; fileRef = 65303D631447B9E100D3F904 /* ParserTokens.h */; settings = {ATTRIBUTES = (Private, ); }; };
>-		6553A33217A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 6553A33017A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h */; };
> 		65570F5A1AA4C3EA009B3C23 /* Regress141275.mm in Sources */ = {isa = PBXBuildFile; fileRef = 65570F591AA4C00A009B3C23 /* Regress141275.mm */; };
> 		657CF45919BF6662004ACBF2 /* JSCallee.h in Headers */ = {isa = PBXBuildFile; fileRef = 657CF45719BF6662004ACBF2 /* JSCallee.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		658824AF1E5CFDB000FB7359 /* ConfigFile.h in Headers */ = {isa = PBXBuildFile; fileRef = 658824AE1E5CFDB000FB7359 /* ConfigFile.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -1749,6 +1748,7 @@
> 		E49DC16C12EF294E00184A1F /* SourceProviderCache.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC15112EF272200184A1F /* SourceProviderCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		E49DC16D12EF295300184A1F /* SourceProviderCacheItem.h in Headers */ = {isa = PBXBuildFile; fileRef = E49DC14912EF261A00184A1F /* SourceProviderCacheItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		FE05FAFD1FE4CEDA00093230 /* DeprecatedInspectorValues.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 992D6A111FBD491D000245F4 /* DeprecatedInspectorValues.cpp */; };
>+		FE086BCA2123DEFB003F2929 /* EntryFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = FE086BC92123DEFA003F2929 /* EntryFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		FE0D4A061AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE0D4A041AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp */; };
> 		FE0D4A091ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE0D4A071ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp */; };
> 		FE10AAEB1F44D528009DEDC5 /* ProbeStack.h in Headers */ = {isa = PBXBuildFile; fileRef = FE10AAEA1F44D512009DEDC5 /* ProbeStack.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -1800,6 +1800,7 @@
> 		FEA08620182B7A0400F6D851 /* Breakpoint.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA0861E182B7A0400F6D851 /* Breakpoint.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		FEA08621182B7A0400F6D851 /* DebuggerPrimitives.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		FEA0C4031CDD7D1D00481991 /* FunctionWhitelist.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA0C4011CDD7D0E00481991 /* FunctionWhitelist.h */; };
>+		FEA3BBA8212B655900E93AD1 /* CallFrameInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = FEA3BBA7212B655800E93AD1 /* CallFrameInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		FEB51F6C1A97B688001F921C /* Regress141809.mm in Sources */ = {isa = PBXBuildFile; fileRef = FEB51F6B1A97B688001F921C /* Regress141809.mm */; };
> 		FEB58C15187B8B160098EF0B /* ErrorHandlingScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FEB58C13187B8B160098EF0B /* ErrorHandlingScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		FECB8B271D25BB85006F2463 /* FunctionOverridesTest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FECB8B251D25BB6E006F2463 /* FunctionOverridesTest.cpp */; };
>@@ -3563,8 +3564,6 @@
> 		654788421C937D2C000781A0 /* RegExpPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = RegExpPrototype.js; sourceTree = "<group>"; };
> 		65525FC31A6DD3B3007B5495 /* NullSetterFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NullSetterFunction.cpp; sourceTree = "<group>"; };
> 		65525FC41A6DD3B3007B5495 /* NullSetterFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NullSetterFunction.h; sourceTree = "<group>"; };
>-		6553A32F17A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CommonSlowPathsExceptions.cpp; sourceTree = "<group>"; };
>-		6553A33017A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CommonSlowPathsExceptions.h; sourceTree = "<group>"; };
> 		65570F581AA4C00A009B3C23 /* Regress141275.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Regress141275.h; path = API/tests/Regress141275.h; sourceTree = "<group>"; };
> 		65570F591AA4C00A009B3C23 /* Regress141275.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = Regress141275.mm; path = API/tests/Regress141275.mm; sourceTree = "<group>"; };
> 		655EB29A10CE2581001A990E /* NodesCodegen.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NodesCodegen.cpp; sourceTree = "<group>"; };
>@@ -4677,6 +4676,7 @@
> 		F692A87E0255597D01FF60F7 /* RegExp.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = RegExp.h; sourceTree = "<group>"; tabWidth = 8; };
> 		F692A8870255597D01FF60F7 /* JSCJSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCJSValue.cpp; sourceTree = "<group>"; tabWidth = 8; };
> 		F73926918DC64330AFCDF0D7 /* JSSourceCode.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSourceCode.cpp; sourceTree = "<group>"; };
>+		FE086BC92123DEFA003F2929 /* EntryFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EntryFrame.h; sourceTree = "<group>"; };
> 		FE0D4A041AB8DD0A002F54BF /* ExecutionTimeLimitTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ExecutionTimeLimitTest.cpp; path = API/tests/ExecutionTimeLimitTest.cpp; sourceTree = "<group>"; };
> 		FE0D4A051AB8DD0A002F54BF /* ExecutionTimeLimitTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ExecutionTimeLimitTest.h; path = API/tests/ExecutionTimeLimitTest.h; sourceTree = "<group>"; };
> 		FE0D4A071ABA2437002F54BF /* GlobalContextWithFinalizerTest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = GlobalContextWithFinalizerTest.cpp; path = API/tests/GlobalContextWithFinalizerTest.cpp; sourceTree = "<group>"; };
>@@ -4765,6 +4765,7 @@
> 		FEA0861F182B7A0400F6D851 /* DebuggerPrimitives.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DebuggerPrimitives.h; sourceTree = "<group>"; };
> 		FEA0C4001CDD7D0E00481991 /* FunctionWhitelist.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FunctionWhitelist.cpp; sourceTree = "<group>"; };
> 		FEA0C4011CDD7D0E00481991 /* FunctionWhitelist.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FunctionWhitelist.h; sourceTree = "<group>"; };
>+		FEA3BBA7212B655800E93AD1 /* CallFrameInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallFrameInlines.h; sourceTree = "<group>"; };
> 		FEB137561BB11EEE00CD5100 /* MacroAssemblerARM64.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerARM64.cpp; sourceTree = "<group>"; };
> 		FEB41CCB1F73284200C5481E /* ProbeFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProbeFrame.h; sourceTree = "<group>"; };
> 		FEB51F6A1A97B688001F921C /* Regress141809.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Regress141809.h; path = API/tests/Regress141809.h; sourceTree = "<group>"; };
>@@ -5499,10 +5500,12 @@
> 				796DAA2A1E89CCD6005DF24A /* CalleeBits.h */,
> 				1429D8DB0ED2205B00B89619 /* CallFrame.cpp */,
> 				1429D8DC0ED2205B00B89619 /* CallFrame.h */,
>+				FEA3BBA7212B655800E93AD1 /* CallFrameInlines.h */,
> 				A7F869EC0F95C2EC00558697 /* CallFrameClosure.h */,
> 				1429D85B0ED218E900B89619 /* CLoopStack.cpp */,
> 				14D792640DAA03FB001A9F05 /* CLoopStack.h */,
> 				A7C1EAEB17987AB600299DB2 /* CLoopStackInlines.h */,
>+				FE086BC92123DEFA003F2929 /* EntryFrame.h */,
> 				E34EDBF61DB5FFC100DC87A5 /* FrameTracers.h */,
> 				1429D7D30ED2128200B89619 /* Interpreter.cpp */,
> 				1429D77B0ED20D7300B89619 /* Interpreter.h */,
>@@ -6497,8 +6500,6 @@
> 				65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */,
> 				A709F2F117A0AC2A00512E98 /* CommonSlowPaths.cpp */,
> 				0F15F15D14B7A73A005DE37D /* CommonSlowPaths.h */,
>-				6553A32F17A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp */,
>-				6553A33017A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h */,
> 				A7E5A3A51797432D00E893C0 /* CompilationResult.cpp */,
> 				A7E5A3A61797432D00E893C0 /* CompilationResult.h */,
> 				969A09220ED1E09C00F1F681 /* Completion.cpp */,
>@@ -8430,6 +8431,7 @@
> 				99DA00A31BD5993100F4575C /* builtins_generator.py in Headers */,
> 				99DA00A41BD5993100F4575C /* builtins_model.py in Headers */,
> 				99DA00A51BD5993100F4575C /* builtins_templates.py in Headers */,
>+				FEA3BBA8212B655900E93AD1 /* CallFrameInlines.h in Headers */,
> 				41DEA1321B9F3163006D65DD /* BuiltinUtils.h in Headers */,
> 				9E72940B190F0514001A91B5 /* BundlePath.h in Headers */,
> 				0FB7F39715ED8E4600F167B2 /* Butterfly.h in Headers */,
>@@ -8490,7 +8492,6 @@
> 				A53243981856A489002ED692 /* CombinedDomains.json in Headers */,
> 				BC18C3F30E16F5CD00B34460 /* CommonIdentifiers.h in Headers */,
> 				0F15F15F14B7A73E005DE37D /* CommonSlowPaths.h in Headers */,
>-				6553A33217A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h in Headers */,
> 				A7E5A3A81797432D00E893C0 /* CompilationResult.h in Headers */,
> 				0F4F11E8209BCDAB00709654 /* CompilerTimingScope.h in Headers */,
> 				0FDCE12A1FAFA85F006F3901 /* CompleteSubspace.h in Headers */,
>@@ -9080,6 +9081,7 @@
> 				978801411471AD920041B016 /* JSDateMath.h in Headers */,
> 				C2A7F688160432D400F76B98 /* JSDestructibleObject.h in Headers */,
> 				0F7DF13C1E2971130095951B /* JSDestructibleObjectHeapCellType.h in Headers */,
>+				FE086BCA2123DEFB003F2929 /* EntryFrame.h in Headers */,
> 				FE384EE61ADDB7AD0055DE2C /* JSDollarVM.h in Headers */,
> 				86E3C614167BABD7006D760A /* JSExport.h in Headers */,
> 				A7B4ACAF1484C9CE00B38A36 /* JSExportMacros.h in Headers */,
>Index: Source/JavaScriptCore/debugger/Debugger.cpp
>===================================================================
>--- Source/JavaScriptCore/debugger/Debugger.cpp	(revision 235087)
>+++ Source/JavaScriptCore/debugger/Debugger.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- *  Copyright (C) 2008-2017 Apple Inc. All rights reserved.
>+ *  Copyright (C) 2008-2018 Apple Inc. All rights reserved.
>  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
>  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
>  *
>@@ -686,6 +686,7 @@ void Debugger::pauseIfNeeded(CallFrame* 
> {
>     VM& vm = m_vm;
>     auto scope = DECLARE_THROW_SCOPE(vm);
>+    ASSERT(callFrame);
> 
>     if (m_isPaused)
>         return;
>@@ -718,7 +719,7 @@ void Debugger::pauseIfNeeded(CallFrame* 
>     // reseting the pause state before executing any breakpoint actions.
>     TemporaryPausedState pausedState(*this);
> 
>-    JSGlobalObject* vmEntryGlobalObject = callFrame->vmEntryGlobalObject(vm);
>+    JSGlobalObject* vmEntryGlobalObject = vm.vmEntryGlobalObject(callFrame);
> 
>     if (didHitBreakpoint) {
>         handleBreakpointHit(vmEntryGlobalObject, breakpoint);
>Index: Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
>===================================================================
>--- Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp	(revision 235087)
>+++ Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2008, 2013-2014, 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -118,7 +118,8 @@ JSC::JSGlobalObject* DebuggerCallFrame::
>     ASSERT(isValid());
>     if (!isValid())
>         return nullptr;
>-    return m_validMachineFrame->vmEntryGlobalObject();
>+    VM& vm = m_validMachineFrame->vm();
>+    return vm.vmEntryGlobalObject(m_validMachineFrame);
> }
> 
> SourceID DebuggerCallFrame::sourceID() const
>@@ -252,7 +253,7 @@ JSValue DebuggerCallFrame::evaluateWithS
>         return jsUndefined();
>     }
> 
>-    JSGlobalObject* globalObject = callFrame->vmEntryGlobalObject();
>+    JSGlobalObject* globalObject = vm.vmEntryGlobalObject(callFrame);
>     if (scopeExtensionObject) {
>         JSScope* ignoredPreviousScope = globalObject->globalScope();
>         globalObject->setGlobalScopeExtension(JSWithScope::create(vm, globalObject, ignoredPreviousScope, scopeExtensionObject));
>Index: Source/JavaScriptCore/interpreter/CallFrame.cpp
>===================================================================
>--- Source/JavaScriptCore/interpreter/CallFrame.cpp	(revision 235087)
>+++ Source/JavaScriptCore/interpreter/CallFrame.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2008-2017 Apple Inc. All Rights Reserved.
>+ * Copyright (C) 2008-2018 Apple Inc. All Rights Reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -187,33 +187,33 @@ Register* CallFrame::topOfFrameInternal(
>     return registers() + codeBlock->stackPointerOffset();
> }
> 
>-JSGlobalObject* CallFrame::vmEntryGlobalObject()
>-{
>-    RELEASE_ASSERT(callee().isCell());
>-    if (callee().asCell()->isObject()) { 
>-        if (this == lexicalGlobalObject()->globalExec())
>-            return lexicalGlobalObject();
>-    }
>-    // If we're not an object, we're wasm, and therefore we're executing code and the below is safe.
>-
>-    // For any ExecState that's not a globalExec, the 
>-    // dynamic global object must be set since code is running
>-    ASSERT(vm().entryScope);
>-    return vm().entryScope->globalObject();
>-}
>-
>-JSGlobalObject* CallFrame::vmEntryGlobalObject(VM& vm)
>-{
>-    if (callee().isCell() && callee().asCell()->isObject()) {
>-        if (this == lexicalGlobalObject()->globalExec())
>-            return lexicalGlobalObject();
>-    }
>-
>-    // For any ExecState that's not a globalExec, the 
>-    // dynamic global object must be set since code is running
>-    ASSERT(vm.entryScope);
>-    return vm.entryScope->globalObject();
>-}
>+//JSGlobalObject* CallFrame::vmEntryGlobalObject()
>+//{
>+//    RELEASE_ASSERT(callee().isCell());
>+//    if (callee().asCell()->isObject()) {
>+//        if (this == lexicalGlobalObject()->globalExec())
>+//            return lexicalGlobalObject();
>+//    }
>+//    // If we're not an object, we're wasm, and therefore we're executing code and the below is safe.
>+//
>+//    // For any ExecState that's not a globalExec, the
>+//    // dynamic global object must be set since code is running
>+//    ASSERT(vm().entryScope);
>+//    return vm().entryScope->globalObject();
>+//}
>+//
>+//JSGlobalObject* CallFrame::vmEntryGlobalObject(VM& vm)
>+//{
>+//    if (callee().isCell() && callee().asCell()->isObject()) {
>+//        if (this == lexicalGlobalObject()->globalExec())
>+//            return lexicalGlobalObject();
>+//    }
>+//
>+//    // For any ExecState that's not a globalExec, the
>+//    // dynamic global object must be set since code is running
>+//    ASSERT(vm.entryScope);
>+//    return vm.entryScope->globalObject();
>+//}
> 
> JSGlobalObject* CallFrame::wasmAwareLexicalGlobalObject(VM& vm)
> {
>@@ -240,7 +240,7 @@ bool CallFrame::isAnyWasmCallee()
>     return false;
> }
> 
>-CallFrame* CallFrame::callerFrame(EntryFrame*& currEntryFrame)
>+CallFrame* CallFrame::callerFrame(EntryFrame*& currEntryFrame) const
> {
>     if (callerFrameOrEntryFrame() == currEntryFrame) {
>         VMEntryRecord* currVMEntryRecord = vmEntryRecord(currEntryFrame);
>@@ -250,7 +250,7 @@ CallFrame* CallFrame::callerFrame(EntryF
>     return static_cast<CallFrame*>(callerFrameOrEntryFrame());
> }
> 
>-SUPPRESS_ASAN CallFrame* CallFrame::unsafeCallerFrame(EntryFrame*& currEntryFrame)
>+SUPPRESS_ASAN CallFrame* CallFrame::unsafeCallerFrame(EntryFrame*& currEntryFrame) const
> {
>     if (unsafeCallerFrameOrEntryFrame() == currEntryFrame) {
>         VMEntryRecord* currVMEntryRecord = vmEntryRecord(currEntryFrame);
>@@ -364,4 +364,13 @@ const char* CallFrame::describeFrame()
>     return buffer;
> }
> 
>+void CallFrame::convertToSkipFrame(VM& vm)
>+{
>+    ASSERT(!isGlobalExec());
>+    JSGlobalObject* globalObject = vm.callerGlobalObjectForThrow(this);
>+    setCodeBlock(nullptr);
>+    setCallee(globalObject->skipFrameCallee());
>+    setArgumentCountIncludingThis(0);
>+}
>+
> } // namespace JSC
>Index: Source/JavaScriptCore/interpreter/CallFrame.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/CallFrame.h	(revision 235087)
>+++ Source/JavaScriptCore/interpreter/CallFrame.h	(working copy)
>@@ -1,7 +1,7 @@
> /*
>  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
>  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
>- *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
>+ *  Copyright (C) 2003-2018 Apple Inc. All rights reserved.
>  *
>  *  This library is free software; you can redistribute it and/or
>  *  modify it under the terms of the GNU Library General Public
>@@ -115,18 +115,18 @@ namespace JSC  {
>             ASSERT(this[scopeRegisterOffset].Register::scope());
>             return this[scopeRegisterOffset].Register::scope();
>         }
>-        // Global object in which execution began.
>-        // This variant is not safe to call from a Wasm frame.
>-        JS_EXPORT_PRIVATE JSGlobalObject* vmEntryGlobalObject();
>-        // This variant is safe to call from a Wasm frame.
>-        JSGlobalObject* vmEntryGlobalObject(VM&);
>+//        // Global object in which execution began.
>+//        // This variant is not safe to call from a Wasm frame.
>+//        JS_EXPORT_PRIVATE JSGlobalObject* vmEntryGlobalObject();
>+//        // This variant is safe to call from a Wasm frame.
>+//        JSGlobalObject* vmEntryGlobalObject(VM&);
> 
>         JSGlobalObject* wasmAwareLexicalGlobalObject(VM&);
> 
>         bool isAnyWasmCallee();
> 
>         // Global object in which the currently executing code was defined.
>-        // Differs from vmEntryGlobalObject() during function calls across web browser frames.
>+        // Differs from VM::vmEntryGlobalObject() during function calls across web browser frames.
>         JSGlobalObject* lexicalGlobalObject() const;
> 
>         // Differs from lexicalGlobalObject because this will have DOM window shell rather than
>@@ -145,8 +145,8 @@ namespace JSC  {
>         void* callerFrameOrEntryFrame() const { return callerFrameAndPC().callerFrame; }
>         SUPPRESS_ASAN void* unsafeCallerFrameOrEntryFrame() const { return unsafeCallerFrameAndPC().callerFrame; }
> 
>-        CallFrame* unsafeCallerFrame(EntryFrame*&);
>-        JS_EXPORT_PRIVATE CallFrame* callerFrame(EntryFrame*&);
>+        CallFrame* unsafeCallerFrame(EntryFrame*&) const;
>+        JS_EXPORT_PRIVATE CallFrame* callerFrame(EntryFrame*&) const;
> 
>         JS_EXPORT_PRIVATE SourceOrigin callerSourceOrigin();
> 
>@@ -255,7 +255,15 @@ namespace JSC  {
> 
>         static int offsetFor(size_t argumentCountIncludingThis) { return argumentCountIncludingThis + CallFrameSlot::thisArgument - 1; }
> 
>-        static CallFrame* noCaller() { return 0; }
>+        static CallFrame* noCaller() { return nullptr; }
>+        bool isGlobalExec() const
>+        {
>+            return callerFrameAndPC().callerFrame == noCaller() && callerFrameAndPC().pc == nullptr;
>+        }
>+
>+        void convertToSkipFrame(VM&);
>+        inline bool isSkipFrame() const;
>+        inline bool isWasmFrame() const;
> 
>         void setArgumentCountIncludingThis(int count) { static_cast<Register*>(this)[CallFrameSlot::argumentCount].payload() = count; }
>         void setCallee(JSObject* callee) { static_cast<Register*>(this)[CallFrameSlot::callee] = callee; }
>@@ -269,7 +277,7 @@ namespace JSC  {
>         // FIXME: This method is improper. We rely on the fact that we can call it with a null
>         // receiver. We should always be using StackVisitor directly.
>         // It's only valid to call this from a non-wasm top frame.
>-        template <typename Functor> void iterate(const Functor& functor)
>+        template <StackVisitor::EmptyEntryFrameAction action = StackVisitor::ContinueIfTopEntryFrameIsEmpty, typename Functor> void iterate(const Functor& functor)
>         {
>             VM* vm;
>             void* rawThis = this;
>@@ -278,7 +286,7 @@ namespace JSC  {
>                 vm = &this->vm();
>             } else
>                 vm = nullptr;
>-            StackVisitor::visit<Functor>(this, vm, functor);
>+            StackVisitor::visit<action, Functor>(this, vm, functor);
>         }
> 
>         void dump(PrintStream&);
>Index: Source/JavaScriptCore/interpreter/CallFrameInlines.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/CallFrameInlines.h	(nonexistent)
>+++ Source/JavaScriptCore/interpreter/CallFrameInlines.h	(working copy)
>@@ -0,0 +1,44 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#pragma once
>+
>+#include "CallFrame.h"
>+
>+namespace JSC {
>+
>+inline bool CallFrame::isSkipFrame() const
>+{
>+    if (callee().isWasm())
>+        return false;
>+    return jsCallee() == jsCallee()->globalObject()->skipFrameCallee();
>+}
>+
>+inline bool CallFrame::isWasmFrame() const
>+{
>+    return callee().isWasm();
>+}
>+
>+} // namespace JSC
>Index: Source/JavaScriptCore/interpreter/EntryFrame.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/EntryFrame.h	(nonexistent)
>+++ Source/JavaScriptCore/interpreter/EntryFrame.h	(working copy)
>@@ -0,0 +1,50 @@
>+/*
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#pragma once
>+
>+#include "StackAlignment.h"
>+#include "VMEntryRecord.h"
>+
>+namespace JSC {
>+
>+struct EntryFrame {
>+#if ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
>+    static ptrdiff_t vmEntryRecordOffset()
>+    {
>+        EntryFrame* fakeEntryFrame = reinterpret_cast<EntryFrame*>(0x1000);
>+        VMEntryRecord* record = vmEntryRecord(fakeEntryFrame);
>+        return static_cast<ptrdiff_t>(
>+            reinterpret_cast<char*>(record) - reinterpret_cast<char*>(fakeEntryFrame));
>+    }
>+
>+    static ptrdiff_t calleeSaveRegistersBufferOffset()
>+    {
>+        return vmEntryRecordOffset() + OBJECT_OFFSETOF(VMEntryRecord, calleeSaveRegistersBuffer);
>+    }
>+#endif
>+};
>+
>+} // namespace JSC
>Index: Source/JavaScriptCore/interpreter/FrameTracers.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/FrameTracers.h	(revision 235087)
>+++ Source/JavaScriptCore/interpreter/FrameTracers.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2016-2017 Apple Inc. All rights reserved.
>+ * Copyright (C) 2016-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -93,30 +93,4 @@ public:
>     }
> };
> 
>-class NativeCallFrameTracerWithRestore {
>-public:
>-    ALWAYS_INLINE NativeCallFrameTracerWithRestore(VM* vm, EntryFrame* EntryFrame, CallFrame* callFrame)
>-        : m_vm(vm)
>-    {
>-        ASSERT(vm);
>-        ASSERT(callFrame);
>-        assertStackPointerIsAligned();
>-        m_savedTopEntryFrame = vm->topEntryFrame;
>-        m_savedTopCallFrame = vm->topCallFrame;
>-        vm->topEntryFrame = EntryFrame;
>-        vm->topCallFrame = callFrame;
>-    }
>-
>-    ALWAYS_INLINE ~NativeCallFrameTracerWithRestore()
>-    {
>-        m_vm->topEntryFrame = m_savedTopEntryFrame;
>-        m_vm->topCallFrame = m_savedTopCallFrame;
>-    }
>-
>-private:
>-    VM* m_vm;
>-    EntryFrame* m_savedTopEntryFrame;
>-    CallFrame* m_savedTopCallFrame;
>-};
>-
>-}
>+} // namespace JSC
>Index: Source/JavaScriptCore/interpreter/Interpreter.cpp
>===================================================================
>--- Source/JavaScriptCore/interpreter/Interpreter.cpp	(revision 235087)
>+++ Source/JavaScriptCore/interpreter/Interpreter.cpp	(working copy)
>@@ -635,7 +635,7 @@ private:
> ALWAYS_INLINE static void notifyDebuggerOfUnwinding(VM& vm, CallFrame* callFrame)
> {
>     auto catchScope = DECLARE_CATCH_SCOPE(vm);
>-    if (Debugger* debugger = callFrame->vmEntryGlobalObject(vm)->debugger()) {
>+    if (Debugger* debugger = vm.vmEntryGlobalObject(callFrame)->debugger()) {
>         SuspendExceptionScope scope(&vm);
>         if (callFrame->isAnyWasmCallee()
>             || (callFrame->callee().isCell() && callFrame->callee().asCell()->inherits<JSFunction>(vm)))
>@@ -718,18 +718,11 @@ private:
>     HandlerInfo*& m_handler;
> };
> 
>-NEVER_INLINE HandlerInfo* Interpreter::unwind(VM& vm, CallFrame*& callFrame, Exception* exception, UnwindStart unwindStart)
>+NEVER_INLINE HandlerInfo* Interpreter::unwind(VM& vm, CallFrame*& callFrame, Exception* exception)
> {
>     auto scope = DECLARE_CATCH_SCOPE(vm);
> 
>-    if (unwindStart == UnwindFromCallerFrame) {
>-        if (callFrame->callerFrameOrEntryFrame() == vm.topEntryFrame)
>-            return nullptr;
>-
>-        callFrame = callFrame->callerFrame();
>-        vm.topCallFrame = callFrame;
>-    }
>-
>+    ASSERT(reinterpret_cast<void*>(callFrame) != vm.topEntryFrame);
>     CodeBlock* codeBlock = callFrame->codeBlock();
> 
>     JSValue exceptionValue = exception->value();
>@@ -740,12 +733,12 @@ NEVER_INLINE HandlerInfo* Interpreter::u
>     if (exceptionValue.isEmpty() || (exceptionValue.isCell() && !exceptionValue.asCell()))
>         exceptionValue = jsNull();
> 
>-    EXCEPTION_ASSERT_UNUSED(scope, scope.exception() && (!Options::exceptionStackTraceLimit() || scope.exception()->stack().size()));
>+    EXCEPTION_ASSERT_UNUSED(scope, scope.exception());
> 
>     // Calculate an exception handler vPC, unwinding call frames as necessary.
>     HandlerInfo* handler = nullptr;
>     UnwindFunctor functor(vm, callFrame, isTerminatedExecutionException(vm, exception), codeBlock, handler);
>-    StackVisitor::visit(callFrame, &vm, functor);
>+    StackVisitor::visit<StackVisitor::TerminateIfTopEntryFrameIsEmpty>(callFrame, &vm, functor);
>     if (!handler)
>         return nullptr;
> 
>@@ -754,7 +747,7 @@ NEVER_INLINE HandlerInfo* Interpreter::u
> 
> void Interpreter::notifyDebuggerOfExceptionToBeThrown(VM& vm, CallFrame* callFrame, Exception* exception)
> {
>-    Debugger* debugger = callFrame->vmEntryGlobalObject(vm)->debugger();
>+    Debugger* debugger = vm.vmEntryGlobalObject(callFrame)->debugger();
>     if (debugger && debugger->needsExceptionCallbacks() && !exception->didNotifyInspectorOfThrow()) {
>         // This code assumes that if the debugger is enabled then there is no inlining.
>         // If that assumption turns out to be false then we'll ignore the inlined call
>@@ -1327,7 +1320,7 @@ NEVER_INLINE void Interpreter::debug(Cal
> {
>     VM& vm = callFrame->vm();
>     auto scope = DECLARE_CATCH_SCOPE(vm);
>-    Debugger* debugger = callFrame->vmEntryGlobalObject()->debugger();
>+    Debugger* debugger = vm.vmEntryGlobalObject(callFrame)->debugger();
>     if (!debugger)
>         return;
> 
>Index: Source/JavaScriptCore/interpreter/Interpreter.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/Interpreter.h	(revision 235087)
>+++ Source/JavaScriptCore/interpreter/Interpreter.h	(working copy)
>@@ -64,8 +64,6 @@ namespace JSC {
>     struct ProtoCallFrame;
>     struct UnlinkedInstruction;
> 
>-    enum UnwindStart : uint8_t { UnwindFromCurrentFrame, UnwindFromCallerFrame };
>-
>     enum DebugHookType {
>         WillExecuteProgram,
>         DidExecuteProgram,
>@@ -116,8 +114,8 @@ namespace JSC {
>         JSValue execute(EvalExecutable*, CallFrame*, JSValue thisValue, JSScope*);
> 
>         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
>-        
>-        NEVER_INLINE HandlerInfo* unwind(VM&, CallFrame*&, Exception*, UnwindStart);
>+
>+        NEVER_INLINE HandlerInfo* unwind(VM&, CallFrame*&, Exception*);
>         void notifyDebuggerOfExceptionToBeThrown(VM&, CallFrame*, Exception*);
>         NEVER_INLINE void debug(CallFrame*, DebugHookType);
>         static String stackTraceAsString(VM&, const Vector<StackFrame>&);
>Index: Source/JavaScriptCore/interpreter/StackVisitor.cpp
>===================================================================
>--- Source/JavaScriptCore/interpreter/StackVisitor.cpp	(revision 235087)
>+++ Source/JavaScriptCore/interpreter/StackVisitor.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2013, 2015-2017 Apple Inc. All rights reserved.
>+ * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -44,13 +44,18 @@ StackVisitor::StackVisitor(CallFrame* st
>     CallFrame* topFrame;
>     if (startFrame) {
>         ASSERT(vm);
>+        ASSERT(!vm->topCallFrame || reinterpret_cast<void*>(vm->topCallFrame) != vm->topEntryFrame);
>+
>         m_frame.m_entryFrame = vm->topEntryFrame;
>         topFrame = vm->topCallFrame;
>-        
>-        if (topFrame && static_cast<void*>(m_frame.m_entryFrame) == static_cast<void*>(topFrame)) {
>-            topFrame = vmEntryRecord(m_frame.m_entryFrame)->m_prevTopCallFrame;
>-            m_frame.m_entryFrame = vmEntryRecord(m_frame.m_entryFrame)->m_prevTopEntryFrame;
>+
>+        if (topFrame && topFrame->isSkipFrame()) {
>+            topFrame = topFrame->callerFrame(m_frame.m_entryFrame);
>+            m_topEntryFrameIsEmpty = (m_frame.m_entryFrame != vm->topEntryFrame);
>+            if (startFrame == vm->topCallFrame)
>+                startFrame = topFrame;
>         }
>+
>     } else {
>         m_frame.m_entryFrame = 0;
>         topFrame = 0;
>Index: Source/JavaScriptCore/interpreter/StackVisitor.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/StackVisitor.h	(revision 235087)
>+++ Source/JavaScriptCore/interpreter/StackVisitor.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
>+ * Copyright (C) 2013-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -26,7 +26,6 @@
> #pragma once
> 
> #include "CalleeBits.h"
>-#include "VMEntryRecord.h"
> #include "WasmIndexOrName.h"
> #include <wtf/Function.h>
> #include <wtf/Indenter.h>
>@@ -35,6 +34,7 @@
> namespace JSC {
> 
> struct CodeOrigin;
>+struct EntryFrame;
> struct InlineCallFrame;
> 
> class CodeBlock;
>@@ -136,10 +136,17 @@ public:
>     // StackVisitor::visit() expects a Functor that implements the following method:
>     //     Status operator()(StackVisitor&) const;
> 
>-    template <typename Functor>
>+    enum EmptyEntryFrameAction {
>+        ContinueIfTopEntryFrameIsEmpty,
>+        TerminateIfTopEntryFrameIsEmpty,
>+    };
>+
>+    template <EmptyEntryFrameAction action = ContinueIfTopEntryFrameIsEmpty, typename Functor>
>     static void visit(CallFrame* startFrame, VM* vm, const Functor& functor)
>     {
>         StackVisitor visitor(startFrame, vm);
>+        if (action == TerminateIfTopEntryFrameIsEmpty && visitor.topEntryFrameIsEmpty())
>+            return;
>         while (visitor->callFrame()) {
>             Status status = functor(visitor);
>             if (status != Continue)
>@@ -152,6 +159,8 @@ public:
>     ALWAYS_INLINE Frame* operator->() { return &m_frame; }
>     void unwindToMachineCodeBlockFrame();
> 
>+    bool topEntryFrameIsEmpty() const { return m_topEntryFrameIsEmpty; }
>+
> private:
>     JS_EXPORT_PRIVATE StackVisitor(CallFrame* startFrame, VM*);
> 
>@@ -164,6 +173,7 @@ private:
> #endif
> 
>     Frame m_frame;
>+    bool m_topEntryFrameIsEmpty { false };
> };
> 
> class CallerFunctor {
>Index: Source/JavaScriptCore/interpreter/VMEntryRecord.h
>===================================================================
>--- Source/JavaScriptCore/interpreter/VMEntryRecord.h	(revision 235087)
>+++ Source/JavaScriptCore/interpreter/VMEntryRecord.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2014-2017 Apple Inc. All rights reserved.
>+ * Copyright (C) 2014-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -31,6 +31,7 @@ namespace JSC {
> 
> struct EntryFrame;
> class ExecState;
>+class JSObject;
> class VM;
> 
> struct VMEntryRecord {
>@@ -41,6 +42,7 @@ struct VMEntryRecord {
>     VM* m_vm;
>     ExecState* m_prevTopCallFrame;
>     EntryFrame* m_prevTopEntryFrame;
>+    JSObject* m_callee;
> 
> #if ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
>     intptr_t calleeSaveRegistersBuffer[NUMBER_OF_CALLEE_SAVES_REGISTERS];
>@@ -55,21 +57,4 @@ struct VMEntryRecord {
> 
> extern "C" VMEntryRecord* vmEntryRecord(EntryFrame*);
> 
>-struct EntryFrame {
>-#if ENABLE(JIT) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0
>-    static ptrdiff_t vmEntryRecordOffset()
>-    {
>-        EntryFrame* fakeEntryFrame = reinterpret_cast<EntryFrame*>(0x1000);
>-        VMEntryRecord* record = vmEntryRecord(fakeEntryFrame);
>-        return static_cast<ptrdiff_t>(
>-            reinterpret_cast<char*>(record) - reinterpret_cast<char*>(fakeEntryFrame));
>-    }
>-
>-    static ptrdiff_t calleeSaveRegistersBufferOffset()
>-    {
>-        return vmEntryRecordOffset() + OBJECT_OFFSETOF(VMEntryRecord, calleeSaveRegistersBuffer);
>-    }
>-#endif
>-};
>-
> } // namespace JSC
>Index: Source/JavaScriptCore/jit/AssemblyHelpers.h
>===================================================================
>--- Source/JavaScriptCore/jit/AssemblyHelpers.h	(revision 235087)
>+++ Source/JavaScriptCore/jit/AssemblyHelpers.h	(working copy)
>@@ -28,6 +28,7 @@
> #if ENABLE(JIT)
> 
> #include "CodeBlock.h"
>+#include "EntryFrame.h"
> #include "FPRInfo.h"
> #include "GPRInfo.h"
> #include "Heap.h"
>Index: Source/JavaScriptCore/jit/JITExceptions.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITExceptions.cpp	(revision 235087)
>+++ Source/JavaScriptCore/jit/JITExceptions.cpp	(working copy)
>@@ -30,6 +30,7 @@
> #include "CatchScope.h"
> #include "CodeBlock.h"
> #include "Disassembler.h"
>+#include "EntryFrame.h"
> #include "Interpreter.h"
> #include "JSCInlines.h"
> #include "JSCJSValue.h"
>@@ -42,28 +43,21 @@
> 
> namespace JSC {
> 
>-void genericUnwind(VM* vm, ExecState* callFrame, UnwindStart unwindStart)
>+void genericUnwind(VM* vm, ExecState* callFrame)
> {
>     auto scope = DECLARE_CATCH_SCOPE(*vm);
>+    CallFrame* topJSCallFrame = vm->topJSCallFrame();
>     if (Options::breakOnThrow()) {
>-        CodeBlock* codeBlock = callFrame->codeBlock();
>-        if (codeBlock)
>-            dataLog("In call frame ", RawPointer(callFrame), " for code block ", *codeBlock, "\n");
>-        else
>-            dataLog("In call frame ", RawPointer(callFrame), " with null CodeBlock\n");
>+        CodeBlock* codeBlock = topJSCallFrame->codeBlock();
>+        dataLog("In call frame ", RawPointer(topJSCallFrame), " for code block ", codeBlock, "\n");
>         CRASH();
>     }
>     
>-    ExecState* shadowChickenTopFrame = callFrame;
>-    if (unwindStart == UnwindFromCallerFrame) {
>-        EntryFrame* topEntryFrame = vm->topEntryFrame;
>-        shadowChickenTopFrame = callFrame->callerFrame(topEntryFrame);
>-    }
>-    vm->shadowChicken().log(*vm, shadowChickenTopFrame, ShadowChicken::Packet::throwPacket());
>-    
>+    vm->shadowChicken().log(*vm, topJSCallFrame, ShadowChicken::Packet::throwPacket());
>+
>     Exception* exception = scope.exception();
>     RELEASE_ASSERT(exception);
>-    HandlerInfo* handler = vm->interpreter->unwind(*vm, callFrame, exception, unwindStart); // This may update callFrame.
>+    HandlerInfo* handler = vm->interpreter->unwind(*vm, callFrame, exception); // This may update callFrame.
> 
>     void* catchRoutine;
>     Instruction* catchPCForInterpreter = 0;
>@@ -83,7 +77,7 @@ void genericUnwind(VM* vm, ExecState* ca
> #endif
>     } else
>         catchRoutine = LLInt::getCodePtr<ExceptionHandlerPtrTag>(handleUncaughtException).executableAddress();
>-    
>+
>     ASSERT(bitwise_cast<uintptr_t>(callFrame) < bitwise_cast<uintptr_t>(vm->topEntryFrame));
> 
>     assertIsTaggedWith(catchRoutine, ExceptionHandlerPtrTag);
>@@ -94,9 +88,4 @@ void genericUnwind(VM* vm, ExecState* ca
>     RELEASE_ASSERT(catchRoutine);
> }
> 
>-void genericUnwind(VM* vm, ExecState* callFrame)
>-{
>-    genericUnwind(vm, callFrame, UnwindFromCurrentFrame);
>-}
>-
> } // namespace JSC
>Index: Source/JavaScriptCore/jit/JITExceptions.h
>===================================================================
>--- Source/JavaScriptCore/jit/JITExceptions.h	(revision 235087)
>+++ Source/JavaScriptCore/jit/JITExceptions.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2012 Apple Inc. All rights reserved.
>+ * Copyright (C) 2012-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -27,12 +27,9 @@
> 
> namespace JSC {
> 
>-enum UnwindStart : uint8_t;
>-
> class ExecState;
> class VM;
> 
>-void genericUnwind(VM*, ExecState*, UnwindStart);
> void genericUnwind(VM*, ExecState*);
> 
> } // namespace JSC
>Index: Source/JavaScriptCore/jit/JITOperations.cpp
>===================================================================
>--- Source/JavaScriptCore/jit/JITOperations.cpp	(revision 235087)
>+++ Source/JavaScriptCore/jit/JITOperations.cpp	(working copy)
>@@ -102,16 +102,10 @@ void JIT_OPERATION operationThrowStackOv
>     // We pass in our own code block, because the callframe hasn't been populated.
>     VM* vm = codeBlock->vm();
>     auto scope = DECLARE_THROW_SCOPE(*vm);
>+    exec->convertToSkipFrame(*vm);
> 
>-    EntryFrame* entryFrame = vm->topEntryFrame;
>-    CallFrame* callerFrame = exec->callerFrame(entryFrame);
>-    if (!callerFrame) {
>-        callerFrame = exec;
>-        entryFrame = vm->topEntryFrame;
>-    }
>-
>-    NativeCallFrameTracerWithRestore tracer(vm, entryFrame, callerFrame);
>-    throwStackOverflowError(callerFrame, scope);
>+    NativeCallFrameTracer tracer(vm, exec);
>+    throwStackOverflowError(exec, scope);
> }
> 
> #if ENABLE(WEBASSEMBLY)
>@@ -119,26 +113,22 @@ void JIT_OPERATION operationThrowDivideE
> {
>     VM* vm = &exec->vm();
>     auto scope = DECLARE_THROW_SCOPE(*vm);
>+    exec->convertToSkipFrame(*vm);
> 
>-    EntryFrame* entryFrame = vm->topEntryFrame;
>-    CallFrame* callerFrame = exec->callerFrame(entryFrame);
>-
>-    NativeCallFrameTracerWithRestore tracer(vm, entryFrame, callerFrame);
>+    NativeCallFrameTracer tracer(vm, exec);
>     ErrorHandlingScope errorScope(*vm);
>-    throwException(callerFrame, scope, createError(callerFrame, "Division by zero or division overflow."_s));
>+    throwException(exec, scope, createError(exec, "Division by zero or division overflow."_s));
> }
> 
> void JIT_OPERATION operationThrowOutOfBoundsAccessError(ExecState* exec)
> {
>     VM* vm = &exec->vm();
>     auto scope = DECLARE_THROW_SCOPE(*vm);
>+    exec->convertToSkipFrame(*vm);
> 
>-    EntryFrame* entryFrame = vm->topEntryFrame;
>-    CallFrame* callerFrame = exec->callerFrame(entryFrame);
>-
>-    NativeCallFrameTracerWithRestore tracer(vm, entryFrame, callerFrame);
>+    NativeCallFrameTracer tracer(vm, exec);
>     ErrorHandlingScope errorScope(*vm);
>-    throwException(callerFrame, scope, createError(callerFrame, "Out-of-bounds access."_s));
>+    throwException(exec, scope, createError(exec, "Out-of-bounds access."_s));
> }
> #endif
> 
>@@ -149,10 +139,9 @@ int32_t JIT_OPERATION operationCallArity
> 
>     int32_t missingArgCount = CommonSlowPaths::arityCheckFor(exec, *vm, CodeForCall);
>     if (missingArgCount < 0) {
>-        EntryFrame* entryFrame = vm->topEntryFrame;
>-        CallFrame* callerFrame = exec->callerFrame(entryFrame);
>-        NativeCallFrameTracerWithRestore tracer(vm, entryFrame, callerFrame);
>-        throwStackOverflowError(callerFrame, scope);
>+        exec->convertToSkipFrame(*vm);
>+        NativeCallFrameTracer tracer(vm, exec);
>+        throwStackOverflowError(vm->topCallFrame, scope);
>     }
> 
>     return missingArgCount;
>@@ -165,10 +154,9 @@ int32_t JIT_OPERATION operationConstruct
> 
>     int32_t missingArgCount = CommonSlowPaths::arityCheckFor(exec, *vm, CodeForConstruct);
>     if (missingArgCount < 0) {
>-        EntryFrame* entryFrame = vm->topEntryFrame;
>-        CallFrame* callerFrame = exec->callerFrame(entryFrame);
>-        NativeCallFrameTracerWithRestore tracer(vm, entryFrame, callerFrame);
>-        throwStackOverflowError(callerFrame, scope);
>+        exec->convertToSkipFrame(*vm);
>+        NativeCallFrameTracer tracer(vm, exec);
>+        throwStackOverflowError(vm->topCallFrame, scope);
>     }
> 
>     return missingArgCount;
>@@ -2477,9 +2465,8 @@ void JIT_OPERATION lookupExceptionHandle
> 
> void JIT_OPERATION lookupExceptionHandlerFromCallerFrame(VM* vm, ExecState* exec)
> {
>-    vm->topCallFrame = exec->callerFrame();
>-    genericUnwind(vm, exec, UnwindFromCallerFrame);
>-    ASSERT(vm->targetMachinePCForThrow);
>+    exec->convertToSkipFrame(*vm);
>+    lookupExceptionHandler(vm, exec);
> }
> 
> void JIT_OPERATION operationVMHandleException(ExecState* exec)
>Index: Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp	(revision 235087)
>+++ Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp	(working copy)
>@@ -58,7 +58,6 @@
> #include "TypeProfiler.h"
> #include "TypeProfilerLog.h"
> #include "VM.h"
>-#include "VMEntryRecord.h"
> #include "ValueProfile.h"
> #include "Watchdog.h"
> #include <wtf/text/StringImpl.h>
>Index: Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(revision 235087)
>+++ Source/JavaScriptCore/llint/LLIntSlowPaths.cpp	(working copy)
>@@ -29,7 +29,6 @@
> #include "ArrayConstructor.h"
> #include "CallFrame.h"
> #include "CommonSlowPaths.h"
>-#include "CommonSlowPathsExceptions.h"
> #include "Error.h"
> #include "ErrorHandlingScope.h"
> #include "EvalCodeBlock.h"
>@@ -524,14 +523,7 @@ LLINT_SLOW_PATH_DECL(stack_check)
> {
>     VM& vm = exec->vm();
>     auto throwScope = DECLARE_THROW_SCOPE(vm);
>-
>-    EntryFrame* topEntryFrame = vm.topEntryFrame;
>-    CallFrame* callerFrame = exec->callerFrame(topEntryFrame);
>-    if (!callerFrame) {
>-        callerFrame = exec;
>-        topEntryFrame = vm.topEntryFrame;
>-    }
>-    NativeCallFrameTracerWithRestore tracer(&vm, topEntryFrame, callerFrame);
>+    NativeCallFrameTracer tracer(&vm, exec);
> 
>     LLINT_SET_PC_FOR_STUBS();
> 
>@@ -563,9 +555,10 @@ LLINT_SLOW_PATH_DECL(stack_check)
>     }
> #endif
> 
>+    exec->convertToSkipFrame(vm);
>     ErrorHandlingScope errorScope(vm);
>-    throwStackOverflowError(callerFrame, throwScope);
>-    pc = returnToThrow(callerFrame);
>+    throwStackOverflowError(exec, throwScope);
>+    pc = returnToThrow(exec);
>     LLINT_RETURN_TWO(pc, exec);
> }
> 
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(revision 235087)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm	(working copy)
>@@ -127,6 +127,8 @@ macro doVMEntry(makeCall)
>     storep t4, VMEntryRecord::m_prevTopCallFrame[sp]
>     loadp VM::topEntryFrame[vm], t4
>     storep t4, VMEntryRecord::m_prevTopEntryFrame[sp]
>+    loadp ProtoCallFrame::calleeValue[protoCallFrame], t4
>+    storep t4, VMEntryRecord::m_callee[sp]
> 
>     # Align stack pointer
>     if X86_WIN or MIPS
>@@ -312,8 +314,7 @@ _handleUncaughtException:
>     loadp VM::callFrameForCatch[t3], cfr
>     storep 0, VM::callFrameForCatch[t3]
> 
>-    loadp CallerFrame[cfr], cfr
>-
>+    loadp VM::topEntryFrame[t3], cfr
>     if ARMv7
>         vmEntryRecord(cfr, t3)
>         move t3, sp
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(revision 235087)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter64.asm	(working copy)
>@@ -132,6 +132,8 @@ macro doVMEntry(makeCall)
>     storep t4, VMEntryRecord::m_prevTopCallFrame[sp]
>     loadp VM::topEntryFrame[vm], t4
>     storep t4, VMEntryRecord::m_prevTopEntryFrame[sp]
>+    loadp ProtoCallFrame::calleeValue[protoCallFrame], t4
>+    storep t4, VMEntryRecord::m_callee[sp]
> 
>     loadi ProtoCallFrame::paddedArgCount[protoCallFrame], t4
>     addp CallFrameHeaderSlots, t4, t4
>@@ -244,7 +246,6 @@ macro doVMEntry(makeCall)
> 
>     popCalleeSaves()
>     functionEpilogue()
>-
>     ret
> end
> 
>@@ -285,7 +286,7 @@ _handleUncaughtException:
>     loadp VM::callFrameForCatch[t3], cfr
>     storep 0, VM::callFrameForCatch[t3]
> 
>-    loadp CallerFrame[cfr], cfr
>+    loadp VM::topEntryFrame[t3], cfr
>     vmEntryRecord(cfr, t2)
> 
>     loadp VMEntryRecord::m_vm[t2], t3
>Index: Source/JavaScriptCore/llint/LowLevelInterpreter.asm
>===================================================================
>--- Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(revision 235087)
>+++ Source/JavaScriptCore/llint/LowLevelInterpreter.asm	(working copy)
>@@ -1148,6 +1148,13 @@ macro doReturn()
>     ret
> end
> 
>+# This break instruction is needed so that the synthesized llintPCRangeStart label
>+# doesn't point to the exact same location as vmEntryToJavaScript which comes after it.
>+# Otherwise, libunwind will report vmEntryToJavaScript as llintPCRangeStart in
>+# stack traces.
>+
>+    break
>+
> # stub to call into JavaScript or Native functions
> # EncodedJSValue vmEntryToJavaScript(void* code, VM* vm, ProtoCallFrame* protoFrame)
> # EncodedJSValue vmEntryToNativeFunction(void* code, VM* vm, ProtoCallFrame* protoFrame)
>Index: Source/JavaScriptCore/runtime/CallData.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/CallData.cpp	(revision 235087)
>+++ Source/JavaScriptCore/runtime/CallData.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2008, 2016 Apple Inc. All Rights Reserved.
>+ * Copyright (C) 2008-2018 Apple Inc. All Rights Reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -57,13 +57,15 @@ JSValue call(ExecState* exec, JSValue fu
> 
> JSValue profiledCall(ExecState* exec, ProfilingReason reason, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
> {
>-    ScriptProfilingScope profilingScope(exec->vmEntryGlobalObject(), reason);
>+    VM& vm = exec->vm();
>+    ScriptProfilingScope profilingScope(vm.vmEntryGlobalObject(exec), reason);
>     return call(exec, functionObject, callType, callData, thisValue, args);
> }
> 
> JSValue profiledCall(ExecState* exec, ProfilingReason reason, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args, NakedPtr<Exception>& returnedException)
> {
>-    ScriptProfilingScope profilingScope(exec->vmEntryGlobalObject(), reason);
>+    VM& vm = exec->vm();
>+    ScriptProfilingScope profilingScope(vm.vmEntryGlobalObject(exec), reason);
>     return call(exec, functionObject, callType, callData, thisValue, args, returnedException);
> }
> 
>Index: Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/CommonSlowPaths.cpp	(revision 235087)
>+++ Source/JavaScriptCore/runtime/CommonSlowPaths.cpp	(working copy)
>@@ -33,7 +33,6 @@
> #include "CallFrame.h"
> #include "ClonedArguments.h"
> #include "CodeProfiling.h"
>-#include "CommonSlowPathsExceptions.h"
> #include "DefinePropertyAttributes.h"
> #include "DirectArguments.h"
> #include "Error.h"
>@@ -163,16 +162,26 @@ namespace JSC {
>             CALL_END_IMPL(cceExec, LLInt::callToThrow(cceExec), ExceptionHandlerPtrTag); \
>     } while (false)
> 
>+static void slowPathThrowStackOverflowError(ExecState* exec, ThrowScope& scope)
>+{
>+    JSObject* error = createStackOverflowError(exec);
>+    throwException(exec, scope, error);
>+#if LLINT_TRACING
>+    if (UNLIKELY(Options::traceLLIntSlowPath()))
>+        dataLog("Throwing exception ", JSValue(scope.exception()), ".\n");
>+#endif
>+}
>+
> SLOW_PATH_DECL(slow_path_call_arityCheck)
> {
>     BEGIN();
>     int slotsToAdd = CommonSlowPaths::arityCheckFor(exec, vm, CodeForCall);
>     if (slotsToAdd < 0) {
>-        exec = exec->callerFrame();
>-        vm.topCallFrame = exec;
>+        exec->convertToSkipFrame(vm);
>+        NativeCallFrameTracer tracer(&vm, exec);
>         ErrorHandlingScope errorScope(vm);
>         throwScope.release();
>-        CommonSlowPaths::interpreterThrowInCaller(exec, createStackOverflowError(exec));
>+        slowPathThrowStackOverflowError(exec, throwScope);
>         RETURN_TWO(bitwise_cast<void*>(static_cast<uintptr_t>(1)), exec);
>     }
>     RETURN_TWO(0, bitwise_cast<void*>(static_cast<uintptr_t>(slotsToAdd)));
>@@ -183,10 +192,10 @@ SLOW_PATH_DECL(slow_path_construct_arity
>     BEGIN();
>     int slotsToAdd = CommonSlowPaths::arityCheckFor(exec, vm, CodeForConstruct);
>     if (slotsToAdd < 0) {
>-        exec = exec->callerFrame();
>-        vm.topCallFrame = exec;
>+        exec->convertToSkipFrame(vm);
>+        NativeCallFrameTracer tracer(&vm, exec);
>         ErrorHandlingScope errorScope(vm);
>-        CommonSlowPaths::interpreterThrowInCaller(exec, createStackOverflowError(exec));
>+        slowPathThrowStackOverflowError(exec, throwScope);
>         RETURN_TWO(bitwise_cast<void*>(static_cast<uintptr_t>(1)), exec);
>     }
>     RETURN_TWO(0, bitwise_cast<void*>(static_cast<uintptr_t>(slotsToAdd)));
>Index: Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp	(revision 235087)
>+++ Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp	(nonexistent)
>@@ -1,56 +0,0 @@
>-/*
>- * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#include "config.h"
>-#include "CommonSlowPathsExceptions.h"
>-
>-#include "CallFrame.h"
>-#include "CodeBlock.h"
>-#include "FrameTracers.h"
>-#include "Interpreter.h"
>-#include "JITExceptions.h"
>-#include "LLIntCommon.h"
>-#include "JSCInlines.h"
>-
>-#if LLINT_TRACING
>-#include "Exception.h"
>-#endif
>-
>-namespace JSC { namespace CommonSlowPaths {
>-
>-void interpreterThrowInCaller(ExecState* exec, JSObject* error)
>-{
>-    VM* vm = &exec->vm();
>-    NativeCallFrameTracer tracer(vm, exec);
>-    auto scope = DECLARE_THROW_SCOPE(*vm);
>-
>-    throwException(exec, scope, error);
>-#if LLINT_TRACING
>-    if (UNLIKELY(Options::traceLLIntSlowPath()))
>-        dataLog("Throwing exception ", JSValue(scope.exception()), ".\n");
>-#endif
>-}
>-
>-} } // namespace JSC::LLInt
>Index: Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.h
>===================================================================
>--- Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.h	(revision 235087)
>+++ Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.h	(nonexistent)
>@@ -1,38 +0,0 @@
>-/*
>- * Copyright (C) 2013 Apple Inc. All rights reserved.
>- *
>- * Redistribution and use in source and binary forms, with or without
>- * modification, are permitted provided that the following conditions
>- * are met:
>- * 1. Redistributions of source code must retain the above copyright
>- *    notice, this list of conditions and the following disclaimer.
>- * 2. Redistributions in binary form must reproduce the above copyright
>- *    notice, this list of conditions and the following disclaimer in the
>- *    documentation and/or other materials provided with the distribution.
>- *
>- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
>- */
>-
>-#pragma once
>-
>-namespace JSC {
>-
>-class ExecState;
>-class JSObject;
>-
>-namespace CommonSlowPaths {
>-
>-// Throw the currently active exception in the context of the caller's call frame.
>-void interpreterThrowInCaller(ExecState* callerFrame, JSObject*);
>-
>-} } // namespace JSC::CommonSlowPaths
>Index: Source/JavaScriptCore/runtime/Completion.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/Completion.cpp	(revision 235087)
>+++ Source/JavaScriptCore/runtime/Completion.cpp	(working copy)
>@@ -1,7 +1,7 @@
> /*
>  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
>  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
>- *  Copyright (C) 2003-2017 Apple Inc.
>+ *  Copyright (C) 2003-2018 Apple Inc.
>  *
>  *  This library is free software; you can redistribute it and/or
>  *  modify it under the terms of the GNU Library General Public
>@@ -98,7 +98,7 @@ JSValue evaluate(ExecState* exec, const 
>     CodeProfiling profile(source);
> 
>     if (!thisValue || thisValue.isUndefinedOrNull())
>-        thisValue = exec->vmEntryGlobalObject();
>+        thisValue = vm.vmEntryGlobalObject(exec);
>     JSObject* thisObj = jsCast<JSObject*>(thisValue.toThis(exec, NotStrictMode));
>     JSValue result = vm.interpreter->executeProgram(source, exec, thisObj);
> 
>@@ -114,17 +114,19 @@ JSValue evaluate(ExecState* exec, const 
> 
> JSValue profiledEvaluate(ExecState* exec, ProfilingReason reason, const SourceCode& source, JSValue thisValue, NakedPtr<Exception>& returnedException)
> {
>-    ScriptProfilingScope profilingScope(exec->vmEntryGlobalObject(), reason);
>+    VM& vm = exec->vm();
>+    ScriptProfilingScope profilingScope(vm.vmEntryGlobalObject(exec), reason);
>     return evaluate(exec, source, thisValue, returnedException);
> }
> 
> JSValue evaluateWithScopeExtension(ExecState* exec, const SourceCode& source, JSObject* scopeExtensionObject, NakedPtr<Exception>& returnedException)
> {
>-    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
>+    VM& vm = exec->vm();
>+    JSGlobalObject* globalObject = vm.vmEntryGlobalObject(exec);
> 
>     if (scopeExtensionObject) {
>         JSScope* ignoredPreviousScope = globalObject->globalScope();
>-        globalObject->setGlobalScopeExtension(JSWithScope::create(exec->vm(), globalObject, ignoredPreviousScope, scopeExtensionObject));
>+        globalObject->setGlobalScopeExtension(JSWithScope::create(vm, globalObject, ignoredPreviousScope, scopeExtensionObject));
>     }
> 
>     JSValue returnValue = JSC::evaluate(globalObject->globalExec(), source, globalObject, returnedException);
>@@ -161,7 +163,7 @@ JSInternalPromise* loadAndEvaluateModule
>     RELEASE_ASSERT(vm.atomicStringTable() == Thread::current().atomicStringTable());
>     RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
> 
>-    return exec->vmEntryGlobalObject()->moduleLoader()->loadAndEvaluateModule(exec, identifierToJSValue(vm, Identifier::fromString(exec, moduleName)), parameters, scriptFetcher);
>+    return vm.vmEntryGlobalObject(exec)->moduleLoader()->loadAndEvaluateModule(exec, identifierToJSValue(vm, Identifier::fromString(exec, moduleName)), parameters, scriptFetcher);
> }
> 
> JSInternalPromise* loadAndEvaluateModule(ExecState* exec, const SourceCode& source, JSValue scriptFetcher)
>@@ -174,7 +176,7 @@ JSInternalPromise* loadAndEvaluateModule
> 
>     Symbol* key = createSymbolForEntryPointModule(vm);
> 
>-    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
>+    JSGlobalObject* globalObject = vm.vmEntryGlobalObject(exec);
> 
>     // Insert the given source code to the ModuleLoader registry as the fetched registry entry.
>     globalObject->moduleLoader()->provideFetch(exec, key, source);
>@@ -190,7 +192,7 @@ JSInternalPromise* loadModule(ExecState*
>     RELEASE_ASSERT(vm.atomicStringTable() == Thread::current().atomicStringTable());
>     RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
> 
>-    return exec->vmEntryGlobalObject()->moduleLoader()->loadModule(exec, identifierToJSValue(vm, Identifier::fromString(exec, moduleName)), parameters, scriptFetcher);
>+    return vm.vmEntryGlobalObject(exec)->moduleLoader()->loadModule(exec, identifierToJSValue(vm, Identifier::fromString(exec, moduleName)), parameters, scriptFetcher);
> }
> 
> JSInternalPromise* loadModule(ExecState* exec, const SourceCode& source, JSValue scriptFetcher)
>@@ -203,7 +205,7 @@ JSInternalPromise* loadModule(ExecState*
> 
>     Symbol* key = createSymbolForEntryPointModule(vm);
> 
>-    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
>+    JSGlobalObject* globalObject = vm.vmEntryGlobalObject(exec);
> 
>     // Insert the given source code to the ModuleLoader registry as the fetched registry entry.
>     // FIXME: Introduce JSSourceCode object to wrap around this source.
>@@ -220,7 +222,7 @@ JSValue linkAndEvaluateModule(ExecState*
>     RELEASE_ASSERT(vm.atomicStringTable() == Thread::current().atomicStringTable());
>     RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
> 
>-    JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
>+    JSGlobalObject* globalObject = vm.vmEntryGlobalObject(exec);
>     return globalObject->moduleLoader()->linkAndEvaluateModule(exec, identifierToJSValue(vm, moduleKey), scriptFetcher);
> }
> 
>@@ -231,7 +233,7 @@ JSInternalPromise* importModule(ExecStat
>     RELEASE_ASSERT(vm.atomicStringTable() == Thread::current().atomicStringTable());
>     RELEASE_ASSERT(!vm.isCollectorBusyOnCurrentThread());
> 
>-    return exec->vmEntryGlobalObject()->moduleLoader()->requestImportModule(exec, moduleKey, parameters, scriptFetcher);
>+    return vm.vmEntryGlobalObject(exec)->moduleLoader()->requestImportModule(exec, moduleKey, parameters, scriptFetcher);
> }
> 
> } // namespace JSC
>Index: Source/JavaScriptCore/runtime/ConstructData.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/ConstructData.cpp	(revision 235087)
>+++ Source/JavaScriptCore/runtime/ConstructData.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2008, 2016 Apple Inc. All Rights Reserved.
>+ * Copyright (C) 2008-2018 Apple Inc. All Rights Reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -58,7 +58,8 @@ JSObject* construct(ExecState* exec, JSV
> 
> JSObject* profiledConstruct(ExecState* exec, ProfilingReason reason, JSValue constructorObject, ConstructType constructType, const ConstructData& constructData, const ArgList& args, JSValue newTarget)
> {
>-    ScriptProfilingScope profilingScope(exec->vmEntryGlobalObject(), reason);
>+    VM& vm = exec->vm();
>+    ScriptProfilingScope profilingScope(vm.vmEntryGlobalObject(exec), reason);
>     return construct(exec, constructorObject, constructType, constructData, args, newTarget);
> }
> 
>Index: Source/JavaScriptCore/runtime/Error.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/Error.cpp	(revision 235087)
>+++ Source/JavaScriptCore/runtime/Error.cpp	(working copy)
>@@ -1,7 +1,7 @@
> /*
>  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
>  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
>- *  Copyright (C) 2003-2017 Apple Inc. All rights reserved.
>+ *  Copyright (C) 2003-2018 Apple Inc. All rights reserved.
>  *  Copyright (C) 2007 Eric Seidel (eric@webkit.org)
>  *
>  *  This library is free software; you can redistribute it and/or
>@@ -39,6 +39,7 @@
> #include "SourceCode.h"
> #include "StackFrame.h"
> #include "SuperSampler.h"
>+#include "VMInlines.h"
> 
> namespace JSC {
> 
>@@ -169,7 +170,7 @@ std::unique_ptr<Vector<StackFrame>> getS
>     std::unique_ptr<Vector<StackFrame>> stackTrace = std::make_unique<Vector<StackFrame>>();
>     vm.interpreter->getStackTrace(obj, *stackTrace, framesToSkip, errorConstructor->stackTraceLimit().value());
>     if (!stackTrace->isEmpty())
>-        ASSERT_UNUSED(exec, exec == vm.topCallFrame || exec == exec->lexicalGlobalObject()->globalExec() || exec == exec->vmEntryGlobalObject()->globalExec());
>+        ASSERT_UNUSED(exec, exec == vm.topCallFrame || exec->isGlobalExec());
>     return stackTrace;
> }
> 
>Index: Source/JavaScriptCore/runtime/ExceptionHelpers.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/ExceptionHelpers.cpp	(revision 235087)
>+++ Source/JavaScriptCore/runtime/ExceptionHelpers.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
>+ * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -29,7 +29,6 @@
> #include "config.h"
> #include "ExceptionHelpers.h"
> 
>-#include "CallFrame.h"
> #include "CatchScope.h"
> #include "CodeBlock.h"
> #include "ErrorHandlingScope.h"
>@@ -38,6 +37,7 @@
> #include "JSCInlines.h"
> #include "JSGlobalObjectFunctions.h"
> #include "RuntimeType.h"
>+#include "VMInlines.h"
> #include <wtf/text/StringBuilder.h>
> #include <wtf/text/StringView.h>
> 
>@@ -69,7 +69,9 @@ bool isTerminatedExecutionException(VM& 
> 
> JSObject* createStackOverflowError(ExecState* exec)
> {
>-    return createStackOverflowError(exec, exec->lexicalGlobalObject());
>+    VM& vm = exec->vm();
>+    JSGlobalObject* globalObject = vm.callerGlobalObjectForThrow(exec);
>+    return createStackOverflowError(exec, globalObject);
> }
> 
> JSObject* createStackOverflowError(ExecState* exec, JSGlobalObject* globalObject)
>Index: Source/JavaScriptCore/runtime/JSGeneratorFunction.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGeneratorFunction.h	(revision 235087)
>+++ Source/JavaScriptCore/runtime/JSGeneratorFunction.h	(working copy)
>@@ -32,7 +32,6 @@ namespace JSC {
> 
> class JSGlobalObject;
> class LLIntOffsetsExtractor;
>-class LLIntDesiredOffsets;
> 
> class JSGeneratorFunction final : public JSFunction {
>     friend class JIT;
>Index: Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObject.cpp	(revision 235087)
>+++ Source/JavaScriptCore/runtime/JSGlobalObject.cpp	(working copy)
>@@ -416,6 +416,9 @@ void JSGlobalObject::init(VM& vm)
>     ExecState::initGlobalExec(JSGlobalObject::globalExec(), globalCallee);
>     ExecState* exec = JSGlobalObject::globalExec();
> 
>+    JSCallee* skipFrameCallee = JSCallee::create(vm, this, globalScope());
>+    m_skipFrameCallee.set(vm, this, skipFrameCallee);
>+
>     m_hostFunctionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
> 
>     auto initFunctionStructures = [&] (FunctionStructures& structures) {
>@@ -1327,6 +1330,7 @@ void JSGlobalObject::visitChildren(JSCel
>     visitor.append(thisObject->m_globalLexicalEnvironment);
>     visitor.append(thisObject->m_globalScopeExtension);
>     visitor.append(thisObject->m_globalCallee);
>+    visitor.append(thisObject->m_skipFrameCallee);
>     visitor.append(thisObject->m_regExpConstructor);
>     visitor.append(thisObject->m_errorConstructor);
>     visitor.append(thisObject->m_nativeErrorPrototypeStructure);
>Index: Source/JavaScriptCore/runtime/JSGlobalObject.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObject.h	(revision 235087)
>+++ Source/JavaScriptCore/runtime/JSGlobalObject.h	(working copy)
>@@ -83,6 +83,7 @@ class InputCursor;
> class JSArrayBuffer;
> class JSArrayBufferConstructor;
> class JSArrayBufferPrototype;
>+class JSCallee;
> class JSGlobalObjectDebuggable;
> class JSInternalPromise;
> class JSModuleLoader;
>@@ -256,7 +257,8 @@ public:
> 
>     WriteBarrier<JSGlobalLexicalEnvironment> m_globalLexicalEnvironment;
>     WriteBarrier<JSScope> m_globalScopeExtension;
>-    WriteBarrier<JSObject> m_globalCallee;
>+    WriteBarrier<JSCallee> m_globalCallee;
>+    WriteBarrier<JSCallee> m_skipFrameCallee;
>     WriteBarrier<RegExpConstructor> m_regExpConstructor;
>     WriteBarrier<ErrorConstructor> m_errorConstructor;
>     WriteBarrier<Structure> m_nativeErrorPrototypeStructure;
>@@ -442,6 +444,8 @@ public:
> 
>     WeakRandom m_weakRandom;
> 
>+    JSCallee* skipFrameCallee() const { return m_skipFrameCallee.get(); }
>+
>     InlineWatchpointSet& arrayIteratorProtocolWatchpoint() { return m_arrayIteratorProtocolWatchpoint; }
>     InlineWatchpointSet& mapIteratorProtocolWatchpoint() { return m_mapIteratorProtocolWatchpoint; }
>     InlineWatchpointSet& setIteratorProtocolWatchpoint() { return m_setIteratorProtocolWatchpoint; }
>Index: Source/JavaScriptCore/runtime/VM.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/VM.cpp	(revision 235087)
>+++ Source/JavaScriptCore/runtime/VM.cpp	(working copy)
>@@ -826,15 +826,16 @@ void VM::clearSourceProviderCaches()
> 
> void VM::throwException(ExecState* exec, Exception* exception)
> {
>+    ASSERT_UNUSED(exec, exec == topCallFrame || exec->isGlobalExec());
>+    CallFrame* throwFrame = exec->isGlobalExec() ? exec : topJSCallFrame();
>+
>     if (Options::breakOnThrow()) {
>-        CodeBlock* codeBlock = exec->codeBlock();
>-        dataLog("Throwing exception in call frame ", RawPointer(exec), " for code block ", codeBlock, "\n");
>+        CodeBlock* codeBlock = throwFrame ? throwFrame->codeBlock() : nullptr;
>+        dataLog("Throwing exception in call frame ", RawPointer(throwFrame), " for code block ", codeBlock, "\n");
>         CRASH();
>     }
> 
>-    ASSERT(exec == topCallFrame || exec == exec->lexicalGlobalObject()->globalExec() || exec == exec->vmEntryGlobalObject()->globalExec());
>-
>-    interpreter->notifyDebuggerOfExceptionToBeThrown(*this, exec, exception);
>+    interpreter->notifyDebuggerOfExceptionToBeThrown(*this, throwFrame, exception);
> 
>     setException(exception);
> 
>@@ -1263,4 +1264,37 @@ void VM::clearScratchBuffers()
>         scratchBuffer->setActiveLength(0);
> }
> 
>+JSGlobalObject* VM::callerGlobalObjectForThrow(const CallFrame* callFrame) const
>+{
>+    auto calleeForComputingGlobalObject = [] (const VM& vm, const CallFrame* callFrame) {
>+        if (callFrame->isGlobalExec())
>+            return callFrame->jsCallee();
>+
>+        EntryFrame* entryFrame = vm.topEntryFrame;
>+        do {
>+            callFrame = callFrame->callerFrame(entryFrame);
>+        } while (callFrame && callFrame->callee().isWasm());
>+
>+        if (callFrame)
>+            return callFrame->jsCallee();
>+
>+        return vmEntryRecord(vm.topEntryFrame)->m_callee;
>+    };
>+
>+    return calleeForComputingGlobalObject(*this, callFrame)->globalObject();
>+}
>+
>+JSGlobalObject* VM::vmEntryGlobalObject(const CallFrame* callFrame) const
>+{
>+    if (callFrame && callFrame->isGlobalExec()) {
>+        RELEASE_ASSERT(callFrame->callee().isCell() && callFrame->callee().asCell()->isObject()); // mlam Make ASSERT
>+        RELEASE_ASSERT(callFrame == callFrame->lexicalGlobalObject()->globalExec()); // mlam Make ASSERT
>+        return callFrame->lexicalGlobalObject();
>+    }
>+    RELEASE_ASSERT(entryScope); // mlam Make ASSERT
>+    return entryScope->globalObject();
>+//    RELEASE_ASSERT(topEntryFrame);
>+//    return vmEntryRecord(topEntryFrame)->m_callee->globalObject();
>+}
>+
> } // namespace JSC
>Index: Source/JavaScriptCore/runtime/VM.h
>===================================================================
>--- Source/JavaScriptCore/runtime/VM.h	(revision 235087)
>+++ Source/JavaScriptCore/runtime/VM.h	(working copy)
>@@ -51,7 +51,6 @@
> #include "SmallStrings.h"
> #include "Strong.h"
> #include "StructureCache.h"
>-#include "VMEntryRecord.h"
> #include "VMTraps.h"
> #include "WasmContext.h"
> #include "Watchpoint.h"
>@@ -168,10 +167,13 @@ namespace DOMJIT {
> class Signature;
> }
> 
>+struct EntryFrame;
> struct HashTable;
> struct Instruction;
> struct ValueProfile;
> 
>+typedef ExecState CallFrame;
>+
> struct LocalTimeOffsetCache {
>     LocalTimeOffsetCache()
>         : start(0.0)
>@@ -293,6 +295,12 @@ public:
>     unsigned id() const { return m_id; }
>     bool isEntered() const { return !!entryScope; }
> 
>+    inline CallFrame* topJSCallFrame() const;
>+    JSGlobalObject* callerGlobalObjectForThrow(const CallFrame*) const;
>+
>+    // Global object in which execution began.
>+    JS_EXPORT_PRIVATE JSGlobalObject* vmEntryGlobalObject(const CallFrame*) const;
>+
> private:
>     unsigned nextID();
> 
>Index: Source/JavaScriptCore/runtime/VMInlines.h
>===================================================================
>--- Source/JavaScriptCore/runtime/VMInlines.h	(revision 235087)
>+++ Source/JavaScriptCore/runtime/VMInlines.h	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
>+ * Copyright (C) 2015-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -25,6 +25,8 @@
> 
> #pragma once
> 
>+#include "CallFrameInlines.h"
>+#include "EntryFrame.h"
> #include "ProfilerDatabase.h"
> #include "VM.h"
> #include "Watchdog.h"
>@@ -60,4 +62,19 @@ void VM::logEvent(CodeBlock* codeBlock, 
>     m_perBytecodeProfiler->logEvent(codeBlock, summary, func());
> }
> 
>+inline CallFrame* VM::topJSCallFrame() const
>+{
>+    CallFrame* frame = topCallFrame;
>+    if (!frame)
>+        return frame;
>+    if (!frame->isWasmFrame() && !frame->isSkipFrame())
>+        return frame;
>+    EntryFrame* entryFrame = topEntryFrame;
>+    do {
>+        frame = frame->callerFrame(entryFrame);
>+        ASSERT(!frame || !frame->isSkipFrame());
>+    } while (frame && frame->isWasmFrame());
>+    return frame;
>+}
>+
> } // namespace JSC
>Index: Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
>===================================================================
>--- Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp	(revision 235087)
>+++ Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp	(working copy)
>@@ -1,5 +1,6 @@
> /*
>  * Copyright (C) 2007, 2013 Alexey Proskuryakov (ap@nypop.com)
>+ * Copyright (C) 2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -51,7 +52,8 @@ ExceptionOr<Ref<JSCustomXPathNSResolver>
>     if (!resolverObject)
>         return Exception { TypeMismatchError };
> 
>-    return adoptRef(*new JSCustomXPathNSResolver(state.vm(), resolverObject, asJSDOMWindow(state.vmEntryGlobalObject())));
>+    VM& vm = state.vm();
>+    return adoptRef(*new JSCustomXPathNSResolver(vm, resolverObject, asJSDOMWindow(vm.vmEntryGlobalObject(&state))));
> }
> 
> JSCustomXPathNSResolver::JSCustomXPathNSResolver(VM& vm, JSObject* customResolver, JSDOMWindow* globalObject)
>Index: Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
>===================================================================
>--- Source/WebCore/bindings/js/JSDOMGlobalObject.cpp	(revision 235087)
>+++ Source/WebCore/bindings/js/JSDOMGlobalObject.cpp	(working copy)
>@@ -304,7 +304,8 @@ JSDOMGlobalObject& callerGlobalObject(Ex
> 
>     GetCallerGlobalObjectFunctor iter;
>     state.iterate(iter);
>-    return *jsCast<JSDOMGlobalObject*>(iter.globalObject() ? iter.globalObject() : state.vmEntryGlobalObject());
>+    VM& vm = state.vm();
>+    return *jsCast<JSDOMGlobalObject*>(iter.globalObject() ? iter.globalObject() : vm.vmEntryGlobalObject(&state));
> }
> 
> JSDOMGlobalObject* toJSDOMGlobalObject(ScriptExecutionContext& context, DOMWrapperWorld& world)
>Index: Source/WebCore/bindings/js/JSDOMWindowBase.cpp
>===================================================================
>--- Source/WebCore/bindings/js/JSDOMWindowBase.cpp	(revision 235087)
>+++ Source/WebCore/bindings/js/JSDOMWindowBase.cpp	(working copy)
>@@ -1,7 +1,7 @@
> /*
>  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
>  *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
>- *  Copyright (C) 2003-2017 Apple Inc. All rights reseved.
>+ *  Copyright (C) 2003-2018 Apple Inc. All rights reseved.
>  *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
>  *  Copyright (c) 2015 Canon Inc. All rights reserved.
>  *
>@@ -269,7 +269,8 @@ DOMWindow& activeDOMWindow(ExecState& st
> 
> DOMWindow& firstDOMWindow(ExecState& state)
> {
>-    return asJSDOMWindow(state.vmEntryGlobalObject())->wrapped();
>+    VM& vm = state.vm();
>+    return asJSDOMWindow(vm.vmEntryGlobalObject(&state))->wrapped();
> }
> 
> Document* responsibleDocument(ExecState& state)
>Index: Source/WebCore/bridge/c/c_utility.cpp
>===================================================================
>--- Source/WebCore/bridge/c/c_utility.cpp	(revision 235087)
>+++ Source/WebCore/bridge/c/c_utility.cpp	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2004, 2006, 2013 Apple Inc.  All rights reserved.
>+ * Copyright (C) 2004-2018 Apple Inc.  All rights reserved.
>  * Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
>  *
>  * Redistribution and use in source and binary forms, with or without
>@@ -96,7 +96,8 @@ void convertValueToNPVariant(ExecState* 
>                 OBJECT_TO_NPVARIANT(obj, *result);
>             }
>         } else {
>-            JSGlobalObject* globalObject = exec->vmEntryGlobalObject();
>+            VM& vm = exec->vm();
>+            JSGlobalObject* globalObject = vm.vmEntryGlobalObject(exec);
> 
>             RootObject* rootObject = findRootObject(globalObject);
>             if (rootObject) {
>Index: Source/WebCore/bridge/objc/WebScriptObject.mm
>===================================================================
>--- Source/WebCore/bridge/objc/WebScriptObject.mm	(revision 235087)
>+++ Source/WebCore/bridge/objc/WebScriptObject.mm	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
>+ * Copyright (C) 2004-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -122,7 +122,8 @@ id createJSWrapper(JSC::JSObject* object
> 
> static void addExceptionToConsole(ExecState* exec, JSC::Exception* exception)
> {
>-    JSDOMWindow* window = asJSDOMWindow(exec->vmEntryGlobalObject());
>+    JSC::VM& vm = exec->vm();
>+    JSDOMWindow* window = asJSDOMWindow(vm.vmEntryGlobalObject(exec));
>     if (!window || !exception)
>         return;
>     reportException(exec, exception);
>Index: Source/WebCore/bridge/objc/objc_instance.mm
>===================================================================
>--- Source/WebCore/bridge/objc/objc_instance.mm	(revision 235087)
>+++ Source/WebCore/bridge/objc/objc_instance.mm	(working copy)
>@@ -88,7 +88,7 @@ void ObjcInstance::moveGlobalExceptionTo
>         return;
>     }
> 
>-    if (!s_exceptionEnvironment || s_exceptionEnvironment == exec->vmEntryGlobalObject()) {
>+    if (!s_exceptionEnvironment || s_exceptionEnvironment == vm.vmEntryGlobalObject(exec)) {
>         JSLockHolder lock(exec);
>         throwError(exec, scope, s_exception);
>     }
>Index: Source/WebCore/bridge/objc/objc_runtime.mm
>===================================================================
>--- Source/WebCore/bridge/objc/objc_runtime.mm	(revision 235087)
>+++ Source/WebCore/bridge/objc/objc_runtime.mm	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2004, 2008, 2013, 2016 Apple Inc. All rights reserved.
>+ * Copyright (C) 2004-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -122,7 +122,8 @@ JSValue ObjcField::valueFromInstance(Exe
> 
> static id convertValueToObjcObject(ExecState* exec, JSValue value)
> {
>-    RefPtr<RootObject> rootObject = findRootObject(exec->vmEntryGlobalObject());
>+    VM& vm = exec->vm();
>+    RefPtr<RootObject> rootObject = findRootObject(vm.vmEntryGlobalObject(exec));
>     if (!rootObject)
>         return nil;
>     return [webScriptObjectClass() _convertValueToObjcValue:value originRootObject:rootObject.get() rootObject:rootObject.get()];
>Index: Source/WebCore/bridge/objc/objc_utility.mm
>===================================================================
>--- Source/WebCore/bridge/objc/objc_utility.mm	(revision 235087)
>+++ Source/WebCore/bridge/objc/objc_utility.mm	(working copy)
>@@ -80,17 +80,18 @@ ObjcValue convertValueToObjcValue(ExecSt
> {
>     ObjcValue result;
>     double d = 0;
>+    VM& vm = exec->vm();
> 
>     if (value.isNumber() || value.isString() || value.isBoolean()) {
>-        JSLockHolder lock(exec);
>+        JSLockHolder lock(vm);
>         d = value.toNumber(exec);
>     }
> 
>     switch (type) {
>         case ObjcObjectType: {
>-            JSLockHolder lock(exec);
>+            JSLockHolder lock(vm);
>             
>-            JSGlobalObject *originGlobalObject = exec->vmEntryGlobalObject();
>+            JSGlobalObject *originGlobalObject = vm.vmEntryGlobalObject(exec);
>             RootObject* originRootObject = findRootObject(originGlobalObject);
> 
>             JSGlobalObject* globalObject = 0;
>Index: Source/WebCore/testing/Internals.cpp
>===================================================================
>--- Source/WebCore/testing/Internals.cpp	(revision 235087)
>+++ Source/WebCore/testing/Internals.cpp	(working copy)
>@@ -4122,7 +4122,7 @@ bool Internals::isReadableStreamDisturbe
> JSValue Internals::cloneArrayBuffer(JSC::ExecState& state, JSValue buffer, JSValue srcByteOffset, JSValue srcLength)
> {
>     JSC::VM& vm = state.vm();
>-    JSGlobalObject* globalObject = state.vmEntryGlobalObject();
>+    JSGlobalObject* globalObject = vm.vmEntryGlobalObject(&state);
>     JSVMClientData* clientData = static_cast<JSVMClientData*>(vm.clientData);
>     const Identifier& privateName = clientData->builtinNames().cloneArrayBufferPrivateName();
>     JSValue value;
>Index: Source/WebKitLegacy/mac/WebView/WebScriptDebugger.mm
>===================================================================
>--- Source/WebKitLegacy/mac/WebView/WebScriptDebugger.mm	(revision 235087)
>+++ Source/WebKitLegacy/mac/WebView/WebScriptDebugger.mm	(working copy)
>@@ -1,5 +1,5 @@
> /*
>- * Copyright (C) 2008-2013 Apple Inc. All rights reserved.
>+ * Copyright (C) 2008-2018 Apple Inc. All rights reserved.
>  *
>  * Redistribution and use in source and binary forms, with or without
>  * modification, are permitted provided that the following conditions
>@@ -93,7 +93,8 @@ void WebScriptDebugger::sourceParsed(Exe
>     NSURL *nsURL = toNSURL(sourceProvider->url());
>     int firstLine = sourceProvider->startPosition().m_line.oneBasedInt();
> 
>-    WebFrame *webFrame = toWebFrame(exec->vmEntryGlobalObject());
>+    VM& vm = exec->vm();
>+    WebFrame *webFrame = toWebFrame(vm.vmEntryGlobalObject(exec));
>     WebView *webView = [webFrame webView];
>     WebScriptDebugDelegateImplementationCache* implementations = WebViewGetScriptDebugDelegateImplementations(webView);
> 
>Index: LayoutTests/ChangeLog
>===================================================================
>--- LayoutTests/ChangeLog	(revision 235087)
>+++ LayoutTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2018-08-20  Mark Lam  <mark.lam@apple.com>
>+
>+        Fix exception throwing code so that topCallFrame and topEntryFrame stay true to their names.
>+        https://bugs.webkit.org/show_bug.cgi?id=188577
>+        <rdar://problem/42985684>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * http/tests/misc/large-js-program-expected.txt:
>+
> 2018-08-20  Eric Carlson  <eric.carlson@apple.com>
> 
>         [MediaStream] Move capture device monitoring to WebKit
>Index: LayoutTests/http/tests/misc/large-js-program-expected.txt
>===================================================================
>--- LayoutTests/http/tests/misc/large-js-program-expected.txt	(revision 235087)
>+++ LayoutTests/http/tests/misc/large-js-program-expected.txt	(working copy)
>@@ -1,4 +1,4 @@
>-CONSOLE MESSAGE: line 27: RangeError: Maximum call stack size exceeded.
>+CONSOLE MESSAGE: RangeError: Maximum call stack size exceeded.
> This tests verifies that a large program doesn't crash JavaScript.
> 
> This test should generate an out of stack exception, but have no other output.

Flags:

ews-watchlist: commit-queue-

Actions: View | Formatted Diff | Diff

Attachments on bug 188577: 347320 | 347321 | 347329 | 347330 | 347332 | 347364 | 347370 | 347372 | 347523 | 347542 | 347574 | 347604 | 348021 | 348047 | 348059