635811 - prevent call objects from escaping on error paths

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Luke Wagner [:luke]]

Once Invoke/Execute/etc have created the call object for a frame, PutActivationObjects must be called.  Currently, this is done in ScriptEpilogue, but if there is an error before ScriptPrologue is called, then ScriptEpilogue is not called.  This was the source of bug 634452.  I think the fix is just to move the PutActivationObjects call out of ScriptEpilogue and into the frame-popping logic.  The tricky part is making sure the mjit/tjit transition code does the right thing.  Doing this will also avoid the temporary hack needed to fix bug 635805.

Comment 1

[Luke Wagner [:luke]]

Attachment: fix the hack

Ah, gag, thanks Jesse.  Bug 635805 is going to fix all this and make this explicit PutActivationObjects business unnecessary, but might as well fix the temporary fix first.

Comment 2

[Luke Wagner [:luke]]

Oops, disregard comment 1; wrong bug.

Comment 3

[Luke Wagner [:luke]]

Another rare corner case that should be fixed by this patch is that of activation objects not being put in some cases of generator closing.

Comment 4

[Luke Wagner [:luke]]

Attachment: assert of doom

If I apply this patch (which simply asserts !fp->hasCallObj() on exiting RunScript) I get oodles of failures in the current jit tests.  I am going to forgo the beautifying fat stack of patches I was cooking up yesterday in lieu of a simple spot fix which can land for 4.0 (bug 635599 is a final+ hardblocker and a dup of this).

Comment 6

[Luke Wagner [:luke]]

Attachment: fix

Comment 7

[Luke Wagner [:luke]]

http://hg.mozilla.org/mozilla-central/rev/f4d6657f3439