Avoid asserting when computing line number for backtrace

With JSC asserts enabled (QtScript built without NDEBUG
defined), JSC::CodeBlock::getBytecodeIndex() would assert
because we sometimes called it with an address that was not
inside the range of the block's JIT code.

We never caught this bug because it just so happens that
even though the assert fails, the function returns a
result that causes our autotests to pass.

Check that the returnPC is in range and report lineNumber
-1 if not; this unifies the behavior of the interpreter
and JIT, even though it's not the result we want.

Task-number: QTBUG-17741
Reviewed-by: Olivier Goffart

1 files changed, 9 insertions, 1 deletions

diff --git a/src/script/api/qscriptcontextinfo.cpp b/src/script/api/qscriptcontextinfo.cpp
index 0f9de1d..182bc4a 100644
--- a/src/script/api/qscriptcontextinfo.cpp
+++ b/src/script/api/qscriptcontextinfo.cpp
@@ -159,12 +159,20 @@ QScriptContextInfoPrivate::QScriptContextInfoPrivate(const QScriptContext *conte
             JSC::CodeBlock *codeBlock = frame->codeBlock();
             if (returnPC && codeBlock && QScriptEnginePrivate::hasValidCodeBlockRegister(frame)) {
 #if ENABLE(JIT)
-                unsigned bytecodeOffset = codeBlock->getBytecodeIndex(frame, JSC::ReturnAddressPtr(returnPC));
+                JSC::JITCode code = codeBlock->getJITCode();
+                unsigned jitOffset = code.offsetOf(JSC::ReturnAddressPtr(returnPC).value());
+                // We can only use the JIT code offset if it's smaller than the JIT size;
+                // otherwise calling getBytecodeIndex() is meaningless.
+                if (jitOffset < code.size()) {
+                    unsigned bytecodeOffset = codeBlock->getBytecodeIndex(frame, JSC::ReturnAddressPtr(returnPC));
 #else
                 unsigned bytecodeOffset = returnPC - codeBlock->instructions().begin();
 #endif
                 bytecodeOffset--; //because returnPC is on the next instruction. We want the current one
                 lineNumber = codeBlock->lineNumberForBytecodeOffset(const_cast<JSC::ExecState *>(frame), bytecodeOffset);
+#if ENABLE(JIT)
+                }
+#endif
             }
         }
     }