Changeset 286840 in webkit

Timestamp:

Dec 10, 2021, 2:30:48 AM (5 years ago)

Author:

commit-queue@webkit.org

Message:

Handle TerminationException in WebCore::ReadableStream::create()
​https://bugs.webkit.org/show_bug.cgi?id=233061

Patch by Frederic Wang <​fwang@igalia.com> on 2021-12-10
Reviewed by Darin Adler.

Source/WebCore:

Test: streams/readable-stream-create-after-worker-terminates-crash.html

• bindings/js/ReadableStream.cpp:

(WebCore::ReadableStream::create): Do not try immediately casting the constructor value to an
object, since it is undefined when a termination exception is thrown.

LayoutTests:

Add non-regression test.

• streams/readable-stream-create-after-worker-terminates-crash-expected.txt: Added.
• streams/readable-stream-create-after-worker-terminates-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/streams/readable-stream-create-after-worker-terminates-crash-expected.txt (added)
• LayoutTests/streams/readable-stream-create-after-worker-terminates-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/js/ReadableStream.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-12-10  Frederic Wang  <fwang@igalia.com>
+
+        Handle TerminationException in WebCore::ReadableStream::create()
+        https://bugs.webkit.org/show_bug.cgi?id=233061
+
+        Reviewed by Darin Adler.
+
+        Add non-regression test.
+
+        * streams/readable-stream-create-after-worker-terminates-crash-expected.txt: Added.
+        * streams/readable-stream-create-after-worker-terminates-crash.html: Added.
+
 2021-12-09  Antoine Quint  <graouts@webkit.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-12-10  Frederic Wang  <fwang@igalia.com>
+
+        Handle TerminationException in WebCore::ReadableStream::create()
+        https://bugs.webkit.org/show_bug.cgi?id=233061
+
+        Reviewed by Darin Adler.
+
+        Test: streams/readable-stream-create-after-worker-terminates-crash.html
+
+        * bindings/js/ReadableStream.cpp:
+        (WebCore::ReadableStream::create): Do not try immediately casting the constructor value to an
+        object, since it is undefined when a termination exception is thrown.
+
 2021-12-10  Kimmo Kinnunen  <kkinnunen@apple.com>
 

trunk/Source/WebCore/bindings/js/ReadableStream.cpp

@@ -46 +46 @@
     auto& globalObject = *JSC::jsCast<JSDOMGlobalObject*>(&lexicalGlobalObject);
 
-    auto* constructor = JSC::asObject(globalObject.get(&lexicalGlobalObject, clientData.builtinNames().ReadableStreamPrivateName()));
+    auto constructorValue = globalObject.get(&lexicalGlobalObject, clientData.builtinNames().ReadableStreamPrivateName());
     RETURN_IF_EXCEPTION(scope, Exception { ExistingExceptionError });
+    auto constructor = JSC::asObject(constructorValue);
 
     auto constructData = getConstructData(vm, constructor);