Bug 189300

Summary: Fix DeferredSourceDump to capture the caller bytecodeIndex instead of CodeOrigin.
Product: WebKit Reporter: Mark Lam <mark.lam>
Component: JavaScriptCoreAssignee: Mark Lam <mark.lam>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, fpizlo, keith_miller, msaboff, rmorisset, saam, tzagallo, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
proposed patch.
none
proposed patch. none

Description Mark Lam 2018-09-04 23:43:44 PDT 
At the time a DeferredSourceDump is instantiated, it captures a CodeOrigin value, which points to a InlineCallFrame in the DFG::Plan's m_inlineCallFrames set.  The DeferredSourceDump may be later used to dump the source of a failed compilation.  The DFG::Plan may have been destructed by then, and since the compilation failed, the InlineCallFrame is also destructed, which means DeferredSourceDump::dump() may be accessing freed memory.

DeferredSourceDump doesn't really need a CodeOrigin.  All it wants is the caller bytecodeIndex for the call to an inlined function.  Hence, we can fix this issue by changing DeferredSourceDump to capture the caller bytecodeIndex instead.

<rdar://problem/39681779>
Comment 1 Mark Lam 2018-09-04 23:56:14 PDT 
Created attachment 348898 [details]
proposed patch.
Comment 2 Mark Lam 2018-09-05 00:04:47 PDT 
Created attachment 348899 [details]
proposed patch.
Comment 3 Mark Lam 2018-09-05 12:54:04 PDT 
Comment on attachment 348899 [details]
proposed patch.

Thanks for the review.  Landing now.
Comment 4 WebKit Commit Bot 2018-09-05 13:21:22 PDT 
Comment on attachment 348899 [details]
proposed patch.

Clearing flags on attachment: 348899

Committed r235684: <https://trac.webkit.org/changeset/235684>
Comment 5 WebKit Commit Bot 2018-09-05 13:21:24 PDT 
All reviewed patches have been landed.  Closing bug.