⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 264751 in webkit


Ignore:
Timestamp:
Jul 23, 2020, 1:49:40 AM (6 years ago)
Author:
mark.lam@apple.com
Message:

Fix missing exception checks below RTCPeerConnection.generateCertificate().
​https://bugs.webkit.org/show_bug.cgi?id=214668
<rdar://problem/65929975>

Reviewed by Yusuke Suzuki.

Source/WebCore:

Test: webrtc/missing-exception-checks-RTCPeerConnection-generateCertificate.html

  • bindings/js/JSCustomElementRegistryCustom.cpp:

(WebCore::JSCustomElementRegistry::whenDefined):

  • bindings/js/JSDOMConvertUnion.h:
  • bindings/js/JSDOMOperationReturningPromise.h:

(WebCore::IDLOperationReturningPromise::call):
(WebCore::IDLOperationReturningPromise::callReturningOwnPromise):
(WebCore::IDLOperationReturningPromise::callStatic):
(WebCore::IDLOperationReturningPromise::callStaticReturningOwnPromise):

  • bindings/js/JSDOMPromiseDeferred.cpp:

(WebCore::DeferredPromise::reject):
(WebCore::rejectPromiseWithExceptionIfAny):

  • bindings/js/JSDOMPromiseDeferred.h:

(WebCore::callPromiseFunction):

LayoutTests:

  • webrtc/missing-exception-checks-RTCPeerConnection-generateCertificate-expected.txt: Added.
  • webrtc/missing-exception-checks-RTCPeerConnection-generateCertificate.html: Added.
Location:
trunk
Files:
2 added
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r264749 r264751  
     12020-07-23  Mark Lam  <mark.lam@apple.com>
     2
     3        Fix missing exception checks below RTCPeerConnection.generateCertificate().
     4        https://bugs.webkit.org/show_bug.cgi?id=214668
     5        <rdar://problem/65929975>
     6
     7        Reviewed by Yusuke Suzuki.
     8
     9        * webrtc/missing-exception-checks-RTCPeerConnection-generateCertificate-expected.txt: Added.
     10        * webrtc/missing-exception-checks-RTCPeerConnection-generateCertificate.html: Added.
     11
    1122020-07-23  Diego Pino Garcia  <dpino@igalia.com>
    213

  • trunk/Source/WebCore/ChangeLog

    r264746 r264751  
     12020-07-23  Mark Lam  <mark.lam@apple.com>
     2
     3        Fix missing exception checks below RTCPeerConnection.generateCertificate().
     4        https://bugs.webkit.org/show_bug.cgi?id=214668
     5        <rdar://problem/65929975>
     6
     7        Reviewed by Yusuke Suzuki.
     8
     9        Test: webrtc/missing-exception-checks-RTCPeerConnection-generateCertificate.html
     10
     11        * bindings/js/JSCustomElementRegistryCustom.cpp:
     12        (WebCore::JSCustomElementRegistry::whenDefined):
     13        * bindings/js/JSDOMConvertUnion.h:
     14        * bindings/js/JSDOMOperationReturningPromise.h:
     15        (WebCore::IDLOperationReturningPromise::call):
     16        (WebCore::IDLOperationReturningPromise::callReturningOwnPromise):
     17        (WebCore::IDLOperationReturningPromise::callStatic):
     18        (WebCore::IDLOperationReturningPromise::callStaticReturningOwnPromise):
     19        * bindings/js/JSDOMPromiseDeferred.cpp:
     20        (WebCore::DeferredPromise::reject):
     21        (WebCore::rejectPromiseWithExceptionIfAny):
     22        * bindings/js/JSDOMPromiseDeferred.h:
     23        (WebCore::callPromiseFunction):
     24
    1252020-07-22  Conrad Shultz  <conrad_shultz@apple.com>
    226

  • trunk/Source/WebCore/bindings/js/JSCustomElementRegistryCustom.cpp

    r260848 r264751  
    11/*
    2  * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    205205JSValue JSCustomElementRegistry::whenDefined(JSGlobalObject& lexicalGlobalObject, CallFrame& callFrame)
    206206{
    207     auto scope = DECLARE_CATCH_SCOPE(lexicalGlobalObject.vm());
     207    auto catchScope = DECLARE_CATCH_SCOPE(lexicalGlobalObject.vm());
    208208
    209209    ASSERT(globalObject());
    … …  
    211211    JSValue promise = whenDefinedPromise(lexicalGlobalObject, callFrame, *globalObject(), wrapped(), *result);
    212212
    213     if (UNLIKELY(scope.exception())) {
    214         rejectPromiseWithExceptionIfAny(lexicalGlobalObject, *globalObject(), *result);
    215         scope.assertNoException();
     213    if (UNLIKELY(catchScope.exception())) {
     214        rejectPromiseWithExceptionIfAny(lexicalGlobalObject, *globalObject(), *result, catchScope);
     215        // FIXME: We could have error since any JS call can throw stack-overflow errors.
     216        // https://bugs.webkit.org/show_bug.cgi?id=203402
     217        RETURN_IF_EXCEPTION(catchScope, JSC::jsUndefined());
    216218        return result;
    217219    }
    … …  
    220222}
    221223
    222 }
     224} // namespace WebCore

  • trunk/Source/WebCore/bindings/js/JSDOMConvertUnion.h

    r251425 r264751  
    11/*
    2  * Copyright (C) 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2016-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    173173        if (hasNullType) {
    174174            if (value.isUndefinedOrNull())
    175                 return ConditionalConverter<ReturnType, IDLNull, hasNullType>::convert(lexicalGlobalObject, value).value();
     175                RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, IDLNull, hasNullType>::convert(lexicalGlobalObject, value).value()));
    176176        }
    177177       
    … …  
    183183            if (value.isUndefinedOrNull()) {
    184184                //     1. If types includes a dictionary type, then return the result of converting V to that dictionary type.
    185                 return ConditionalConverter<ReturnType, DictionaryType, hasDictionaryType>::convert(lexicalGlobalObject, value).value();
     185                RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, DictionaryType, hasDictionaryType>::convert(lexicalGlobalObject, value).value()));
    186186            }
    187187        }
    … …  
    232232                if (hasArrayBufferType)
    233233                    return ConditionalReturner<ReturnType, hasArrayBufferType>::get(WTFMove(arrayBuffer)).value();
    234                 return ConditionalConverter<ReturnType, ObjectType, hasObjectType>::convert(lexicalGlobalObject, value).value();
     234                RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, ObjectType, hasObjectType>::convert(lexicalGlobalObject, value).value()));
    235235            }
    236236        }
    … …  
    242242                if (hasArrayBufferViewType)
    243243                    return ConditionalReturner<ReturnType, hasArrayBufferViewType>::get(WTFMove(arrayBufferView)).value();
    244                 return ConditionalConverter<ReturnType, ObjectType, hasObjectType>::convert(lexicalGlobalObject, value).value();
     244                RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, ObjectType, hasObjectType>::convert(lexicalGlobalObject, value).value()));
    245245            }
    246246        }
    … …  
    255255                if (hasDataViewType)
    256256                    return ConditionalReturner<ReturnType, hasDataViewType>::get(WTFMove(dataView)).value();
    257                 return ConditionalConverter<ReturnType, ObjectType, hasObjectType>::convert(lexicalGlobalObject, value).value();
     257                RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, ObjectType, hasObjectType>::convert(lexicalGlobalObject, value).value()));
    258258            }
    259259        }
    … …  
    308308                        RETURN_IF_EXCEPTION(scope, ReturnType());
    309309                        if (!method.isUndefined())
    310                             return ConditionalSequenceConverter<ReturnType, SequenceType, hasSequenceType>::convert(lexicalGlobalObject, object, method).value();
     310                            RELEASE_AND_RETURN(scope, (ConditionalSequenceConverter<ReturnType, SequenceType, hasSequenceType>::convert(lexicalGlobalObject, object, method).value()));
    311311                    }
    312312
    … …  
    321321                        RETURN_IF_EXCEPTION(scope, ReturnType());
    322322                        if (!method.isUndefined())
    323                             return ConditionalSequenceConverter<ReturnType, FrozenArrayType, hasFrozenArrayType>::convert(lexicalGlobalObject, object, method).value();
     323                            RELEASE_AND_RETURN(scope, (ConditionalSequenceConverter<ReturnType, FrozenArrayType, hasFrozenArrayType>::convert(lexicalGlobalObject, object, method).value()));
    324324                    }
    325325
    … …  
    327327                    //        converting V to that dictionary type.
    328328                    if (hasDictionaryType)
    329                         return ConditionalConverter<ReturnType, DictionaryType, hasDictionaryType>::convert(lexicalGlobalObject, value).value();
     329                        RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, DictionaryType, hasDictionaryType>::convert(lexicalGlobalObject, value).value()));
    330330
    331331                    //     4. If types includes a record type, then return the result of converting V to that record type.
    332332                    if (hasRecordType)
    333                         return ConditionalConverter<ReturnType, RecordType, hasRecordType>::convert(lexicalGlobalObject, value).value();
     333                        RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, RecordType, hasRecordType>::convert(lexicalGlobalObject, value).value()));
    334334
    335335                    //     5. If types includes a callback interface type, then return the result of converting V to that interface type.
    … …  
    338338                    //     6. If types includes object, then return the IDL value that is a reference to the object V.
    339339                    if (hasObjectType)
    340                         return ConditionalConverter<ReturnType, ObjectType, hasObjectType>::convert(lexicalGlobalObject, value).value();
     340                        RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, ObjectType, hasObjectType>::convert(lexicalGlobalObject, value).value()));
    341341                }
    342342            }
    … …  
    348348        if (hasBooleanType) {
    349349            if (value.isBoolean())
    350                 return ConditionalConverter<ReturnType, IDLBoolean, hasBooleanType>::convert(lexicalGlobalObject, value).value();
     350                RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, IDLBoolean, hasBooleanType>::convert(lexicalGlobalObject, value).value()));
    351351        }
    352352       
    … …  
    356356        if (hasNumericType) {
    357357            if (value.isNumber())
    358                 return ConditionalConverter<ReturnType, NumericType, hasNumericType>::convert(lexicalGlobalObject, value).value();
     358                RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, NumericType, hasNumericType>::convert(lexicalGlobalObject, value).value()));
    359359        }
    360360       
    … …  
    362362        constexpr bool hasStringType = brigand::size<StringTypeList>::value != 0;
    363363        if (hasStringType)
    364             return ConditionalConverter<ReturnType, StringType, hasStringType>::convert(lexicalGlobalObject, value).value();
     364            RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, StringType, hasStringType>::convert(lexicalGlobalObject, value).value()));
    365365
    366366        // 15. If types includes a numeric type, then return the result of converting V to that numeric type.
    367367        if (hasNumericType)
    368             return ConditionalConverter<ReturnType, NumericType, hasNumericType>::convert(lexicalGlobalObject, value).value();
     368            RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, NumericType, hasNumericType>::convert(lexicalGlobalObject, value).value()));
    369369
    370370        // 16. If types includes a boolean, then return the result of converting V to boolean.
    371371        if (hasBooleanType)
    372             return ConditionalConverter<ReturnType, IDLBoolean, hasBooleanType>::convert(lexicalGlobalObject, value).value();
     372            RELEASE_AND_RETURN(scope, (ConditionalConverter<ReturnType, IDLBoolean, hasBooleanType>::convert(lexicalGlobalObject, value).value()));
    373373
    374374        // 17. Throw a TypeError.

  • trunk/Source/WebCore/bindings/js/JSDOMOperationReturningPromise.h

    r251691 r264751  
    11/*
    22 *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2003-2006, 2008-2009, 2013, 2016 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2003-2020 Apple Inc. All rights reserved.
    44 *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
    55 *  Copyright (C) 2009 Google, Inc. All rights reserved.
    … …  
    5050           
    5151            // FIXME: We should refactor the binding generated code to use references for lexicalGlobalObject and thisObject.
    52             return operation(&lexicalGlobalObject, &callFrame, thisObject, WTFMove(promise), throwScope);
     52            RELEASE_AND_RETURN(throwScope, operation(&lexicalGlobalObject, &callFrame, thisObject, WTFMove(promise), throwScope));
    5353        }));
    5454    }
    … …  
    6969
    7070        // FIXME: We should refactor the binding generated code to use references for lexicalGlobalObject and thisObject.
    71         return operation(&lexicalGlobalObject, &callFrame, thisObject, throwScope);
     71        RELEASE_AND_RETURN(throwScope, operation(&lexicalGlobalObject, &callFrame, thisObject, throwScope));
    7272    }
    7373
    … …  
    7979           
    8080            // FIXME: We should refactor the binding generated code to use references for lexicalGlobalObject.
    81             return operation(&lexicalGlobalObject, &callFrame, WTFMove(promise), throwScope);
     81            RELEASE_AND_RETURN(throwScope, operation(&lexicalGlobalObject, &callFrame, WTFMove(promise), throwScope));
    8282        }));
    8383    }
    … …  
    9191
    9292        // FIXME: We should refactor the binding generated code to use references for lexicalGlobalObject.
    93         return operation(&lexicalGlobalObject, &callFrame, throwScope);
     93        RELEASE_AND_RETURN(throwScope, operation(&lexicalGlobalObject, &callFrame, throwScope));
    9494    }
    9595};

  • trunk/Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp

    r260744 r264751  
    11/*
    2  * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    151151
    152152    reject(lexicalGlobalObject, error, rejectAsHandled);
     153    EXCEPTION_ASSERT(!scope.exception() || isTerminatedExecutionException(lexicalGlobalObject.vm(), scope.exception()));
    153154}
    154155
    … …  
    198199}
    199200
    200 void rejectPromiseWithExceptionIfAny(JSC::JSGlobalObject& lexicalGlobalObject, JSDOMGlobalObject& globalObject, JSPromise& promise)
    201 {
    202     VM& vm = lexicalGlobalObject.vm();
    203     auto scope = DECLARE_CATCH_SCOPE(vm);
    204 
    205     if (LIKELY(!scope.exception()))
    206         return;
    207 
    208     JSValue error = scope.exception()->value();
    209     scope.clearException();
     201void rejectPromiseWithExceptionIfAny(JSC::JSGlobalObject& lexicalGlobalObject, JSDOMGlobalObject& globalObject, JSPromise& promise, JSC::CatchScope& catchScope)
     202{
     203    UNUSED_PARAM(lexicalGlobalObject);
     204    if (LIKELY(!catchScope.exception()))
     205        return;
     206
     207    JSValue error = catchScope.exception()->value();
     208    catchScope.clearException();
    210209
    211210    DeferredPromise::create(globalObject, promise)->reject<IDLAny>(error);

  • trunk/Source/WebCore/bindings/js/JSDOMPromiseDeferred.h

    r264021 r264751  
    11/*
    2  * Copyright (C) 2013 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    290290void fulfillPromiseWithArrayBuffer(Ref<DeferredPromise>&&, ArrayBuffer*);
    291291void fulfillPromiseWithArrayBuffer(Ref<DeferredPromise>&&, const void*, size_t);
    292 WEBCORE_EXPORT void rejectPromiseWithExceptionIfAny(JSC::JSGlobalObject&, JSDOMGlobalObject&, JSC::JSPromise&);
     292WEBCORE_EXPORT void rejectPromiseWithExceptionIfAny(JSC::JSGlobalObject&, JSDOMGlobalObject&, JSC::JSPromise&, JSC::CatchScope&);
    293293
    294294enum class RejectedPromiseWithTypeErrorCause { NativeGetter, InvalidThis };
    … …  
    301301{
    302302    JSC::VM& vm = JSC::getVM(&lexicalGlobalObject);
    303     auto scope = DECLARE_CATCH_SCOPE(vm);
     303    auto catchScope = DECLARE_CATCH_SCOPE(vm);
    304304
    305305    auto& globalObject = callerGlobalObject(lexicalGlobalObject, callFrame);
    … …  
    309309    promiseFunction(lexicalGlobalObject, callFrame, DeferredPromise::create(globalObject, *promise));
    310310
    311     rejectPromiseWithExceptionIfAny(lexicalGlobalObject, globalObject, *promise);
     311    rejectPromiseWithExceptionIfAny(lexicalGlobalObject, globalObject, *promise, catchScope);
    312312    // FIXME: We could have error since any JS call can throw stack-overflow errors.
    313313    // https://bugs.webkit.org/show_bug.cgi?id=203402
    314     RETURN_IF_EXCEPTION(scope, JSC::jsUndefined());
     314    RETURN_IF_EXCEPTION(catchScope, JSC::jsUndefined());
    315315    return promise;
    316316}
    … …  
    320320{
    321321    JSC::VM& vm = JSC::getVM(&lexicalGlobalObject);
    322     auto scope = DECLARE_CATCH_SCOPE(vm);
     322    auto catchScope = DECLARE_CATCH_SCOPE(vm);
    323323
    324324    auto& globalObject = callerGlobalObject(lexicalGlobalObject, callFrame);
    … …  
    328328    functor(lexicalGlobalObject, callFrame, DeferredPromise::create(globalObject, *promise));
    329329
    330     rejectPromiseWithExceptionIfAny(lexicalGlobalObject, globalObject, *promise);
     330    rejectPromiseWithExceptionIfAny(lexicalGlobalObject, globalObject, *promise, catchScope);
    331331    // FIXME: We could have error since any JS call can throw stack-overflow errors.
    332332    // https://bugs.webkit.org/show_bug.cgi?id=203402
    333     RETURN_IF_EXCEPTION(scope, JSC::jsUndefined());
     333    RETURN_IF_EXCEPTION(catchScope, JSC::jsUndefined());
    334334    return promise;
    335335}
Note: See TracChangeset for help on using the changeset viewer.