532887 - Sampler::sampleSpaceCheck might crash if the AS3 callback throws an exception

Status: VERIFIED FIXED

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Alexandru Chiculita]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-us) AppleWebKit/531.9 (KHTML, like Gecko) Version/4.0.3 Safari/531.9
Build Identifier: 8aaad35edfac

Sampler::sampleSpaceCheck doesn't have any TRY/CATCH block, so all the exceptions can go unhandled and crash later in avmplus::ExceptionFrame::throwException(avmplus::Exception*).

Reproducible: Sometimes

Steps to Reproduce:
1. add a callback that throws exceptions.
2. create many samples (by executing code) until the buffer is full and the callback kicks in.
3. The callback throws exception and the shell should crash.
Actual Results:  
crash

Expected Results:  
no crash

Comment 1

[Alexandru Chiculita]

It cannot be reproduced in shell because it already has a try/catch from the script.

I could reproduce it in AIR while profiling javascript that might not have any AS3 on the stack.

Comment 2

[Alexandru Chiculita]

Attachment: patch

Comment 3

[Lars T Hansen]

Comment on attachment 416410 [details] [diff] [review]
patch

Probably good enough - it does not seem worth the bother to propagate the exception any further.

I'll land the patch.

Comment 4

[Lars T Hansen]

redux changeset:   3275:69c5f43c524b

Comment 5

[Chris Peyer]

Engineering work item.  Marking as verified.