Changeset 239256 in webkit for trunk/Source/JavaScriptCore/jsc.cpp

Timestamp:

Dec 15, 2018, 9:49:01 PM (6 years ago)

Author:

[email protected]

Message:

Null pointer dereference in JSC::WriteBarrierBase()
​https://bugs.webkit.org/show_bug.cgi?id=191252

Reviewed by Keith Miller.

Source/JavaScriptCore:

JSPromiseDeferred::create can return nullptr and an exception if stack overflow happens.
We would like to make it RELEASE_ASSERT since the current module mechanism is not immune
to stack overflow.

This patch renames JSPromiseDeferred::create to JSPromiseDeferred::tryCreate to tell that
it can return nullptr. And we insert error checks or assertions after this call.

• jsc.cpp:

(GlobalObject::moduleLoaderImportModule):
(GlobalObject::moduleLoaderFetch):

• runtime/Completion.cpp:

(JSC::rejectPromise):

• runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncImportModule):

• runtime/JSInternalPromiseDeferred.cpp:

(JSC::JSInternalPromiseDeferred::tryCreate):
(JSC::JSInternalPromiseDeferred::create): Deleted.

• runtime/JSInternalPromiseDeferred.h:
• runtime/JSModuleLoader.cpp:

(JSC::JSModuleLoader::importModule):
(JSC::JSModuleLoader::resolve):
(JSC::JSModuleLoader::fetch):
(JSC::moduleLoaderParseModule):

• runtime/JSPromise.h:
• runtime/JSPromiseDeferred.cpp:

(JSC::JSPromiseDeferred::tryCreate):

• runtime/JSPromiseDeferred.h:
• wasm/js/WebAssemblyPrototype.cpp:

(JSC::webAssemblyCompileFunc):
(JSC::webAssemblyInstantiateFunc):
(JSC::webAssemblyCompileStreamingInternal):
(JSC::webAssemblyInstantiateStreamingInternal):

Source/WebCore:

• bindings/js/JSCustomElementRegistryCustom.cpp:

(WebCore::JSCustomElementRegistry::whenDefined):

• bindings/js/JSDOMPromiseDeferred.cpp:

(WebCore::createDeferredPromise):

• bindings/js/JSDOMPromiseDeferred.h:

(WebCore::DeferredPromise::create):
(WebCore::callPromiseFunction):

• bindings/js/JSDOMWindowBase.cpp:

(WebCore::JSDOMWindowBase::moduleLoaderFetch):
(WebCore::JSDOMWindowBase::moduleLoaderImportModule):

• bindings/js/ScriptModuleLoader.cpp:

(WebCore::ScriptModuleLoader::fetch):
(WebCore::rejectPromise):

File:

• trunk/Source/JavaScriptCore/jsc.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/jsc.cpp

@@ -807 +807 @@
     auto throwScope = DECLARE_THROW_SCOPE(vm);
 
-    auto* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    auto* deferred = JSInternalPromiseDeferred::tryCreate(exec, globalObject);
     RETURN_IF_EXCEPTION(throwScope, nullptr);
 
@@ -1001 +1001 @@
     VM& vm = globalObject->vm();
     auto throwScope = DECLARE_THROW_SCOPE(vm);
-    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::tryCreate(exec, globalObject);
     RETURN_IF_EXCEPTION(throwScope, nullptr);