Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 19e18af9f08841b6921050b6d471dbc13b937977
https://github.com/WebKit/WebKit/commit/19e18af9f08841b6921050b6d471dbc13b937977
Author: Yijia Huang <[email protected]>
Date: 2026-06-10 (Wed, 10 Jun 2026)
Changed paths:
M JSTests/stress/temporal-calendar.js
M JSTests/stress/temporal-duration.js
A JSTests/stress/temporal-plainyearmonth-constructor-exception-check.js
M JSTests/stress/temporal-timezone.js
M Source/JavaScriptCore/runtime/TemporalPlainDateConstructor.cpp
M Source/JavaScriptCore/runtime/TemporalPlainMonthDayConstructor.cpp
M Source/JavaScriptCore/runtime/TemporalPlainYearMonthConstructor.cpp
Log Message:
-----------
[JSC][Temporal] Fix double-throw crash in Temporal constructors; clean up
stress tests
https://bugs.webkit.org/show_bug.cgi?id=316793
rdar://179110003
Reviewed by Yusuke Suzuki.
toIntegerWithTruncation() can throw (e.g. when an argument's valueOf
triggers JS execution) and return NaN. PlainDate, PlainYearMonth, and
PlainMonthDay constructors placed RETURN_IF_EXCEPTION after the
!isfinite() guard, so when toIntegerWithTruncation() threw and returned
NaN, the isfinite check triggered throwVMRangeError on top of a pending
exception, crashing via verifyExceptionCheckNeedIsSatisfied. Fix by
moving RETURN_IF_EXCEPTION immediately after each
toIntegerWithTruncation() call.
Also remove stale //@ skip from temporal-calendar.js,
temporal-duration.js, and temporal-timezone.js now that Temporal is
complete, and enable the previously-FIXMEd ZonedDateTime.timeZoneId
and offset tests in temporal-timezone.js.
Test: JSTests/stress/temporal-plainyearmonth-constructor-exception-check.js
Canonical link: https://commits.webkit.org/314985@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
