Added another check in SafeStackFrameIterator.

src/frames.cc

Index: src/frames.cc
diff --git a/src/frames.cc b/src/frames.cc
index a7da25a63953d26dc13dcdfbe37fa1a063ea7b19..a9bbbede388f9197193412287781fa45b918c9e6 100644
--- a/src/frames.cc
+++ b/src/frames.cc
@@ -208,7 +208,9 @@ void SafeStackFrameIterator::Advance() {
   StackFrame* last_frame = iterator_.frame();
   Address last_sp = last_frame->sp(), last_fp = last_frame->fp();
   // Before advancing to the next stack frame, perform pointer validity tests
-  iteration_done_ = !IsValidFrame(last_frame) || !IsValidCaller(last_frame);
+  iteration_done_ = !IsValidFrame(last_frame) ||
+      !CanIterateHandles(last_frame, iterator_.handler()) ||
+      !IsValidCaller(last_frame);
   if (iteration_done_) return;
 
   iterator_.Advance();
@@ -219,6 +221,15 @@ void SafeStackFrameIterator::Advance() {
 }
 
 
+bool SafeStackFrameIterator::CanIterateHandles(StackFrame* frame,
+                                               StackHandler* handler) {
+  // If StackIterator iterates over StackHandles, verify that
+  // StackHandlerIterator can be instantiated (see StackHandlerIterator
+  // constructor.)
+  return !is_valid_top_ || (frame->sp() <= handler->address());
+}
+
+
 bool SafeStackFrameIterator::IsValidFrame(StackFrame* frame) const {
   return IsValidStackAddress(frame->sp()) && IsValidStackAddress(frame->fp()) &&
       // JavaScriptFrame uses function shared info to advance, hence it must