Changeset 243246 in webkit

Timestamp:

Mar 20, 2019, 3:12:12 PM (7 years ago)

Author:

Tadeu Zagallo

Message:

JSC::createError needs to check for OOM in errorDescriptionForValue
​https://bugs.webkit.org/show_bug.cgi?id=196032
<rdar://problem/46842740>

Reviewed by Mark Lam.

JSTests:

• stress/create-error-out-of-memory-rope-string.js: Added.

Source/JavaScriptCore:

We were missing exceptions checks at two levels:

• In errorDescriptionForValue, when the value is a string, we should check that JSString::value returns a valid string, since we might run out of memory if it is a rope and we need to resolve it.
• In createError, we should check for the result of errorDescriptionForValue before concatenating it with the message provided by the caller.

• runtime/ExceptionHelpers.cpp:

(JSC::errorDescriptionForValue):
(JSC::createError):

• runtime/ExceptionHelpers.h:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/create-error-out-of-memory-rope-string.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ExceptionHelpers.cpp (modified) (3 diffs)
• Source/JavaScriptCore/runtime/ExceptionHelpers.h (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-03-20  Tadeu Zagallo  <tzagallo@apple.com>
+
+        JSC::createError needs to check for OOM in errorDescriptionForValue
+        https://bugs.webkit.org/show_bug.cgi?id=196032
+        <rdar://problem/46842740>
+
+        Reviewed by Mark Lam.
+
+        * stress/create-error-out-of-memory-rope-string.js: Added.
+
 2019-03-19  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-03-20  Tadeu Zagallo  <tzagallo@apple.com>
+
+        JSC::createError needs to check for OOM in errorDescriptionForValue
+        https://bugs.webkit.org/show_bug.cgi?id=196032
+        <rdar://problem/46842740>
+
+        Reviewed by Mark Lam.
+
+        We were missing exceptions checks at two levels:
+        - In errorDescriptionForValue, when the value is a string, we should
+          check that JSString::value returns a valid string, since we might run
+          out of memory if it is a rope and we need to resolve it.
+        - In createError, we should check for the result of errorDescriptionForValue
+          before concatenating it with the message provided by the caller.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::errorDescriptionForValue):
+        (JSC::createError):
+        * runtime/ExceptionHelpers.h:
+
 2019-03-20  Devin Rousso  <drousso@apple.com>
 

trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp

@@ -90 +90 @@
 }
     
-JSString* errorDescriptionForValue(ExecState* exec, JSValue v)
-{
-    if (v.isString())
-        return jsNontrivialString(exec, makeString('"', asString(v)->value(exec), '"'));
+String errorDescriptionForValue(ExecState* exec, JSValue v)
+{
+    if (v.isString()) {
+        String string = asString(v)->value(exec);
+        if (!string)
+            return string;
+        return tryMakeString('"', string, '"');
+    }
+
     if (v.isSymbol())
-        return jsNontrivialString(exec, asSymbol(v)->descriptiveString());
+        return asSymbol(v)->descriptiveString();
     if (v.isObject()) {
         VM& vm = exec->vm();
@@ -101 +106 @@
         JSObject* object = asObject(v);
         if (object->methodTable(vm)->getCallData(object, callData) != CallType::None)
-            return vm.smallStrings.functionString();
-        return jsString(exec, JSObject::calculatedClassName(object));
-    }
-    return v.toString(exec);
+            return vm.smallStrings.functionString()->value(exec);
+        return JSObject::calculatedClassName(object);
+    }
+    return v.toString(exec)->value(exec);
 }
     
@@ -270 +275 @@
     auto scope = DECLARE_CATCH_SCOPE(vm);
 
-    String errorMessage = tryMakeString(errorDescriptionForValue(exec, value)->value(exec), ' ', message);
-    if (errorMessage.isNull())
+    String valueDescription = errorDescriptionForValue(exec, value);
+    if (!valueDescription)
+        return createOutOfMemoryError(exec);
+    String errorMessage = tryMakeString(valueDescription, ' ', message);
+    if (!errorMessage)
         return createOutOfMemoryError(exec);
     scope.assertNoException();

trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.h

@@ -55 +55 @@
 JSObject* createNotAFunctionError(ExecState*, JSValue);
 JSObject* createErrorForInvalidGlobalAssignment(ExecState*, const String&);
-JSString* errorDescriptionForValue(ExecState*, JSValue);
+String errorDescriptionForValue(ExecState*, JSValue);
 
 JS_EXPORT_PRIVATE Exception* throwOutOfMemoryError(ExecState*, ThrowScope&);