Changeset 263905 in webkit for trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp

Timestamp:

Jul 3, 2020, 1:06:51 PM (5 years ago)

Author:

[email protected]

Message:

[JSC] Add exception checks before and after viewWithUnderlyingString
​https://bugs.webkit.org/show_bug.cgi?id=213923
<rdar://problem/65068473>

Reviewed by Sam Weinig.

JSTests:

• stress/exception-checks-before-and-after-viewwithunderlyingstring.js: Added.

(shouldThrow):

Source/JavaScriptCore:

This patch inserts missing exception checks before and after viewWithUnderlyingString.

• jsc.cpp:

(printInternal):
(functionDebug):

• runtime/FunctionConstructor.cpp:

(JSC::constructFunctionSkippingEvalEnabledCheck):

• runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncParseFloat):

• runtime/JSONObject.cpp:

(JSC::JSONProtoFuncParse):

• runtime/StringPrototype.cpp:

(JSC::stringProtoFuncCharAt):
(JSC::stringProtoFuncCharCodeAt):

File:

• trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp

@@ -528 +528 @@
 EncodedJSValue JSC_HOST_CALL globalFuncParseFloat(JSGlobalObject* globalObject, CallFrame* callFrame)
 {
-    auto viewWithString = callFrame->argument(0).toString(globalObject)->viewWithUnderlyingString(globalObject);
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    auto* jsString = callFrame->argument(0).toString(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
+    auto viewWithString = jsString->viewWithUnderlyingString(globalObject);
+    RETURN_IF_EXCEPTION(scope, { });
     return JSValue::encode(jsNumber(parseFloat(viewWithString.view)));
 }