Changeset 197794 in webkit


Ignore:
Timestamp:
Mar 8, 2016, 12:57:25 PM (9 years ago)
Author:
mark.lam@apple.com
Message:

synthesizePrototype() and friends need to be followed by exception checks (or equivalent).
​https://bugs.webkit.org/show_bug.cgi?id=155169

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

With the exception checks, we may end up throwing new exceptions over an existing
one that has been thrown but not handled yet, thereby obscuring it. It may also
mean that the VM will continue running on potentially unstable state, which may
have undesirable consequences.

I first observed this in some failed assertion while running tests on a patch for
​https://bugs.webkit.org/show_bug.cgi?id=154865.

Performance is neutral with this patch (tested on x86_64).

  1. Deleted JSNotAnObject, and removed all uses of it.
  1. Added exception checks, when needed, following calls to synthesizePrototype() and JSValue::toObject().

The cases that do not need an exception check are the ones that already ensures
that JSValue::toObject() is only called on a value that is convertible to an
object. In those cases, I added an assertion that no exception was thrown
after the call.

  • CMakeLists.txt:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • inspector/ScriptCallStackFactory.cpp:

(Inspector::createScriptCallStackFromException):

  • interpreter/Interpreter.cpp:
  • jit/JITOperations.cpp:
  • llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

  • runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncJoin):
(JSC::arrayProtoFuncConcat):
(JSC::arrayProtoFuncPop):
(JSC::arrayProtoFuncPush):
(JSC::arrayProtoFuncReverse):
(JSC::arrayProtoFuncShift):
(JSC::arrayProtoFuncSlice):
(JSC::arrayProtoFuncSplice):
(JSC::arrayProtoFuncUnShift):
(JSC::arrayProtoFuncIndexOf):
(JSC::arrayProtoFuncLastIndexOf):
(JSC::arrayProtoFuncValues):
(JSC::arrayProtoFuncEntries):
(JSC::arrayProtoFuncKeys):

  • runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

  • runtime/ExceptionHelpers.cpp:
  • runtime/JSCJSValue.cpp:

(JSC::JSValue::toObjectSlowCase):
(JSC::JSValue::toThisSlowCase):
(JSC::JSValue::synthesizePrototype):
(JSC::JSValue::putToPrimitive):
(JSC::JSValue::putToPrimitiveByIndex):

  • runtime/JSCJSValueInlines.h:

(JSC::JSValue::getPropertySlot):
(JSC::JSValue::get):

  • runtime/JSFunction.cpp:
  • runtime/JSGlobalObjectFunctions.cpp:

(JSC::globalFuncProtoGetter):

  • runtime/JSNotAnObject.cpp: Removed.
  • runtime/JSNotAnObject.h: Removed.
  • runtime/ObjectConstructor.cpp:

(JSC::objectConstructorDefineProperties):
(JSC::objectConstructorCreate):

  • runtime/ObjectPrototype.cpp:

(JSC::objectProtoFuncValueOf):
(JSC::objectProtoFuncHasOwnProperty):
(JSC::objectProtoFuncIsPrototypeOf):
(JSC::objectProtoFuncToString):

  • runtime/VM.cpp:

(JSC::VM::VM):

  • runtime/VM.h:

Source/WebCore:

No new tests because this issue is covered by existing tests when the fix for
​https://bugs.webkit.org/show_bug.cgi?id=154865 lands. That patch is waiting for
this patch to land first so as to not introduce test failures.

  • Modules/plugins/QuickTimePluginReplacement.mm:

(WebCore::QuickTimePluginReplacement::installReplacement):

  • bindings/js/JSDeviceMotionEventCustom.cpp:

(WebCore::readAccelerationArgument):
(WebCore::readRotationRateArgument):

  • bindings/js/JSGeolocationCustom.cpp:

(WebCore::createPositionOptions):

  • bindings/js/JSHTMLCanvasElementCustom.cpp:

(WebCore::get3DContextAttributes):

  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateConstructorDefinition):

  • bindings/scripts/test/JS/JSTestEventConstructor.cpp:

(WebCore::JSTestEventConstructorConstructor::construct):

  • contentextensions/ContentExtensionParser.cpp:

(WebCore::ContentExtensions::getTypeFlags):

  • html/HTMLMediaElement.cpp:

(WebCore::setPageScaleFactorProperty):
(WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
(WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):

  • html/HTMLPlugInImageElement.cpp:

(WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):

Location:
trunk/Source
Files:
2 deleted
28 edited

Legend:

Unmodified
Added
Removed

  • TabularUnified trunk/Source/JavaScriptCore/CMakeLists.txt

    r197781 r197794  
    710710    runtime/JSModuleRecord.cpp
    711711    runtime/JSNativeStdFunction.cpp
    712     runtime/JSNotAnObject.cpp
    713712    runtime/JSONObject.cpp
    714713    runtime/JSObject.cpp

  • TabularUnified trunk/Source/JavaScriptCore/ChangeLog

    r197793 r197794  
     12016-03-08  Mark Lam  <mark.lam@apple.com>
     2
     3        synthesizePrototype() and friends need to be followed by exception checks (or equivalent).
     4        https://bugs.webkit.org/show_bug.cgi?id=155169
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        With the exception checks, we may end up throwing new exceptions over an existing
     9        one that has been thrown but not handled yet, thereby obscuring it.  It may also
     10        mean that the VM will continue running on potentially unstable state, which may
     11        have undesirable consequences.
     12
     13        I first observed this in some failed assertion while running tests on a patch for
     14        https://bugs.webkit.org/show_bug.cgi?id=154865.
     15
     16        Performance is neutral with this patch (tested on x86_64).
     17
     18        1. Deleted JSNotAnObject, and removed all uses of it.
     19
     20        2. Added exception checks, when needed, following calls to synthesizePrototype()
     21           and JSValue::toObject().
     22
     23           The cases that do not need an exception check are the ones that already ensures
     24           that JSValue::toObject() is only called on a value that is convertible to an
     25           object.  In those cases, I added an assertion that no exception was thrown
     26           after the call.
     27
     28        * CMakeLists.txt:
     29        * JavaScriptCore.xcodeproj/project.pbxproj:
     30        * inspector/ScriptCallStackFactory.cpp:
     31        (Inspector::createScriptCallStackFromException):
     32        * interpreter/Interpreter.cpp:
     33        * jit/JITOperations.cpp:
     34        * llint/LLIntSlowPaths.cpp:
     35        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
     36        * runtime/ArrayPrototype.cpp:
     37        (JSC::arrayProtoFuncJoin):
     38        (JSC::arrayProtoFuncConcat):
     39        (JSC::arrayProtoFuncPop):
     40        (JSC::arrayProtoFuncPush):
     41        (JSC::arrayProtoFuncReverse):
     42        (JSC::arrayProtoFuncShift):
     43        (JSC::arrayProtoFuncSlice):
     44        (JSC::arrayProtoFuncSplice):
     45        (JSC::arrayProtoFuncUnShift):
     46        (JSC::arrayProtoFuncIndexOf):
     47        (JSC::arrayProtoFuncLastIndexOf):
     48        (JSC::arrayProtoFuncValues):
     49        (JSC::arrayProtoFuncEntries):
     50        (JSC::arrayProtoFuncKeys):
     51        * runtime/CommonSlowPaths.cpp:
     52        (JSC::SLOW_PATH_DECL):
     53        * runtime/ExceptionHelpers.cpp:
     54        * runtime/JSCJSValue.cpp:
     55        (JSC::JSValue::toObjectSlowCase):
     56        (JSC::JSValue::toThisSlowCase):
     57        (JSC::JSValue::synthesizePrototype):
     58        (JSC::JSValue::putToPrimitive):
     59        (JSC::JSValue::putToPrimitiveByIndex):
     60        * runtime/JSCJSValueInlines.h:
     61        (JSC::JSValue::getPropertySlot):
     62        (JSC::JSValue::get):
     63        * runtime/JSFunction.cpp:
     64        * runtime/JSGlobalObjectFunctions.cpp:
     65        (JSC::globalFuncProtoGetter):
     66        * runtime/JSNotAnObject.cpp: Removed.
     67        * runtime/JSNotAnObject.h: Removed.
     68        * runtime/ObjectConstructor.cpp:
     69        (JSC::objectConstructorDefineProperties):
     70        (JSC::objectConstructorCreate):
     71        * runtime/ObjectPrototype.cpp:
     72        (JSC::objectProtoFuncValueOf):
     73        (JSC::objectProtoFuncHasOwnProperty):
     74        (JSC::objectProtoFuncIsPrototypeOf):
     75        (JSC::objectProtoFuncToString):
     76        * runtime/VM.cpp:
     77        (JSC::VM::VM):
     78        * runtime/VM.h:
     79
    1802016-03-08  Oliver Hunt  <oliver@apple.com>
    281

  • TabularUnified trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r197781 r197794  
    16881688                A72028B81797601E0098028C /* JSCTestRunnerUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = A72028B51797601E0098028C /* JSCTestRunnerUtils.h */; settings = {ATTRIBUTES = (Private, ); }; };
    16891689                A72028BA1797603D0098028C /* JSFunctionInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = A72028B91797603D0098028C /* JSFunctionInlines.h */; settings = {ATTRIBUTES = (Private, ); }; };
    1690                 A72700900DAC6BBC00E548D7 /* JSNotAnObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A72700780DAC605600E548D7 /* JSNotAnObject.cpp */; };
    16911690                A72701B90DADE94900E548D7 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; };
    16921691                A7280A2811557E3000D56957 /* JSObjectRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A79EDB0811531CD60019E912 /* JSObjectRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
    … …  
    38903889                A72028B51797601E0098028C /* JSCTestRunnerUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCTestRunnerUtils.h; sourceTree = "<group>"; };
    38913890                A72028B91797603D0098028C /* JSFunctionInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFunctionInlines.h; sourceTree = "<group>"; };
    3892                 A72700770DAC605600E548D7 /* JSNotAnObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotAnObject.h; sourceTree = "<group>"; };
    3893                 A72700780DAC605600E548D7 /* JSNotAnObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotAnObject.cpp; sourceTree = "<group>"; };
    38943891                A72701B30DADE94900E548D7 /* ExceptionHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionHelpers.h; sourceTree = "<group>"; };
    38953892                A729009B17976C6000317298 /* MacroAssemblerARMv7.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerARMv7.cpp; sourceTree = "<group>"; };
    … …  
    57365733                                E33E8D1A1B9013C300346B52 /* JSNativeStdFunction.cpp */,
    57375734                                E33E8D1B1B9013C300346B52 /* JSNativeStdFunction.h */,
    5738                                 A72700780DAC605600E548D7 /* JSNotAnObject.cpp */,
    5739                                 A72700770DAC605600E548D7 /* JSNotAnObject.h */,
    57405735                                BC22A3980E16E14800AF21C8 /* JSObject.cpp */,
    57415736                                BC22A3990E16E14800AF21C8 /* JSObject.h */,
    … …  
    90889083                                0FB387921BFD31A100E3AB1E /* FTLCompile.cpp in Sources */,
    90899084                                E33E8D1C1B9013C300346B52 /* JSNativeStdFunction.cpp in Sources */,
    9090                                 A72700900DAC6BBC00E548D7 /* JSNotAnObject.cpp in Sources */,
    90919085                                147F39D4107EC37600427A48 /* JSObject.cpp in Sources */,
    90929086                                1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */,

  • TabularUnified trunk/Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp

    r190722 r197794  
    150150    if (exception->value().isObject()) {
    151151        JSObject* exceptionObject = exception->value().toObject(exec);
     152        ASSERT(exceptionObject);
    152153        int lineNumber;
    153154        int columnNumber;

  • TabularUnified trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

    r197614 r197794  
    4949#include "JSLexicalEnvironment.h"
    5050#include "JSModuleEnvironment.h"
    51 #include "JSNotAnObject.h"
    5251#include "JSStackInlines.h"
    5352#include "JSString.h"

  • TabularUnified trunk/Source/JavaScriptCore/jit/JITOperations.cpp

    r197648 r197794  
    17661766
    17671767    JSObject* baseObj = JSValue::decode(encodedBase).toObject(exec);
     1768    if (!baseObj)
     1769        JSValue::encode(JSValue());
    17681770    bool couldDelete = baseObj->methodTable(vm)->deleteProperty(baseObj, exec, *identifier);
    17691771    JSValue result = jsBoolean(couldDelete);
    … …  
    18061808    VM& vm = exec->vm();
    18071809    NativeCallFrameTracer tracer(&vm, exec);
    1808     return JSValue::encode(JSValue::decode(value).toObject(exec));
     1810    JSObject* obj = JSValue::decode(value).toObject(exec);
     1811    if (!obj)
     1812        return JSValue::encode(JSValue());
     1813    return JSValue::encode(obj);
    18091814}
    18101815
    … …  
    20432048
    20442049    JSObject* base = baseValue.toObject(exec);
     2050    if (!base)
     2051        return JSValue::encode(JSValue());
    20452052    return JSValue::encode(jsBoolean(base->hasPropertyGeneric(exec, asString(propertyName)->toIdentifier(exec), PropertySlot::InternalMethodType::GetOwnProperty)));
    20462053}

  • TabularUnified trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

    r197648 r197794  
    682682    CodeBlock* codeBlock = exec->codeBlock();
    683683    JSObject* baseObject = LLINT_OP_C(2).jsValue().toObject(exec);
     684    LLINT_CHECK_EXCEPTION();
    684685    bool couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, codeBlock->identifier(pc[3].u.operand));
    685686    LLINT_CHECK_EXCEPTION();
    … …  
    799800    JSValue baseValue = LLINT_OP_C(2).jsValue();
    800801    JSObject* baseObject = baseValue.toObject(exec);
    801    
     802    LLINT_CHECK_EXCEPTION();
     803
    802804    JSValue subscript = LLINT_OP_C(3).jsValue();
    803805   

  • TabularUnified trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

    r197648 r197794  
    563563{
    564564    JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     565    if (!thisObject)
     566        return JSValue::encode(JSValue());
    565567
    566568    StringRecursionChecker checker(exec, thisObject);
    … …  
    585587    unsigned argCount = exec->argumentCount();
    586588    JSValue curArg = thisValue.toObject(exec);
     589    if (!curArg)
     590        return JSValue::encode(JSValue());
    587591    Checked<unsigned, RecordOverflow> finalArraySize = 0;
    588592
    … …  
    631635
    632636    curArg = thisValue.toObject(exec);
     637    ASSERT(!exec->hadException());
    633638    unsigned n = 0;
    634639    for (unsigned i = 0; ; ++i) {
    … …  
    666671
    667672    JSObject* thisObj = thisValue.toObject(exec);
     673    if (!thisObj)
     674        return JSValue::encode(JSValue());
    668675    unsigned length = getLength(exec, thisObj);
    669676    if (exec->hadException())
    … …  
    698705   
    699706    JSObject* thisObj = thisValue.toObject(exec);
     707    if (!thisObj)
     708        return JSValue::encode(JSValue());
    700709    unsigned length = getLength(exec, thisObj);
    701710    if (exec->hadException())
    … …  
    723732{
    724733    JSObject* thisObject = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     734    if (!thisObject)
     735        return JSValue::encode(JSValue());
    725736
    726737    unsigned length = getLength(exec, thisObject);
    … …  
    796807{
    797808    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     809    if (!thisObj)
     810        return JSValue::encode(JSValue());
    798811    unsigned length = getLength(exec, thisObj);
    799812    if (exec->hadException())
    … …  
    818831    // http://developer.netscape.com/docs/manuals/js/client/jsref/array.htm#1193713 or 15.4.4.10
    819832    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     833    if (!thisObj)
     834        return JSValue::encode(JSValue());
    820835    unsigned length = getLength(exec, thisObj);
    821836    if (exec->hadException())
    … …  
    860875
    861876    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     877    if (!thisObj)
     878        return JSValue::encode(JSValue());
    862879    unsigned length = getLength(exec, thisObj);
    863880    if (exec->hadException())
    … …  
    951968
    952969    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     970    if (!thisObj)
     971        return JSValue::encode(JSValue());
    953972    unsigned length = getLength(exec, thisObj);
    954973    if (exec->hadException())
    … …  
    975994    // 15.4.4.14
    976995    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     996    if (!thisObj)
     997        return JSValue::encode(JSValue());
    977998    unsigned length = getLength(exec, thisObj);
    978999    if (exec->hadException())
    … …  
    9981019    // 15.4.4.15
    9991020    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     1021    if (!thisObj)
     1022        return JSValue::encode(JSValue());
    10001023    unsigned length = getLength(exec, thisObj);
    10011024    if (!length)
    … …  
    10331056{
    10341057    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     1058    if (!thisObj)
     1059        return JSValue::encode(JSValue());
    10351060    return JSValue::encode(JSArrayIterator::create(exec, exec->callee()->globalObject()->arrayIteratorStructure(), ArrayIterateValue, thisObj));
    10361061}
    … …  
    10391064{
    10401065    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     1066    if (!thisObj)
     1067        return JSValue::encode(JSValue());
    10411068    return JSValue::encode(JSArrayIterator::create(exec, exec->callee()->globalObject()->arrayIteratorStructure(), ArrayIterateKeyValue, thisObj));
    10421069}
    … …  
    10451072{
    10461073    JSObject* thisObj = exec->thisValue().toThis(exec, StrictMode).toObject(exec);
     1074    if (!thisObj)
     1075        return JSValue::encode(JSValue());
    10471076    return JSValue::encode(JSArrayIterator::create(exec, exec->callee()->globalObject()->arrayIteratorStructure(), ArrayIterateKey, thisObj));
    10481077}

  • TabularUnified trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

    r197614 r197794  
    550550    JSValue baseValue = OP_C(2).jsValue();
    551551    JSObject* baseObject = baseValue.toObject(exec);
     552    CHECK_EXCEPTION();
    552553   
    553554    JSValue subscript = OP_C(3).jsValue();
    … …  
    607608    BEGIN();
    608609    JSObject* base = OP(2).jsValue().toObject(exec);
     610    CHECK_EXCEPTION();
    609611    JSValue property = OP(3).jsValue();
    610612    pc[4].u.arrayProfile->observeStructure(base->structure(vm));
    … …  
    617619    BEGIN();
    618620    JSObject* base = OP(2).jsValue().toObject(exec);
     621    CHECK_EXCEPTION();
    619622    JSValue property = OP(3).jsValue();
    620623    ASSERT(property.isString());
    … …  
    629632    BEGIN();
    630633    JSObject* base = OP(2).jsValue().toObject(exec);
     634    CHECK_EXCEPTION();
    631635    JSValue property = OP(3).jsValue();
    632636    bool result;
    … …  
    657661
    658662    JSObject* base = baseValue.toObject(exec);
     663    CHECK_EXCEPTION();
    659664
    660665    RETURN(propertyNameEnumerator(exec, base));

  • TabularUnified trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp

    r197614 r197794  
    3535#include "Exception.h"
    3636#include "JSGlobalObjectFunctions.h"
    37 #include "JSNotAnObject.h"
    3837#include "Interpreter.h"
    3938#include "Nodes.h"

  • TabularUnified trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp

    r197648 r197794  
    3333#include "JSFunction.h"
    3434#include "JSGlobalObject.h"
    35 #include "JSNotAnObject.h"
    3635#include "NumberObject.h"
    3736#include "StructureInlines.h"
    … …  
    9190    VM& vm = exec->vm();
    9291    vm.throwException(exec, createNotAnObjectError(exec, *this));
    93     return JSNotAnObject::create(vm);
     92    return nullptr;
    9493}
    9594
    … …  
    126125    VM& vm = exec->vm();
    127126    vm.throwException(exec, createNotAnObjectError(exec, *this));
    128     return JSNotAnObject::create(vm);
     127    return nullptr;
    129128}
    130129
    … …  
    141140    // Check if there are any setters or getters in the prototype chain
    142141    JSObject* obj = synthesizePrototype(exec);
     142    if (UNLIKELY(!obj))
     143        return;
    143144    JSValue prototype;
    144145    if (propertyName != exec->propertyNames().underscoreProto) {
    … …  
    199200    }
    200201   
    201     if (synthesizePrototype(exec)->attemptToInterceptPutByIndexOnHoleForPrototype(exec, *this, propertyName, value, shouldThrow))
     202    JSObject* prototype = synthesizePrototype(exec);
     203    if (UNLIKELY(!prototype)) {
     204        ASSERT(exec->hadException());
     205        return;
     206    }
     207    if (prototype->attemptToInterceptPutByIndexOnHoleForPrototype(exec, *this, propertyName, value, shouldThrow))
    202208        return;
    203209   

  • TabularUnified trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h

    r197614 r197794  
    768768            return true;
    769769        object = synthesizePrototype(exec);
     770        if (UNLIKELY(!object))
     771            return false;
    770772    } else
    771773        object = asObject(asCell());
    … …  
    789791            return slot.getValue(exec, propertyName);
    790792        object = synthesizePrototype(exec);
     793        if (UNLIKELY(!object))
     794            return JSValue();
    791795    } else
    792796        object = asObject(asCell());

  • TabularUnified trunk/Source/JavaScriptCore/runtime/JSFunction.cpp

    r197614 r197794  
    4040#include "JSFunctionInlines.h"
    4141#include "JSGlobalObject.h"
    42 #include "JSNotAnObject.h"
    4342#include "Interpreter.h"
    4443#include "ObjectConstructor.h"

  • TabularUnified trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp

    r197648 r197794  
    822822    JSObject* thisObject = jsDynamicCast<JSObject*>(exec->thisValue().toThis(exec, NotStrictMode));
    823823
    824     if (!thisObject)
    825         return JSValue::encode(exec->thisValue().synthesizePrototype(exec));
     824    if (!thisObject) {
     825        JSObject* prototype = exec->thisValue().synthesizePrototype(exec);
     826        if (UNLIKELY(!prototype))
     827            return JSValue::encode(JSValue());
     828        return JSValue::encode(prototype);
     829    }
    826830
    827831    GlobalFuncProtoGetterFunctor functor(exec, thisObject);

  • TabularUnified trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp

    r197648 r197794  
    452452    if (!exec->argument(0).isObject())
    453453        return throwVMError(exec, createTypeError(exec, ASCIILiteral("Properties can only be defined on Objects.")));
    454     return JSValue::encode(defineProperties(exec, asObject(exec->argument(0)), exec->argument(1).toObject(exec)));
     454    JSObject* targetObj = asObject(exec->argument(0));
     455    JSObject* props = exec->argument(1).toObject(exec);
     456    if (!props)
     457        return JSValue::encode(JSValue());
     458    return JSValue::encode(defineProperties(exec, targetObj, props));
    455459}
    456460

  • TabularUnified trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp

    r197648 r197794  
    8282{
    8383    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
    84     return JSValue::encode(thisValue.toObject(exec));
     84    JSObject* valueObj = thisValue.toObject(exec);
     85    if (!valueObj)
     86        return JSValue::encode(JSValue());
     87    return JSValue::encode(valueObj);
    8588}
    8689
    … …  
    9194    if (exec->hadException())
    9295        return JSValue::encode(jsUndefined());
    93     return JSValue::encode(jsBoolean(thisValue.toObject(exec)->hasOwnProperty(exec, propertyName)));
     96    JSObject* thisObject = thisValue.toObject(exec);
     97    if (!thisObject)
     98        return JSValue::encode(JSValue());
     99    return JSValue::encode(jsBoolean(thisObject->hasOwnProperty(exec, propertyName)));
    94100}
    95101
    … …  
    98104    JSValue thisValue = exec->thisValue().toThis(exec, StrictMode);
    99105    JSObject* thisObj = thisValue.toObject(exec);
     106    if (!thisObj)
     107        return JSValue::encode(JSValue());
    100108
    101109    if (!exec->argument(0).isObject())
    … …  
    266274        return JSValue::encode(thisValue.isUndefined() ? vm.smallStrings.undefinedObjectString() : vm.smallStrings.nullObjectString());
    267275    JSObject* thisObject = thisValue.toObject(exec);
     276    if (!thisObject)
     277        return JSValue::encode(JSValue());
    268278
    269279    JSString* result = thisObject->structure(vm)->objectToStringValue();

  • TabularUnified trunk/Source/JavaScriptCore/runtime/VM.cpp

    r197595 r197794  
    6666#include "JSLexicalEnvironment.h"
    6767#include "JSLock.h"
    68 #include "JSNotAnObject.h"
    6968#include "JSPromiseDeferred.h"
    7069#include "JSPropertyNameEnumerator.h"
    … …  
    216215    terminatedExecutionErrorStructure.set(*this, TerminatedExecutionError::createStructure(*this, 0, jsNull()));
    217216    stringStructure.set(*this, JSString::createStructure(*this, 0, jsNull()));
    218     notAnObjectStructure.set(*this, JSNotAnObject::createStructure(*this, 0, jsNull()));
    219217    propertyNameEnumeratorStructure.set(*this, JSPropertyNameEnumerator::createStructure(*this, 0, jsNull()));
    220218    getterSetterStructure.set(*this, GetterSetter::createStructure(*this, 0, jsNull()));

  • TabularUnified trunk/Source/JavaScriptCore/runtime/VM.h

    r197595 r197794  
    285285    Strong<Structure> terminatedExecutionErrorStructure;
    286286    Strong<Structure> stringStructure;
    287     Strong<Structure> notAnObjectStructure;
    288287    Strong<Structure> propertyNameIteratorStructure;
    289288    Strong<Structure> propertyNameEnumeratorStructure;

  • TabularUnified trunk/Source/WebCore/ChangeLog

    r197793 r197794  
     12016-03-08  Mark Lam  <mark.lam@apple.com>
     2
     3        synthesizePrototype() and friends need to be followed by exception checks (or equivalent).
     4        https://bugs.webkit.org/show_bug.cgi?id=155169
     5
     6        Reviewed by Geoffrey Garen.
     7
     8        No new tests because this issue is covered by existing tests when the fix for
     9        https://bugs.webkit.org/show_bug.cgi?id=154865 lands.  That patch is waiting for
     10        this patch to land first so as to not introduce test failures.
     11
     12        * Modules/plugins/QuickTimePluginReplacement.mm:
     13        (WebCore::QuickTimePluginReplacement::installReplacement):
     14        * bindings/js/JSDeviceMotionEventCustom.cpp:
     15        (WebCore::readAccelerationArgument):
     16        (WebCore::readRotationRateArgument):
     17        * bindings/js/JSGeolocationCustom.cpp:
     18        (WebCore::createPositionOptions):
     19        * bindings/js/JSHTMLCanvasElementCustom.cpp:
     20        (WebCore::get3DContextAttributes):
     21        * bindings/scripts/CodeGeneratorJS.pm:
     22        (GenerateConstructorDefinition):
     23        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
     24        (WebCore::JSTestEventConstructorConstructor::construct):
     25        * contentextensions/ContentExtensionParser.cpp:
     26        (WebCore::ContentExtensions::getTypeFlags):
     27        * html/HTMLMediaElement.cpp:
     28        (WebCore::setPageScaleFactorProperty):
     29        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
     30        (WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):
     31        * html/HTMLPlugInImageElement.cpp:
     32        (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):
     33
    1342016-03-08  Oliver Hunt  <oliver@apple.com>
    235

  • TabularUnified trunk/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm

    r197614 r197794  
    191191        return false;
    192192    JSC::JSObject* replacementObject = replacementFunction.toObject(exec);
     193    ASSERT(!exec->hadException());
    193194    JSC::CallData callData;
    194195    JSC::CallType callType = replacementObject->methodTable()->getCallData(replacementObject, callData);
    … …  
    221222    // Get the scripting interface.
    222223    value = replacement.get(exec, JSC::Identifier::fromString(exec, "scriptObject"));
    223     if (!exec->hadException() && !value.isUndefinedOrNull())
     224    if (!exec->hadException() && !value.isUndefinedOrNull()) {
    224225        m_scriptObject = value.toObject(exec);
     226        ASSERT(!exec->hadException());
     227    }
    225228
    226229    if (!m_scriptObject) {

  • TabularUnified trunk/Source/WebCore/bindings/js/JSDeviceMotionEventCustom.cpp

    r195524 r197794  
    4848    // Given the above test, this will always yield an object.
    4949    JSObject* object = value.toObject(&state);
     50    ASSERT(!state.hadException());
    5051
    5152    JSValue xValue = object->get(&state, Identifier::fromString(&state, "x"));
    … …  
    8687    // Given the above test, this will always yield an object.
    8788    JSObject* object = value.toObject(&state);
     89    ASSERT(!state.hadException());
    8890
    8991    JSValue alphaValue = object->get(&state, Identifier::fromString(&state, "alpha"));

  • TabularUnified trunk/Source/WebCore/bindings/js/JSGeolocationCustom.cpp

    r191887 r197794  
    8383    // Given the above test, this will always yield an object.
    8484    JSObject* object = value.toObject(exec);
     85    ASSERT(!exec->hadException());
    8586
    8687    // Create the dictionary wrapper from the initializer object.

  • TabularUnified trunk/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp

    r191887 r197794  
    5252   
    5353    JSObject* initializerObject = initializerValue.toObject(&state);
     54    ASSERT(!state.hadException());
    5455    JSDictionary dictionary(&state, initializerObject);
    5556   

  • TabularUnified trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

    r197748 r197794  
    48214821        // Given the above test, this will always yield an object.
    48224822        JSObject* initializerObject = initializerValue.toObject(state);
     4823        ASSERT(!state->hadException());
    48234824
    48244825        // Create the dictionary wrapper from the initializer object.

  • TabularUnified trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp

    r197648 r197794  
    8989        // Given the above test, this will always yield an object.
    9090        JSObject* initializerObject = initializerValue.toObject(state);
     91        ASSERT(!state->hadException());
    9192
    9293        // Create the dictionary wrapper from the initializer object.

  • TabularUnified trunk/Source/WebCore/contentextensions/ContentExtensionParser.cpp

    r194496 r197794  
    9191
    9292    const JSObject* object = typeValue.toObject(&exec);
     93    ASSERT(!exec.hadException());
    9394    if (!isJSArray(object))
    9495        return ContentExtensionError::JSONInvalidTriggerFlagsArray;

  • TabularUnified trunk/Source/WebCore/html/HTMLMediaElement.cpp

    r197628 r197794  
    63106310    JSC::PutPropertySlot propertySlot(controllerValue);
    63116311    JSC::JSObject* controllerObject = controllerValue.toObject(exec);
     6312    if (!controllerObject)
     6313        return;
    63126314    controllerObject->methodTable()->put(controllerObject, exec, JSC::Identifier::fromString(exec, "pageScaleFactor"), JSC::jsNumber(pageScaleFactor), propertySlot);
    63136315}
    … …  
    63566358
    63576359    JSC::JSObject* function = functionValue.toObject(exec);
     6360    ASSERT(!exec->hadException());
    63586361    JSC::CallData callData;
    63596362    JSC::CallType callType = function->methodTable()->getCallData(function, callData);
    … …  
    63696372    // Connect the Media, MediaControllerHost, and Controller so the GC knows about their relationship
    63706373    JSC::JSObject* mediaJSWrapperObject = mediaJSWrapper.toObject(exec);
     6374    ASSERT(!exec->hadException());
    63716375    JSC::Identifier controlsHost = JSC::Identifier::fromString(&exec->vm(), "controlsHost");
    63726376   
    … …  
    64506454
    64516455    JSC::JSObject* function = functionValue.toObject(exec);
     6456    ASSERT(!exec->hadException());
    64526457    JSC::CallData callData;
    64536458    JSC::CallType callType = function->methodTable()->getCallData(function, callData);

  • TabularUnified trunk/Source/WebCore/html/HTMLPlugInImageElement.cpp

    r197614 r197794  
    405405    // It is expected the JS file provides a createOverlay(shadowRoot, title, subtitle) function.
    406406    JSC::JSObject* overlay = globalObject->get(exec, JSC::Identifier::fromString(exec, "createOverlay")).toObject(exec);
     407    if (!overlay) {
     408        ASSERT(exec->hadException());
     409        exec->clearException();
     410        return;
     411    }
    407412    JSC::CallData callData;
    408413    JSC::CallType callType = overlay->methodTable()->getCallData(overlay, callData);
Note: See TracChangeset for help on using the changeset viewer.