Title: [238163] trunk/Source/_javascript_Core
- Revision
- 238163
- Author
- sbar...@apple.com
- Date
- 2018-11-13 20:58:17 -0800 (Tue, 13 Nov 2018)
Log Message
ProxyObject should check for VMInquiry and return early before throwing a stack overflow exception
https://bugs.webkit.org/show_bug.cgi?id=191601
Reviewed by Mark Lam.
This doesn't fix any bugs today, but it may reduce future bugs. It was
always weird that ProxyObject::getOwnPropertySlot with VMInquiry might
throw a stack overflow error instead of just returning false like it
normally does when VMInquiry is passed in.
* runtime/ProxyObject.cpp:
(JSC::ProxyObject::getOwnPropertySlotCommon):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (238162 => 238163)
--- trunk/Source/_javascript_Core/ChangeLog 2018-11-14 04:57:33 UTC (rev 238162)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-11-14 04:58:17 UTC (rev 238163)
@@ -1,5 +1,20 @@
2018-11-13 Saam Barati <sbar...@apple.com>
+ ProxyObject should check for VMInquiry and return early before throwing a stack overflow exception
+ https://bugs.webkit.org/show_bug.cgi?id=191601
+
+ Reviewed by Mark Lam.
+
+ This doesn't fix any bugs today, but it may reduce future bugs. It was
+ always weird that ProxyObject::getOwnPropertySlot with VMInquiry might
+ throw a stack overflow error instead of just returning false like it
+ normally does when VMInquiry is passed in.
+
+ * runtime/ProxyObject.cpp:
+ (JSC::ProxyObject::getOwnPropertySlotCommon):
+
+2018-11-13 Saam Barati <sbar...@apple.com>
+
TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
https://bugs.webkit.org/show_bug.cgi?id=191600
Modified: trunk/Source/_javascript_Core/runtime/ProxyObject.cpp (238162 => 238163)
--- trunk/Source/_javascript_Core/runtime/ProxyObject.cpp 2018-11-14 04:57:33 UTC (rev 238162)
+++ trunk/Source/_javascript_Core/runtime/ProxyObject.cpp 2018-11-14 04:58:17 UTC (rev 238163)
@@ -366,6 +366,12 @@
bool ProxyObject::getOwnPropertySlotCommon(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
{
+ slot.disableCaching();
+ slot.setIsTaintedByOpaqueObject();
+
+ if (slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry)
+ return false;
+
VM& vm = exec->vm();
auto scope = DECLARE_THROW_SCOPE(vm);
if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
@@ -372,8 +378,6 @@
throwStackOverflowError(exec, scope);
return false;
}
- slot.disableCaching();
- slot.setIsTaintedByOpaqueObject();
switch (slot.internalMethodType()) {
case PropertySlot::InternalMethodType::Get:
RELEASE_AND_RETURN(scope, performGet(exec, propertyName, slot));
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
