Changeset 196966 in webkit for trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

Timestamp:

Feb 22, 2016, 4:51:02 PM (9 years ago)

Author:

[email protected]

Message:

InternalFunction::createSubclassStructure doesn't take into account that get() might throw
​https://bugs.webkit.org/show_bug.cgi?id=154548

Reviewed by Mark Lam and Geoffrey Garen and Andreas Kling.

InternalFunction::createSubclassStructure calls newTarget.get(...) which can throw
an exception. Neither the function nor the call sites of the function took this into
account. This patch audits the call sites of the function to make it work in
the event that an exception is thrown.

• runtime/BooleanConstructor.cpp:

(JSC::constructWithBooleanConstructor):

• runtime/DateConstructor.cpp:

(JSC::constructDate):

• runtime/ErrorConstructor.cpp:

(JSC::Interpreter::constructWithErrorConstructor):

• runtime/FunctionConstructor.cpp:

(JSC::constructFunctionSkippingEvalEnabledCheck):

• runtime/InternalFunction.cpp:

(JSC::InternalFunction::createSubclassStructure):

• runtime/JSArrayBufferConstructor.cpp:

(JSC::constructArrayBuffer):

• runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayView):

• runtime/JSGlobalObject.h:

(JSC::constructEmptyArray):
(JSC::constructArray):
(JSC::constructArrayNegativeIndexed):

• runtime/JSPromiseConstructor.cpp:

(JSC::constructPromise):

• runtime/MapConstructor.cpp:

(JSC::constructMap):

• runtime/NativeErrorConstructor.cpp:

(JSC::Interpreter::constructWithNativeErrorConstructor):

• runtime/NumberConstructor.cpp:

(JSC::constructWithNumberConstructor):

• runtime/RegExpConstructor.cpp:

(JSC::getRegExpStructure):
(JSC::constructRegExp):
(JSC::constructWithRegExpConstructor):

• runtime/SetConstructor.cpp:

(JSC::constructSet):

• runtime/StringConstructor.cpp:

(JSC::constructWithStringConstructor):
(JSC::StringConstructor::getConstructData):

• runtime/WeakMapConstructor.cpp:

(JSC::constructWeakMap):

• runtime/WeakSetConstructor.cpp:

(JSC::constructWeakSet):

• tests/stress/create-subclass-structure-might-throw.js: Added.

(assert):

File:

• trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h (modified) (4 diffs)

trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

@@ -732 +732 @@
     else
         structure = globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget);
+    if (exec->hadException())
+        return nullptr;
 
     return ArrayAllocationProfile::updateLastAllocationFor(profile, JSArray::create(exec->vm(), structure, initialLength));
@@ -743 +745 @@
 inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const ArgList& values, JSValue newTarget = JSValue())
 {
-    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArray(exec, globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget), values));
+    Structure* structure = globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget);
+    if (exec->hadException())
+        return nullptr;
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArray(exec, structure, values));
 }
 
@@ -753 +758 @@
 inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const JSValue* values, unsigned length, JSValue newTarget = JSValue())
 {
-    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArray(exec, globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget), values, length));
+    Structure* structure = globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget);
+    if (exec->hadException())
+        return nullptr;
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArray(exec, structure, values, length));
 }
 
@@ -763 +771 @@
 inline JSArray* constructArrayNegativeIndexed(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const JSValue* values, unsigned length, JSValue newTarget = JSValue())
 {
-    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArrayNegativeIndexed(exec, globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget), values, length));
+    Structure* structure = globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget);
+    if (exec->hadException())
+        return nullptr;
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArrayNegativeIndexed(exec, structure, values, length));
 }