- Revision
- 264052
- Author
- [email protected]
- Date
- 2020-07-07 18:02:23 -0700 (Tue, 07 Jul 2020)
Log Message
[JSC] Should not pass Exception to JSPromise::reject
https://bugs.webkit.org/show_bug.cgi?id=214061
<rdar://problem/65134450>
Reviewed by Mark Lam.
JSTests:
* stress/import-exception.js: Added.
(import.string_appeared_here.then):
Source/_javascript_Core:
In some places, we are passing Exception* as JSValue instead of Exception::value()'s JSValue.
Error and Exception are different, and Exception is not an object. We should pass Exception::value()'s
thrown value instead. I checked `reject(` call sites and ensure error is passed.
* API/JSAPIGlobalObject.mm:
(JSC::JSAPIGlobalObject::moduleLoaderImportModule):
(JSC::JSAPIGlobalObject::moduleLoaderFetch):
* jsc.cpp:
(GlobalObject::moduleLoaderImportModule):
(GlobalObject::moduleLoaderFetch):
* runtime/JSModuleLoader.cpp:
(JSC::JSModuleLoader::importModule):
(JSC::JSModuleLoader::resolve):
(JSC::JSModuleLoader::fetch):
(JSC::moduleLoaderParseModule):
* runtime/JSPromise.cpp:
(JSC::JSPromise::resolve):
(JSC::JSPromise::reject):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (264051 => 264052)
--- trunk/JSTests/ChangeLog 2020-07-08 00:59:10 UTC (rev 264051)
+++ trunk/JSTests/ChangeLog 2020-07-08 01:02:23 UTC (rev 264052)
@@ -1,3 +1,14 @@
+2020-07-07 Yusuke Suzuki <[email protected]>
+
+ [JSC] Should not pass Exception to JSPromise::reject
+ https://bugs.webkit.org/show_bug.cgi?id=214061
+ <rdar://problem/65134450>
+
+ Reviewed by Mark Lam.
+
+ * stress/import-exception.js: Added.
+ (import.string_appeared_here.then):
+
2020-07-07 Keith Miller <[email protected]>
Bytecode UseDef should be aware of checkpoints
Added: trunk/JSTests/stress/import-exception.js (0 => 264052)
--- trunk/JSTests/stress/import-exception.js (rev 0)
+++ trunk/JSTests/stress/import-exception.js 2020-07-08 01:02:23 UTC (rev 264052)
@@ -0,0 +1,2 @@
+//@ runDefault("--watchdog=1", "--watchdog-exception-ok")
+import('').then(()=>{}, e => e.foo);
Modified: trunk/Source/_javascript_Core/API/JSAPIGlobalObject.mm (264051 => 264052)
--- trunk/Source/_javascript_Core/API/JSAPIGlobalObject.mm 2020-07-08 00:59:10 UTC (rev 264051)
+++ trunk/Source/_javascript_Core/API/JSAPIGlobalObject.mm 2020-07-08 01:02:23 UTC (rev 264052)
@@ -126,12 +126,12 @@
{
VM& vm = globalObject->vm();
auto scope = DECLARE_CATCH_SCOPE(vm);
- auto reject = [&] (JSValue exception) -> JSInternalPromise* {
+ auto reject = [&] (JSValue error) -> JSInternalPromise* {
scope.clearException();
auto* promise = JSInternalPromise::create(vm, globalObject->internalPromiseStructure());
// FIXME: We could have error since any JS call can throw stack-overflow errors.
// https://bugs.webkit.org/show_bug.cgi?id=203402
- promise->reject(globalObject, exception);
+ promise->reject(globalObject, error);
scope.clearException();
return promise;
};
@@ -139,15 +139,15 @@
auto import = [&] (URL& url) {
auto result = importModule(globalObject, Identifier::fromString(vm, url.string()), jsUndefined(), jsUndefined());
if (UNLIKELY(scope.exception()))
- return reject(scope.exception());
+ return reject(scope.exception()->value());
return result;
};
auto specifier = specifierValue->value(globalObject);
if (UNLIKELY(scope.exception())) {
- JSValue exception = scope.exception();
+ Exception* exception = scope.exception();
scope.clearException();
- return reject(exception);
+ return reject(exception->value());
}
String referrer = !sourceOrigin.isNull() ? sourceOrigin.string() : String();
@@ -170,9 +170,9 @@
Identifier moduleKey = key.toPropertyKey(globalObject);
if (UNLIKELY(scope.exception())) {
- JSValue exception = scope.exception();
+ Exception* exception = scope.exception();
scope.clearException();
- promise->reject(globalObject, exception);
+ promise->reject(globalObject, exception->value());
scope.clearException();
return promise;
}
Modified: trunk/Source/_javascript_Core/ChangeLog (264051 => 264052)
--- trunk/Source/_javascript_Core/ChangeLog 2020-07-08 00:59:10 UTC (rev 264051)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-07-08 01:02:23 UTC (rev 264052)
@@ -1,5 +1,32 @@
2020-07-07 Yusuke Suzuki <[email protected]>
+ [JSC] Should not pass Exception to JSPromise::reject
+ https://bugs.webkit.org/show_bug.cgi?id=214061
+ <rdar://problem/65134450>
+
+ Reviewed by Mark Lam.
+
+ In some places, we are passing Exception* as JSValue instead of Exception::value()'s JSValue.
+ Error and Exception are different, and Exception is not an object. We should pass Exception::value()'s
+ thrown value instead. I checked `reject(` call sites and ensure error is passed.
+
+ * API/JSAPIGlobalObject.mm:
+ (JSC::JSAPIGlobalObject::moduleLoaderImportModule):
+ (JSC::JSAPIGlobalObject::moduleLoaderFetch):
+ * jsc.cpp:
+ (GlobalObject::moduleLoaderImportModule):
+ (GlobalObject::moduleLoaderFetch):
+ * runtime/JSModuleLoader.cpp:
+ (JSC::JSModuleLoader::importModule):
+ (JSC::JSModuleLoader::resolve):
+ (JSC::JSModuleLoader::fetch):
+ (JSC::moduleLoaderParseModule):
+ * runtime/JSPromise.cpp:
+ (JSC::JSPromise::resolve):
+ (JSC::JSPromise::reject):
+
+2020-07-07 Yusuke Suzuki <[email protected]>
+
[JSC] Fix btjs by recovering CallFrame::describeFrame
https://bugs.webkit.org/show_bug.cgi?id=214055
Modified: trunk/Source/_javascript_Core/jsc.cpp (264051 => 264052)
--- trunk/Source/_javascript_Core/jsc.cpp 2020-07-08 00:59:10 UTC (rev 264051)
+++ trunk/Source/_javascript_Core/jsc.cpp 2020-07-08 01:02:23 UTC (rev 264052)
@@ -818,7 +818,7 @@
auto moduleName = moduleNameValue->value(globalObject);
RETURN_IF_EXCEPTION(throwScope, nullptr);
if (UNLIKELY(catchScope.exception()))
- return reject(catchScope.exception());
+ return reject(catchScope.exception()->value());
auto directoryName = extractDirectoryName(referrer.impl());
if (!directoryName)
@@ -826,7 +826,7 @@
auto result = JSC::importModule(globalObject, Identifier::fromString(vm, resolvePath(directoryName.value(), ModuleName(moduleName))), parameters, jsUndefined());
if (UNLIKELY(catchScope.exception()))
- return reject(catchScope.exception());
+ return reject(catchScope.exception()->value());
return result;
}
@@ -1147,7 +1147,7 @@
String moduleKey = key.toWTFString(globalObject);
if (UNLIKELY(catchScope.exception()))
- return reject(catchScope.exception());
+ return reject(catchScope.exception()->value());
// Here, now we consider moduleKey as the fileName.
Vector<uint8_t> buffer;
Modified: trunk/Source/_javascript_Core/runtime/JSModuleLoader.cpp (264051 => 264052)
--- trunk/Source/_javascript_Core/runtime/JSModuleLoader.cpp 2020-07-08 00:59:10 UTC (rev 264051)
+++ trunk/Source/_javascript_Core/runtime/JSModuleLoader.cpp 2020-07-08 01:02:23 UTC (rev 264052)
@@ -254,9 +254,9 @@
auto catchScope = DECLARE_CATCH_SCOPE(vm);
auto moduleNameString = moduleName->value(globalObject);
if (UNLIKELY(catchScope.exception())) {
- JSValue exception = catchScope.exception()->value();
+ JSValue error = catchScope.exception()->value();
catchScope.clearException();
- promise->reject(globalObject, exception);
+ promise->reject(globalObject, error);
catchScope.clearException();
return promise;
}
@@ -284,9 +284,9 @@
const Identifier moduleKey = resolveSync(globalObject, name, referrer, scriptFetcher);
if (UNLIKELY(catchScope.exception())) {
- JSValue exception = catchScope.exception();
+ JSValue error = catchScope.exception()->value();
catchScope.clearException();
- promise->reject(globalObject, exception);
+ promise->reject(globalObject, error);
catchScope.clearException();
return promise;
}
@@ -311,9 +311,9 @@
String moduleKey = key.toWTFString(globalObject);
if (UNLIKELY(catchScope.exception())) {
- JSValue exception = catchScope.exception()->value();
+ JSValue error = catchScope.exception()->value();
catchScope.clearException();
- promise->reject(globalObject, exception);
+ promise->reject(globalObject, error);
catchScope.clearException();
return promise;
}
@@ -378,7 +378,7 @@
const Identifier moduleKey = callFrame->argument(0).toPropertyKey(globalObject);
if (UNLIKELY(catchScope.exception()))
- return reject(catchScope.exception());
+ return reject(catchScope.exception()->value());
JSValue source = callFrame->argument(1);
auto* jsSourceCode = jsCast<JSSourceCode*>(source);
@@ -399,7 +399,7 @@
ModuleAnalyzer moduleAnalyzer(globalObject, moduleKey, sourceCode, moduleProgramNode->varDeclarations(), moduleProgramNode->lexicalVariables());
if (UNLIKELY(catchScope.exception()))
- return reject(catchScope.exception());
+ return reject(catchScope.exception()->value());
promise->resolve(globalObject, moduleAnalyzer.analyze(*moduleProgramNode));
catchScope.clearException();
Modified: trunk/Source/_javascript_Core/runtime/JSPromise.cpp (264051 => 264052)
--- trunk/Source/_javascript_Core/runtime/JSPromise.cpp 2020-07-08 00:59:10 UTC (rev 264051)
+++ trunk/Source/_javascript_Core/runtime/JSPromise.cpp 2020-07-08 01:02:23 UTC (rev 264052)
@@ -161,6 +161,7 @@
VM& vm = lexicalGlobalObject->vm();
auto scope = DECLARE_THROW_SCOPE(vm);
uint32_t flags = this->flags();
+ ASSERT(!value.inherits<Exception>(vm));
if (!(flags & isFirstResolvingFunctionCalledFlag)) {
internalField(Field::Flags).set(vm, this, jsNumber(flags | isFirstResolvingFunctionCalledFlag));
JSGlobalObject* globalObject = this->globalObject(vm);
@@ -175,6 +176,7 @@
VM& vm = lexicalGlobalObject->vm();
auto scope = DECLARE_THROW_SCOPE(vm);
uint32_t flags = this->flags();
+ ASSERT(!value.inherits<Exception>(vm));
if (!(flags & isFirstResolvingFunctionCalledFlag)) {
internalField(Field::Flags).set(vm, this, jsNumber(flags | isFirstResolvingFunctionCalledFlag));
JSGlobalObject* globalObject = this->globalObject(vm);
