[CVE-2018-8380] Edge - Incorrect callinfo on inlineeFrame on an exception - Google, Inc

Meghana Gupta · aneeshdk · commit 15bd39993cff · 2018-08-13T15:48:39.000-07:00
diff --git a/lib/Runtime/Base/ThreadContext.cpp b/lib/Runtime/Base/ThreadContext.cpp
@@ -124,7 +124,7 @@ ThreadContext::ThreadContext(AllocationPolicyManager * allocationPolicyManager,
     entryExitRecord(nullptr),
     leafInterpreterFrame(nullptr),
     threadServiceWrapper(nullptr),
-    tryCatchFrameAddr(nullptr),
+    tryHandlerAddrOfReturnAddr(nullptr),
     temporaryArenaAllocatorCount(0),
     temporaryGuestArenaAllocatorCount(0),
     crefSContextForDiag(0),
diff --git a/lib/Runtime/Base/ThreadContext.h b/lib/Runtime/Base/ThreadContext.h
@@ -667,7 +667,7 @@ class ThreadContext sealed :
     ThreadServiceWrapper* threadServiceWrapper;
     uint functionCount;
     uint sourceInfoCount;
-    void * tryCatchFrameAddr;
+    void * tryHandlerAddrOfReturnAddr;
     enum RedeferralState
     {
         InitialRedeferralState,
@@ -1268,8 +1268,8 @@ class ThreadContext sealed :
     uint EnterScriptStart(Js::ScriptEntryExitRecord *, bool doCleanup);
     void EnterScriptEnd(Js::ScriptEntryExitRecord *, bool doCleanup);
 
-    void * GetTryCatchFrameAddr() { return this->tryCatchFrameAddr; }
-    void SetTryCatchFrameAddr(void * frameAddr) { this->tryCatchFrameAddr = frameAddr; }
+    void * GetTryHandlerAddrOfReturnAddr() { return this->tryHandlerAddrOfReturnAddr; }
+    void SetTryHandlerAddrOfReturnAddr(void * addrOfReturnAddr) { this->tryHandlerAddrOfReturnAddr = addrOfReturnAddr; }
 
     template <bool leaveForHost>
     void LeaveScriptStart(void *);
diff --git a/lib/Runtime/Language/InterpreterStackFrame.cpp b/lib/Runtime/Language/InterpreterStackFrame.cpp
@@ -6492,6 +6492,8 @@ namespace Js
             this->OrFlags(InterpreterStackFrameFlags_WithinTryBlock);
 
             Js::JavascriptExceptionOperators::AutoCatchHandlerExists autoCatchHandlerExists(scriptContext);
+            void * addrOfReturnAddr = _AddressOfReturnAddress();
+            Js::JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack tryHandlerAddrOfReturnAddrStack(scriptContext, addrOfReturnAddr);
 
 #ifdef ENABLE_SCRIPT_DEBUGGING
             if (this->IsInDebugMode())
diff --git a/lib/Runtime/Language/JavascriptExceptionOperators.cpp b/lib/Runtime/Language/JavascriptExceptionOperators.cpp
@@ -69,16 +69,16 @@ namespace Js
         m_threadContext->SetIsUserCode(m_previousCatchHandlerToUserCodeStatus);
     }
 
-    JavascriptExceptionOperators::TryCatchFrameAddrStack::TryCatchFrameAddrStack(ScriptContext* scriptContext, void *frameAddr)
+    JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack::TryHandlerAddrOfReturnAddrStack(ScriptContext* scriptContext, void *addrOfReturnAddr)
     {
         m_threadContext = scriptContext->GetThreadContext();
-        m_prevTryCatchFrameAddr = m_threadContext->GetTryCatchFrameAddr();
-        scriptContext->GetThreadContext()->SetTryCatchFrameAddr(frameAddr);
+        m_prevTryHandlerAddrOfReturnAddr = m_threadContext->GetTryHandlerAddrOfReturnAddr();
+        scriptContext->GetThreadContext()->SetTryHandlerAddrOfReturnAddr(addrOfReturnAddr);
     }
 
-    JavascriptExceptionOperators::TryCatchFrameAddrStack::~TryCatchFrameAddrStack()
+    JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack::~TryHandlerAddrOfReturnAddrStack()
     {
-        m_threadContext->SetTryCatchFrameAddr(m_prevTryCatchFrameAddr);
+        m_threadContext->SetTryHandlerAddrOfReturnAddr(m_prevTryHandlerAddrOfReturnAddr);
     }
 
     JavascriptExceptionOperators::HasBailedOutPtrStack::HasBailedOutPtrStack(ScriptContext* scriptContext, bool *hasBailedOutPtr)
@@ -125,13 +125,14 @@ namespace Js
     {
         void *continuation = nullptr;
         JavascriptExceptionObject *exception = nullptr;
-        void *tryCatchFrameAddr = nullptr;
+        void *tryHandlerAddrOfReturnAddr = nullptr;
 
         Js::JavascriptExceptionOperators::HasBailedOutPtrStack hasBailedOutPtrStack(scriptContext, (bool*)((char*)frame + hasBailedOutOffset));
 
         PROBE_STACK(scriptContext, Constants::MinStackJitEHBailout + spillSize + argsSize);
         {
-            Js::JavascriptExceptionOperators::TryCatchFrameAddrStack tryCatchFrameAddrStack(scriptContext, frame);
+            void * addrOfReturnAddr = (void*)((char*)frame + sizeof(char*));
+            Js::JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack tryHandlerAddrOfReturnAddrStack(scriptContext, addrOfReturnAddr);
             try
             {
                 Js::JavascriptExceptionOperators::AutoCatchHandlerExists autoCatchHandlerExists(scriptContext);
@@ -140,8 +141,7 @@ namespace Js
             catch (const Js::JavascriptException& err)
             {
                 exception = err.GetAndClear();
-                tryCatchFrameAddr = scriptContext->GetThreadContext()->GetTryCatchFrameAddr();
-                Assert(frame == tryCatchFrameAddr);
+                tryHandlerAddrOfReturnAddr = scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr();
             }
         }
         if (exception)
@@ -157,7 +157,7 @@ namespace Js
 #if ENABLE_NATIVE_CODEGEN
             if (exception->GetExceptionContext() && exception->GetExceptionContext()->ThrowingFunction())
             {
-                WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryCatchFrameAddr);
+                WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryHandlerAddrOfReturnAddr);
             }
 #endif
 
@@ -212,11 +212,11 @@ namespace Js
         if (exception)
         {
 #if ENABLE_NATIVE_CODEGEN
-            if (scriptContext->GetThreadContext()->GetTryCatchFrameAddr() != nullptr)
+            if (scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr() != nullptr)
             {
                 if (exception->GetExceptionContext() && exception->GetExceptionContext()->ThrowingFunction())
                 {
-                    WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryCatchFrameAddr());
+                    WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr());
                 }
             }
             else
@@ -295,13 +295,13 @@ namespace Js
     {
         void *continuation = nullptr;
         JavascriptExceptionObject *exception = nullptr;
-        void * tryCatchFrameAddr = nullptr;
+        void * tryHandlerAddrOfReturnAddr = nullptr;
         Js::JavascriptExceptionOperators::HasBailedOutPtrStack hasBailedOutPtrStack(scriptContext, (bool*)((char*)localsPtr + hasBailedOutOffset));
 
         PROBE_STACK(scriptContext, Constants::MinStackJitEHBailout + argsSize);
         {
-            Js::JavascriptExceptionOperators::TryCatchFrameAddrStack tryCatchFrameAddrStack(scriptContext, framePtr);
-
+            void * addrOfReturnAddr = (void*)((char*)framePtr + sizeof(char*));
+            Js::JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack tryHandlerAddrOfReturnAddrStack(scriptContext, addrOfReturnAddr);
             try
             {
                 Js::JavascriptExceptionOperators::AutoCatchHandlerExists autoCatchHandlerExists(scriptContext);
@@ -314,8 +314,7 @@ namespace Js
             catch (const Js::JavascriptException& err)
             {
                 exception = err.GetAndClear();
-                tryCatchFrameAddr = scriptContext->GetThreadContext()->GetTryCatchFrameAddr();
-                Assert(framePtr == tryCatchFrameAddr);
+                tryHandlerAddrOfReturnAddr = scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr();
             }
         }
 
@@ -332,7 +331,7 @@ namespace Js
 #if ENABLE_NATIVE_CODEGEN
             if (exception->GetExceptionContext() && exception->GetExceptionContext()->ThrowingFunction())
             {
-                WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryCatchFrameAddr);
+                WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryHandlerAddrOfReturnAddr);
             }
 #endif
             exception = exception->CloneIfStaticExceptionObject(scriptContext);
@@ -387,11 +386,11 @@ namespace Js
         if (exception)
         {
 #if ENABLE_NATIVE_CODEGEN
-            if (scriptContext->GetThreadContext()->GetTryCatchFrameAddr() != nullptr)
+            if (scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr() != nullptr)
             {
                 if (exception->GetExceptionContext() && exception->GetExceptionContext()->ThrowingFunction())
                 {
-                    WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryCatchFrameAddr());
+                    WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr());
                 }
             }
             else
@@ -486,14 +485,14 @@ namespace Js
     {
         void* continuationAddr = NULL;
         Js::JavascriptExceptionObject* pExceptionObject = NULL;
-        void *tryCatchFrameAddr = nullptr;
+        void *tryHandlerAddrOfReturnAddr = nullptr;
 
         Js::JavascriptExceptionOperators::HasBailedOutPtrStack hasBailedOutPtrStack(scriptContext, (bool*)((char*)framePtr + hasBailedOutOffset));
 
         PROBE_STACK(scriptContext, Constants::MinStackJitEHBailout);
         {
-            Js::JavascriptExceptionOperators::TryCatchFrameAddrStack tryCatchFrameAddrStack(scriptContext, framePtr);
-
+            void * addrOfReturnAddr = (void*)((char*)framePtr + sizeof(char*));
+            Js::JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack tryHandlerAddrOfReturnAddrStack(scriptContext, addrOfReturnAddr);
             try
             {
                 Js::JavascriptExceptionOperators::AutoCatchHandlerExists autoCatchHandlerExists(scriptContext);
@@ -557,8 +556,7 @@ namespace Js
             catch (const Js::JavascriptException& err)
             {
                 pExceptionObject = err.GetAndClear();
-                tryCatchFrameAddr = scriptContext->GetThreadContext()->GetTryCatchFrameAddr();
-                Assert(framePtr == tryCatchFrameAddr);
+                tryHandlerAddrOfReturnAddr = scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr();
             }
         }
 
@@ -576,7 +574,7 @@ namespace Js
 #if ENABLE_NATIVE_CODEGEN
             if (pExceptionObject->GetExceptionContext() && pExceptionObject->GetExceptionContext()->ThrowingFunction())
             {
-                WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryCatchFrameAddr);
+                WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryHandlerAddrOfReturnAddr);
             }
 #endif
             pExceptionObject = pExceptionObject->CloneIfStaticExceptionObject(scriptContext);
@@ -722,11 +720,11 @@ namespace Js
         if (pExceptionObject)
         {
 #if ENABLE_NATIVE_CODEGEN
-            if (scriptContext->GetThreadContext()->GetTryCatchFrameAddr() != nullptr)
+            if (scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr() != nullptr)
             {
                 if (pExceptionObject->GetExceptionContext() && pExceptionObject->GetExceptionContext()->ThrowingFunction())
                 {
-                    WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryCatchFrameAddr());
+                    WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr());
                 }
             }
             else
@@ -1053,14 +1051,14 @@ namespace Js
     }
 #if ENABLE_NATIVE_CODEGEN
     // TODO: Add code address of throwing function on exception context, and use that for returnAddress instead of passing nullptr which starts stackwalk from the top
-    void JavascriptExceptionOperators::WalkStackForCleaningUpInlineeInfo(ScriptContext *scriptContext, PVOID returnAddress, PVOID tryCatchFrameAddr)
+    void JavascriptExceptionOperators::WalkStackForCleaningUpInlineeInfo(ScriptContext *scriptContext, PVOID returnAddress, PVOID tryHandlerAddrOfReturnAddr)
     {
-        Assert(tryCatchFrameAddr != nullptr);
+        Assert(tryHandlerAddrOfReturnAddr != nullptr);
         JavascriptStackWalker walker(scriptContext, /*useEERContext*/ true, returnAddress);
 
         // We have to walk the inlinee frames and clear callinfo count on them on an exception
         // At this point inlinedFrameWalker is closed, so we should build it again by calling InlinedFrameWalker::FromPhysicalFrame
-        walker.WalkAndClearInlineeFrameCallInfoOnException(tryCatchFrameAddr);
+        walker.WalkAndClearInlineeFrameCallInfoOnException(tryHandlerAddrOfReturnAddr);
     }
 #endif
     void
diff --git a/lib/Runtime/Language/JavascriptExceptionOperators.h b/lib/Runtime/Language/JavascriptExceptionOperators.h
@@ -43,15 +43,15 @@ namespace Js
             ~AutoCatchHandlerExists();
         };
 
-        class TryCatchFrameAddrStack
+        class TryHandlerAddrOfReturnAddrStack
         {
           private:
-            void * m_prevTryCatchFrameAddr;
+            void * m_prevTryHandlerAddrOfReturnAddr;
             ThreadContext* m_threadContext;
 
           public:
-            TryCatchFrameAddrStack(ScriptContext* scriptContext, void *frameAddr);
-            ~TryCatchFrameAddrStack();
+            TryHandlerAddrOfReturnAddrStack(ScriptContext* scriptContext, void *addrOfReturnAddr);
+            ~TryHandlerAddrOfReturnAddrStack();
         };
 
         class HasBailedOutPtrStack
diff --git a/lib/Runtime/Language/JavascriptStackWalker.cpp b/lib/Runtime/Language/JavascriptStackWalker.cpp
@@ -632,7 +632,7 @@ namespace Js
         return nullptr;
     }
 #if ENABLE_NATIVE_CODEGEN
-    void JavascriptStackWalker::WalkAndClearInlineeFrameCallInfoOnException(void *tryCatchFrameAddr)
+    void JavascriptStackWalker::WalkAndClearInlineeFrameCallInfoOnException(void *tryHandlerAddrOfReturnAddr)
     {
         // Walk the stack and when we find the first native frame, we clear the inlinee's callinfo for this frame
         // It is sufficient we stop at the first native frame which had the enclosing try-catch
@@ -649,10 +649,10 @@ namespace Js
                         inlinedFrame->callInfo.Clear();
                     }
                 }
-                if (this->currentFrame.GetFrame() == tryCatchFrameAddr)
-                {
-                    break;
-                }
+            }
+            if (this->currentFrame.GetAddressOfReturnAddress() == tryHandlerAddrOfReturnAddr)
+            {
+                break;
             }
         }
     }
diff --git a/lib/Runtime/Language/JavascriptStackWalker.h b/lib/Runtime/Language/JavascriptStackWalker.h
@@ -237,7 +237,7 @@ namespace Js
         void ClearCachedInternalFrameInfo();
         void SetCachedInternalFrameInfo(InternalFrameType frameType, JavascriptFunction* function, bool hasInlinedFramesOnStack, bool prevIntFrameIsFromBailout);
         InternalFrameInfo GetCachedInternalFrameInfo() const { return this->lastInternalFrameInfo; }
-        void WalkAndClearInlineeFrameCallInfoOnException(void *tryCatchFrameAddr);
+        void WalkAndClearInlineeFrameCallInfoOnException(void *tryHandlerAddrOfReturnAddr);
 #endif
         bool IsCurrentPhysicalFrameForLoopBody() const;
 

Original file line number	Diff line number	Diff line change
`@@ -69,16 +69,16 @@ namespace Js`
`69`	`69`	`m_threadContext->SetIsUserCode(m_previousCatchHandlerToUserCodeStatus);`
`70`	`70`	`}`
`71`	`71`
`72`		`- JavascriptExceptionOperators::TryCatchFrameAddrStack::TryCatchFrameAddrStack(ScriptContext* scriptContext, void *frameAddr)`
	`72`	`+ JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack::TryHandlerAddrOfReturnAddrStack(ScriptContext* scriptContext, void *addrOfReturnAddr)`
`73`	`73`	`{`
`74`	`74`	`m_threadContext = scriptContext->GetThreadContext();`
`75`		`- m_prevTryCatchFrameAddr = m_threadContext->GetTryCatchFrameAddr();`
`76`		`- scriptContext->GetThreadContext()->SetTryCatchFrameAddr(frameAddr);`
	`75`	`+ m_prevTryHandlerAddrOfReturnAddr = m_threadContext->GetTryHandlerAddrOfReturnAddr();`
	`76`	`+ scriptContext->GetThreadContext()->SetTryHandlerAddrOfReturnAddr(addrOfReturnAddr);`
`77`	`77`	`}`
`78`	`78`
`79`		`- JavascriptExceptionOperators::TryCatchFrameAddrStack::~TryCatchFrameAddrStack()`
	`79`	`+ JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack::~TryHandlerAddrOfReturnAddrStack()`
`80`	`80`	`{`
`81`		`- m_threadContext->SetTryCatchFrameAddr(m_prevTryCatchFrameAddr);`
	`81`	`+ m_threadContext->SetTryHandlerAddrOfReturnAddr(m_prevTryHandlerAddrOfReturnAddr);`
`82`	`82`	`}`
`83`	`83`
`84`	`84`	`JavascriptExceptionOperators::HasBailedOutPtrStack::HasBailedOutPtrStack(ScriptContext* scriptContext, bool *hasBailedOutPtr)`
`@@ -125,13 +125,14 @@ namespace Js`
`125`	`125`	`{`
`126`	`126`	`void *continuation = nullptr;`
`127`	`127`	`JavascriptExceptionObject *exception = nullptr;`
`128`		`- void *tryCatchFrameAddr = nullptr;`
	`128`	`+ void *tryHandlerAddrOfReturnAddr = nullptr;`
`129`	`129`
`130`	`130`	`Js::JavascriptExceptionOperators::HasBailedOutPtrStack hasBailedOutPtrStack(scriptContext, (bool)((char)frame + hasBailedOutOffset));`
`131`	`131`
`132`	`132`	`PROBE_STACK(scriptContext, Constants::MinStackJitEHBailout + spillSize + argsSize);`
`133`	`133`	`{`
`134`		`- Js::JavascriptExceptionOperators::TryCatchFrameAddrStack tryCatchFrameAddrStack(scriptContext, frame);`
	`134`	`+ void * addrOfReturnAddr = (void)((char)frame + sizeof(char*));`
	`135`	`+ Js::JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack tryHandlerAddrOfReturnAddrStack(scriptContext, addrOfReturnAddr);`
`135`	`136`	`try`
`136`	`137`	`{`
`137`	`138`	`Js::JavascriptExceptionOperators::AutoCatchHandlerExists autoCatchHandlerExists(scriptContext);`
`@@ -140,8 +141,7 @@ namespace Js`
`140`	`141`	`catch (const Js::JavascriptException& err)`
`141`	`142`	`{`
`142`	`143`	`exception = err.GetAndClear();`
`143`		`- tryCatchFrameAddr = scriptContext->GetThreadContext()->GetTryCatchFrameAddr();`
`144`		`- Assert(frame == tryCatchFrameAddr);`
	`144`	`+ tryHandlerAddrOfReturnAddr = scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr();`
`145`	`145`	`}`
`146`	`146`	`}`
`147`	`147`	`if (exception)`
`@@ -157,7 +157,7 @@ namespace Js`
`157`	`157`	`#if ENABLE_NATIVE_CODEGEN`
`158`	`158`	`if (exception->GetExceptionContext() && exception->GetExceptionContext()->ThrowingFunction())`
`159`	`159`	`{`
`160`		`- WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryCatchFrameAddr);`
	`160`	`+ WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryHandlerAddrOfReturnAddr);`
`161`	`161`	`}`
`162`	`162`	`#endif`
`163`	`163`
`@@ -212,11 +212,11 @@ namespace Js`
`212`	`212`	`if (exception)`
`213`	`213`	`{`
`214`	`214`	`#if ENABLE_NATIVE_CODEGEN`
`215`		`- if (scriptContext->GetThreadContext()->GetTryCatchFrameAddr() != nullptr)`
	`215`	`+ if (scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr() != nullptr)`
`216`	`216`	`{`
`217`	`217`	`if (exception->GetExceptionContext() && exception->GetExceptionContext()->ThrowingFunction())`
`218`	`218`	`{`
`219`		`- WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryCatchFrameAddr());`
	`219`	`+ WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr());`
`220`	`220`	`}`
`221`	`221`	`}`
`222`	`222`	`else`
`@@ -295,13 +295,13 @@ namespace Js`
`295`	`295`	`{`
`296`	`296`	`void *continuation = nullptr;`
`297`	`297`	`JavascriptExceptionObject *exception = nullptr;`
`298`		`- void * tryCatchFrameAddr = nullptr;`
	`298`	`+ void * tryHandlerAddrOfReturnAddr = nullptr;`
`299`	`299`	`Js::JavascriptExceptionOperators::HasBailedOutPtrStack hasBailedOutPtrStack(scriptContext, (bool)((char)localsPtr + hasBailedOutOffset));`
`300`	`300`
`301`	`301`	`PROBE_STACK(scriptContext, Constants::MinStackJitEHBailout + argsSize);`
`302`	`302`	`{`
`303`		`- Js::JavascriptExceptionOperators::TryCatchFrameAddrStack tryCatchFrameAddrStack(scriptContext, framePtr);`
`304`		`-`
	`303`	`+ void * addrOfReturnAddr = (void)((char)framePtr + sizeof(char*));`
	`304`	`+ Js::JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack tryHandlerAddrOfReturnAddrStack(scriptContext, addrOfReturnAddr);`
`305`	`305`	`try`
`306`	`306`	`{`
`307`	`307`	`Js::JavascriptExceptionOperators::AutoCatchHandlerExists autoCatchHandlerExists(scriptContext);`
`@@ -314,8 +314,7 @@ namespace Js`
`314`	`314`	`catch (const Js::JavascriptException& err)`
`315`	`315`	`{`
`316`	`316`	`exception = err.GetAndClear();`
`317`		`- tryCatchFrameAddr = scriptContext->GetThreadContext()->GetTryCatchFrameAddr();`
`318`		`- Assert(framePtr == tryCatchFrameAddr);`
	`317`	`+ tryHandlerAddrOfReturnAddr = scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr();`
`319`	`318`	`}`
`320`	`319`	`}`
`321`	`320`
`@@ -332,7 +331,7 @@ namespace Js`
`332`	`331`	`#if ENABLE_NATIVE_CODEGEN`
`333`	`332`	`if (exception->GetExceptionContext() && exception->GetExceptionContext()->ThrowingFunction())`
`334`	`333`	`{`
`335`		`- WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryCatchFrameAddr);`
	`334`	`+ WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryHandlerAddrOfReturnAddr);`
`336`	`335`	`}`
`337`	`336`	`#endif`
`338`	`337`	`exception = exception->CloneIfStaticExceptionObject(scriptContext);`
`@@ -387,11 +386,11 @@ namespace Js`
`387`	`386`	`if (exception)`
`388`	`387`	`{`
`389`	`388`	`#if ENABLE_NATIVE_CODEGEN`
`390`		`- if (scriptContext->GetThreadContext()->GetTryCatchFrameAddr() != nullptr)`
	`389`	`+ if (scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr() != nullptr)`
`391`	`390`	`{`
`392`	`391`	`if (exception->GetExceptionContext() && exception->GetExceptionContext()->ThrowingFunction())`
`393`	`392`	`{`
`394`		`- WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryCatchFrameAddr());`
	`393`	`+ WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr());`
`395`	`394`	`}`
`396`	`395`	`}`
`397`	`396`	`else`
`@@ -486,14 +485,14 @@ namespace Js`
`486`	`485`	`{`
`487`	`486`	`void* continuationAddr = NULL;`
`488`	`487`	`Js::JavascriptExceptionObject* pExceptionObject = NULL;`
`489`		`- void *tryCatchFrameAddr = nullptr;`
	`488`	`+ void *tryHandlerAddrOfReturnAddr = nullptr;`
`490`	`489`
`491`	`490`	`Js::JavascriptExceptionOperators::HasBailedOutPtrStack hasBailedOutPtrStack(scriptContext, (bool)((char)framePtr + hasBailedOutOffset));`
`492`	`491`
`493`	`492`	`PROBE_STACK(scriptContext, Constants::MinStackJitEHBailout);`
`494`	`493`	`{`
`495`		`- Js::JavascriptExceptionOperators::TryCatchFrameAddrStack tryCatchFrameAddrStack(scriptContext, framePtr);`
`496`		`-`
	`494`	`+ void * addrOfReturnAddr = (void)((char)framePtr + sizeof(char*));`
	`495`	`+ Js::JavascriptExceptionOperators::TryHandlerAddrOfReturnAddrStack tryHandlerAddrOfReturnAddrStack(scriptContext, addrOfReturnAddr);`
`497`	`496`	`try`
`498`	`497`	`{`
`499`	`498`	`Js::JavascriptExceptionOperators::AutoCatchHandlerExists autoCatchHandlerExists(scriptContext);`
`@@ -557,8 +556,7 @@ namespace Js`
`557`	`556`	`catch (const Js::JavascriptException& err)`
`558`	`557`	`{`
`559`	`558`	`pExceptionObject = err.GetAndClear();`
`560`		`- tryCatchFrameAddr = scriptContext->GetThreadContext()->GetTryCatchFrameAddr();`
`561`		`- Assert(framePtr == tryCatchFrameAddr);`
	`559`	`+ tryHandlerAddrOfReturnAddr = scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr();`
`562`	`560`	`}`
`563`	`561`	`}`
`564`	`562`
`@@ -576,7 +574,7 @@ namespace Js`
`576`	`574`	`#if ENABLE_NATIVE_CODEGEN`
`577`	`575`	`if (pExceptionObject->GetExceptionContext() && pExceptionObject->GetExceptionContext()->ThrowingFunction())`
`578`	`576`	`{`
`579`		`- WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryCatchFrameAddr);`
	`577`	`+ WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, tryHandlerAddrOfReturnAddr);`
`580`	`578`	`}`
`581`	`579`	`#endif`
`582`	`580`	`pExceptionObject = pExceptionObject->CloneIfStaticExceptionObject(scriptContext);`
`@@ -722,11 +720,11 @@ namespace Js`
`722`	`720`	`if (pExceptionObject)`
`723`	`721`	`{`
`724`	`722`	`#if ENABLE_NATIVE_CODEGEN`
`725`		`- if (scriptContext->GetThreadContext()->GetTryCatchFrameAddr() != nullptr)`
	`723`	`+ if (scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr() != nullptr)`
`726`	`724`	`{`
`727`	`725`	`if (pExceptionObject->GetExceptionContext() && pExceptionObject->GetExceptionContext()->ThrowingFunction())`
`728`	`726`	`{`
`729`		`- WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryCatchFrameAddr());`
	`727`	`+ WalkStackForCleaningUpInlineeInfo(scriptContext, nullptr /* start stackwalk from the current frame */, scriptContext->GetThreadContext()->GetTryHandlerAddrOfReturnAddr());`
`730`	`728`	`}`
`731`	`729`	`}`
`732`	`730`	`else`
`@@ -1053,14 +1051,14 @@ namespace Js`
`1053`	`1051`	`}`
`1054`	`1052`	`#if ENABLE_NATIVE_CODEGEN`
`1055`	`1053`	`// TODO: Add code address of throwing function on exception context, and use that for returnAddress instead of passing nullptr which starts stackwalk from the top`
`1056`		`- void JavascriptExceptionOperators::WalkStackForCleaningUpInlineeInfo(ScriptContext *scriptContext, PVOID returnAddress, PVOID tryCatchFrameAddr)`
	`1054`	`+ void JavascriptExceptionOperators::WalkStackForCleaningUpInlineeInfo(ScriptContext *scriptContext, PVOID returnAddress, PVOID tryHandlerAddrOfReturnAddr)`
`1057`	`1055`	`{`
`1058`		`- Assert(tryCatchFrameAddr != nullptr);`
	`1056`	`+ Assert(tryHandlerAddrOfReturnAddr != nullptr);`
`1059`	`1057`	`JavascriptStackWalker walker(scriptContext, /useEERContext/ true, returnAddress);`
`1060`	`1058`
`1061`	`1059`	`// We have to walk the inlinee frames and clear callinfo count on them on an exception`
`1062`	`1060`	`// At this point inlinedFrameWalker is closed, so we should build it again by calling InlinedFrameWalker::FromPhysicalFrame`
`1063`		`- walker.WalkAndClearInlineeFrameCallInfoOnException(tryCatchFrameAddr);`
	`1061`	`+ walker.WalkAndClearInlineeFrameCallInfoOnException(tryHandlerAddrOfReturnAddr);`
`1064`	`1062`	`}`
`1065`	`1063`	`#endif`
`1066`	`1064`	`void`
Original file line number	Diff line number	Diff line change
`@@ -632,7 +632,7 @@ namespace Js`
`632`	`632`	`return nullptr;`
`633`	`633`	`}`
`634`	`634`	`#if ENABLE_NATIVE_CODEGEN`
`635`		`- void JavascriptStackWalker::WalkAndClearInlineeFrameCallInfoOnException(void *tryCatchFrameAddr)`
	`635`	`+ void JavascriptStackWalker::WalkAndClearInlineeFrameCallInfoOnException(void *tryHandlerAddrOfReturnAddr)`
`636`	`636`	`{`
`637`	`637`	`// Walk the stack and when we find the first native frame, we clear the inlinee's callinfo for this frame`
`638`	`638`	`// It is sufficient we stop at the first native frame which had the enclosing try-catch`
`@@ -649,10 +649,10 @@ namespace Js`
`649`	`649`	`inlinedFrame->callInfo.Clear();`
`650`	`650`	`}`
`651`	`651`	`}`
`652`		`- if (this->currentFrame.GetFrame() == tryCatchFrameAddr)`
`653`		`- {`
`654`		`- break;`
`655`		`- }`
	`652`	`+ }`
	`653`	`+ if (this->currentFrame.GetAddressOfReturnAddress() == tryHandlerAddrOfReturnAddr)`
	`654`	`+ {`
	`655`	`+ break;`
`656`	`656`	`}`
`657`	`657`	`}`
`658`	`658`	`}`