Fix crash in SafeStackFrameIterator related to native frames entry/exit

test/cctest/test-cpu-profiler.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 408 matching lines @@
 
 
 static v8::CpuProfile* RunProfiler(v8::Local<v8::Context> env,
                                    v8::Local<v8::Function> function,
                                    v8::Local<v8::Value> argv[], int argc,
                                    unsigned min_js_samples,
                                    bool collect_samples = false) {
   v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
   v8::Local<v8::String> profile_name = v8_str("my_profile");
 
+  cpu_profiler->SetSamplingInterval(100);
   cpu_profiler->StartProfiling(profile_name, collect_samples);
 
   i::Sampler* sampler =
       reinterpret_cast<i::Isolate*>(env->GetIsolate())->logger()->sampler();
   sampler->StartCountingSamples();
   do {
     function->Call(env, env->Global(), argc, argv).ToLocalChecked();
   } while (sampler->js_and_external_sample_count() < min_js_samples);
 
   v8::CpuProfile* profile = cpu_profiler->StopProfiling(profile_name);
@@ skipping 91 matching lines @@
 static const ProfileNode* GetSimpleBranch(v8::Local<v8::Context> context,
                                           v8::CpuProfile* profile,
                                           const char* names[], int length) {
   const v8::CpuProfileNode* node = profile->GetTopDownRoot();
   for (int i = 0; i < length; i++) {
     node = GetChild(context, node, names[i]);
   }
   return reinterpret_cast<const ProfileNode*>(node);
 }
 
+static void CallCollectSample(const v8::FunctionCallbackInfo<v8::Value>& info) {
+  info.GetIsolate()->GetCpuProfiler()->CollectSample();
+}
 
 static const char* cpu_profiler_test_source = "function loop(timeout) {\n"
 "  this.mmm = 0;\n"
 "  var start = Date.now();\n"
 "  while (Date.now() - start < timeout) {\n"
 "    var n = 100*1000;\n"
 "    while(n > 1) {\n"
 "      n--;\n"
 "      this.mmm += n * n * n;\n"
 "    }\n"
@@ skipping 1051 matching lines @@
   GetChild(env, nativeNode2, "foo");
 
   profile->Delete();
 }
 
 static const char* js_force_collect_sample_source =
     "function start() {\n"
     "  CallCollectSample();\n"
     "}";
 
-static void CallCollectSample(const v8::FunctionCallbackInfo<v8::Value>& info) {
-  info.GetIsolate()->GetCpuProfiler()->CollectSample();
-}
-
 TEST(CollectSampleAPI) {
   v8::HandleScope scope(CcTest::isolate());
   v8::Local<v8::Context> env = CcTest::NewContext(PROFILER_EXTENSION);
   v8::Context::Scope context_scope(env);
 
   v8::Local<v8::FunctionTemplate> func_template =
       v8::FunctionTemplate::New(env->GetIsolate(), CallCollectSample);
   v8::Local<v8::Function> func =
       func_template->GetFunction(env).ToLocalChecked();
   func->SetName(v8_str("CallCollectSample"));
   env->Global()->Set(env, v8_str("CallCollectSample"), func).FromJust();
 
   CompileRun(js_force_collect_sample_source);
   v8::Local<v8::Function> function = GetFunction(env, "start");
 
   v8::CpuProfile* profile = RunProfiler(env, function, NULL, 0, 0);
 
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
   const v8::CpuProfileNode* startNode = GetChild(env, root, "start");
   CHECK_LE(1, startNode->GetChildrenCount());
   GetChild(env, startNode, "CallCollectSample");
 
   profile->Delete();
 }
 
+static const char* js_native_js_runtime_multiple_test_source =
+    "function foo() {\n"
+    "  CallCollectSample();"
+    "  return Math.sin(Math.random());\n"
+    "}\n"
+    "var bound = foo.bind(this);\n"
+    "function bar() {\n"
+    "  try { return bound(); } catch(e) {}\n"
+    "}\n"
+    "function start() {\n"
+    "  try {\n"
+    "    startProfiling('my_profile');\n"
+    "    var startTime = Date.now();\n"
+    "    do {\n"
+    "      CallJsFunction(bar);\n"
+    "    } while (Date.now() - startTime < 200);\n"
+    "  } catch(e) {}\n"
+    "}";
+
+// The test check multiple entrances/exits between JS and native code.
+//
+// [Top down]:
+//    (root) #0 1
+//      start #16 3
+//        CallJsFunction #0 4
+//          bar #16 5
+//            foo #16 6
+//              CallCollectSample
+//      (program) #0 2
+TEST(JsNativeJsRuntimeJsSampleMultiple) {
+  v8::HandleScope scope(CcTest::isolate());
+  v8::Local<v8::Context> env = CcTest::NewContext(PROFILER_EXTENSION);
+  v8::Context::Scope context_scope(env);
+
+  v8::Local<v8::FunctionTemplate> func_template =
+      v8::FunctionTemplate::New(env->GetIsolate(), CallJsFunction);
+  v8::Local<v8::Function> func =
+      func_template->GetFunction(env).ToLocalChecked();
+  func->SetName(v8_str("CallJsFunction"));
+  env->Global()->Set(env, v8_str("CallJsFunction"), func).FromJust();
+
+  func_template =
+      v8::FunctionTemplate::New(env->GetIsolate(), CallCollectSample);
+  func = func_template->GetFunction(env).ToLocalChecked();
+  func->SetName(v8_str("CallCollectSample"));
+  env->Global()->Set(env, v8_str("CallCollectSample"), func).FromJust();
+
+  CompileRun(js_native_js_runtime_multiple_test_source);
+  v8::Local<v8::Function> function = GetFunction(env, "start");
+
+  v8::CpuProfile* profile = RunProfiler(env, function, NULL, 0, 1000);
+
+  const v8::CpuProfileNode* root = profile->GetTopDownRoot();
+  const v8::CpuProfileNode* startNode = GetChild(env, root, "start");
+  const v8::CpuProfileNode* nativeFunctionNode =
+      GetChild(env, startNode, "CallJsFunction");
+
+  const v8::CpuProfileNode* barNode = GetChild(env, nativeFunctionNode, "bar");
+  const v8::CpuProfileNode* fooNode = GetChild(env, barNode, "foo");
+  GetChild(env, fooNode, "CallCollectSample");
+
+  profile->Delete();
+}
+
 // [Top down]:
 //     0   (root) #0 1
 //     2    (program) #0 2
 //     3    (idle) #0 3
 TEST(IdleTime) {
   LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
   v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
 
   v8::Local<v8::String> profile_name = v8_str("my_profile");
@@ skipping 450 matching lines @@
   iprofile->Print();
   v8::CpuProfile* profile = reinterpret_cast<v8::CpuProfile*>(iprofile);
 
   const char* branch[] = {"", "test"};
   const ProfileNode* itest_node =
       GetSimpleBranch(env, profile, branch, arraysize(branch));
   CHECK_EQ(0U, itest_node->deopt_infos().size());
 
   iprofiler->DeleteProfile(iprofile);
 }