Changeset 286275 in webkit

Timestamp:

Nov 29, 2021, 5:20:43 PM (5 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] slice should be aware of TerminationException
​https://bugs.webkit.org/show_bug.cgi?id=233593
rdar://85823844

Reviewed by Mark Lam.

JSTests:

• stress/slice-termination-exception.js: Added.

(async infiniteLoop):

Source/JavaScriptCore:

Since termination exception can happen at any time, assertNoException is wrong.

• runtime/ArrayPrototype.cpp:

(JSC::JSC_DEFINE_HOST_FUNCTION):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/slice-termination-exception.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ArrayPrototype.cpp (modified) (4 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] slice should be aware of TerminationException
+        https://bugs.webkit.org/show_bug.cgi?id=233593
+        rdar://85823844
+
+        Reviewed by Mark Lam.
+
+        * stress/slice-termination-exception.js: Added.
+        (async infiniteLoop):
+
 2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] slice should be aware of TerminationException
+        https://bugs.webkit.org/show_bug.cgi?id=233593
+        rdar://85823844
+
+        Reviewed by Mark Lam.
+
+        Since termination exception can happen at any time, assertNoException is wrong.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::JSC_DEFINE_HOST_FUNCTION):
+
 2021-11-29  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -209 +209 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    auto exceptionResult = [] () {
-        return std::make_pair(SpeciesConstructResult::Exception, nullptr);
-    };
+    constexpr std::pair<SpeciesConstructResult, JSObject*> exceptionResult { SpeciesConstructResult::Exception, nullptr };
 
     // ECMA 9.4.2.3: https://tc39.github.io/ecma262/#sec-arrayspeciescreate
     JSValue constructor = jsUndefined();
     bool thisIsArray = isArray(globalObject, thisObject);
-    RETURN_IF_EXCEPTION(scope, exceptionResult());
+    RETURN_IF_EXCEPTION(scope, exceptionResult);
     if (LIKELY(thisIsArray)) {
         // Fast path in the normal case where the user has not set an own constructor and the Array.prototype.constructor is normal.
         // We need prototype check for subclasses of Array, which are Array objects but have a different prototype by default.
         bool isValid = speciesWatchpointIsValid(vm, thisObject);
-        scope.assertNoException();
+        RETURN_IF_EXCEPTION(scope, exceptionResult);
         if (LIKELY(isValid))
-            return std::make_pair(SpeciesConstructResult::FastPath, nullptr);
+            return std::pair { SpeciesConstructResult::FastPath, nullptr };
 
         constructor = thisObject->get(globalObject, vm.propertyNames->constructor);
-        RETURN_IF_EXCEPTION(scope, exceptionResult());
+        RETURN_IF_EXCEPTION(scope, exceptionResult);
         if (constructor.isConstructor(vm)) {
             JSObject* constructorObject = jsCast<JSObject*>(constructor);
@@ -232 +230 @@
                 && constructorObject->inherits<ArrayConstructor>(vm);
             if (isArrayConstructorFromAnotherRealm)
-                return std::make_pair(SpeciesConstructResult::FastPath, nullptr);
+                return std::pair { SpeciesConstructResult::FastPath, nullptr };
         }
         if (constructor.isObject()) {
             constructor = constructor.get(globalObject, vm.propertyNames->speciesSymbol);
-            RETURN_IF_EXCEPTION(scope, exceptionResult());
+            RETURN_IF_EXCEPTION(scope, exceptionResult);
             if (constructor.isNull())
-                return std::make_pair(SpeciesConstructResult::FastPath, nullptr);
+                return std::pair { SpeciesConstructResult::FastPath, nullptr };
         }
     } else {
         // If isArray is false, return ? ArrayCreate(length).
-        return std::make_pair(SpeciesConstructResult::FastPath, nullptr);
+        return std::pair { SpeciesConstructResult::FastPath, nullptr };
     }
 
     if (constructor.isUndefined())
-        return std::make_pair(SpeciesConstructResult::FastPath, nullptr);
+        return std::pair { SpeciesConstructResult::FastPath, nullptr };
 
     MarkedArgumentBuffer args;
@@ -252 +250 @@
     ASSERT(!args.hasOverflowed());
     JSObject* newObject = construct(globalObject, constructor, args, "Species construction did not get a valid constructor");
-    RETURN_IF_EXCEPTION(scope, exceptionResult());
-    return std::make_pair(SpeciesConstructResult::CreatedObject, newObject);
+    RETURN_IF_EXCEPTION(scope, exceptionResult);
+    return std::pair { SpeciesConstructResult::CreatedObject, newObject };
 }
 
@@ -1563 +1561 @@
     // We need to check the species constructor here since checking it in the JS wrapper is too expensive for the non-optimizing tiers.
     bool isValid = speciesWatchpointIsValid(vm, firstArray);
-    scope.assertNoException();
+    RETURN_IF_EXCEPTION(scope, { });
     if (UNLIKELY(!isValid))
         return JSValue::encode(jsNull());