Skip to content

Commit b744a2f

Browse files
ConstellationConstellation
committed
[JSC] JSValue::toThis should not throw exception
https://bugs.webkit.org/show_bug.cgi?id=212595 Reviewed by Mark Lam. JSTests: * stress/number-proto.js: Added. (shouldBe): Source/JavaScriptCore: Including WebCore code, there are a lot of code which assume JSValue::toThis should not throw an exception. This assumption was now broken after making JSBigInt allocation graceful for OOM. But for this particular JSValue::toThis case, we can make it non-throwing code. This patch makes JSValue::toThis non-throwing code to fix exception-missing debug assertions. We ensure that BigIntObject can hold BigInt32 (actually, it can already if toObjectSlowCase path is taken). * runtime/BigIntObject.cpp: (JSC::BigIntObject::create): * runtime/JSCJSValue.cpp: (JSC::JSValue::toThisSlowCase const): Canonical link: https://commits.webkit.org/225435@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@262388 268f45cc-cd09-0410-ab3c-d52691b4dbfc
1 parent efe7d6e commit b744a2f

5 files changed

Lines changed: 40 additions & 8 deletions

File tree

‎JSTests/ChangeLog‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1+
2020-06-01 Yusuke Suzuki <[email protected]>
2+
3+
[JSC] JSValue::toThis should not throw exception
4+
https://bugs.webkit.org/show_bug.cgi?id=212595
5+
6+
Reviewed by Mark Lam.
7+
8+
* stress/number-proto.js: Added.
9+
(shouldBe):
10+
111
2020-06-01 Caio Lima <[email protected]>
212

313
JSTests/exceptionFuzz/earley-boyer.js fails with early exception thrown.

‎JSTests/stress/number-proto.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
function shouldBe(actual, expected) {
2+
if (actual !== expected)
3+
throw new Error('bad value: ' + actual);
4+
}
5+
6+
shouldBe(typeof (0).__proto__, `object`);

‎Source/JavaScriptCore/ChangeLog‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,22 @@
1+
2020-06-01 Yusuke Suzuki <[email protected]>
2+
3+
[JSC] JSValue::toThis should not throw exception
4+
https://bugs.webkit.org/show_bug.cgi?id=212595
5+
6+
Reviewed by Mark Lam.
7+
8+
Including WebCore code, there are a lot of code which assume JSValue::toThis should not throw an exception.
9+
This assumption was now broken after making JSBigInt allocation graceful for OOM. But for this particular JSValue::toThis case,
10+
we can make it non-throwing code.
11+
12+
This patch makes JSValue::toThis non-throwing code to fix exception-missing debug assertions.
13+
We ensure that BigIntObject can hold BigInt32 (actually, it can already if toObjectSlowCase path is taken).
14+
15+
* runtime/BigIntObject.cpp:
16+
(JSC::BigIntObject::create):
17+
* runtime/JSCJSValue.cpp:
18+
(JSC::JSValue::toThisSlowCase const):
19+
120
2020-06-01 Yusuke Suzuki <[email protected]>
221

322
[JSC] BigInt operations should handle exception correctly

‎Source/JavaScriptCore/runtime/BigIntObject.cpp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ const ClassInfo BigIntObject::s_info = { "BigInt", &Base::s_info, nullptr, nullp
3838

3939
BigIntObject* BigIntObject::create(VM& vm, JSGlobalObject* globalObject, JSValue bigInt)
4040
{
41+
ASSERT(bigInt.isBigInt());
4142
BigIntObject* object = new (NotNull, allocateCell<BigIntObject>(vm.heap)) BigIntObject(vm, globalObject->bigIntObjectStructure());
4243
object->finishCreation(vm, bigInt);
4344
return object;

‎Source/JavaScriptCore/runtime/JSCJSValue.cpp‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -119,23 +119,19 @@ JSObject* JSValue::toObjectSlowCase(JSGlobalObject* globalObject) const
119119
JSValue JSValue::toThisSlowCase(JSGlobalObject* globalObject, ECMAMode ecmaMode) const
120120
{
121121
VM& vm = globalObject->vm();
122-
auto scope = DECLARE_THROW_SCOPE(vm);
123122

124123
ASSERT(!isCell());
125124

126125
if (ecmaMode.isStrict())
127126
return *this;
128127

129128
if (isInt32() || isDouble())
130-
RELEASE_AND_RETURN(scope, constructNumber(globalObject, asValue()));
129+
return constructNumber(globalObject, asValue());
131130
if (isTrue() || isFalse())
132-
RELEASE_AND_RETURN(scope, constructBooleanFromImmediateBoolean(globalObject, asValue()));
131+
return constructBooleanFromImmediateBoolean(globalObject, asValue());
133132
#if USE(BIGINT32)
134-
if (isBigInt32()) {
135-
JSCell* heapBigInt = static_cast<JSCell*>(JSBigInt::createFrom(globalObject, bigInt32AsInt32()));
136-
RETURN_IF_EXCEPTION(scope, { });
137-
RELEASE_AND_RETURN(scope, heapBigInt->toObject(globalObject));
138-
}
133+
if (isBigInt32())
134+
return BigIntObject::create(vm, globalObject, *this);
139135
#endif
140136

141137
ASSERT(isUndefinedOrNull());

0 commit comments

Comments
 (0)