Changeset 204388 in webkit

Timestamp:

Aug 11, 2016 2:21:55 PM (8 years ago)

Author:

mark.lam@apple.com

Message:

The jsc shell's Element host constructor should throw if it fails to construct an object.
​https://bugs.webkit.org/show_bug.cgi?id=160773
<rdar://problem/27328608>

Reviewed by Saam Barati.

JSTests:

• stress/generational-opaque-roots.js:

Source/JavaScriptCore:

The Element object is a test object provided in the jsc shell for testing use only.
JavaScriptCore expects host constructors to either throw an error or return a
constructed object. Element has a host constructor that did not obey this contract.
As a result, the following statement will fail a RELEASE_ASSERT:

new (Element.bind())

This is now fixed.

• jsc.cpp:

(functionCreateElement):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/generational-opaque-roots.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/jsc.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ -1 @@
-2016-08-10  Mark Lam  <mark.lam@apple.com>
+2016-08-11  Mark Lam  <mark.lam@apple.com>
+
+        The jsc shell's Element host constructor should throw if it fails to construct an object.
+        https://bugs.webkit.org/show_bug.cgi?id=160773
+        <rdar://problem/27328608>
+
+        Reviewed by Saam Barati.
+
+        * stress/generational-opaque-roots.js:
+
+2016-08-11  Mark Lam  <mark.lam@apple.com>
 
         Disallow synchronous sweeping for eden GCs.

trunk/JSTests/stress/generational-opaque-roots.js

@@ -1 +1 @@
 // Tests that opaque roots behave correctly during young generation collections
+
+try {
+    // regression test for bug 160773.  This should not crash.
+    new (Element.bind());
+} catch(e) {
+}
 
 // Create the primary Root.

trunk/Source/JavaScriptCore/ChangeLog

@@ -1 @@
-2016-08-10  Mark Lam  <mark.lam@apple.com>
+2016-08-11  Mark Lam  <mark.lam@apple.com>
+
+        The jsc shell's Element host constructor should throw if it fails to construct an object.
+        https://bugs.webkit.org/show_bug.cgi?id=160773
+        <rdar://problem/27328608>
+
+        Reviewed by Saam Barati.
+
+        The Element object is a test object provided in the jsc shell for testing use only.
+        JavaScriptCore expects host constructors to either throw an error or return a
+        constructed object.  Element has a host constructor that did not obey this contract.
+        As a result, the following statement will fail a RELEASE_ASSERT:
+
+            new (Element.bind())
+
+        This is now fixed.
+
+        * jsc.cpp:
+        (functionCreateElement):
+
+2016-08-11  Mark Lam  <mark.lam@apple.com>
 
         Disallow synchronous sweeping for eden GCs.

trunk/Source/JavaScriptCore/jsc.cpp

@@ -1232 +1232 @@
     Root* root = jsDynamicCast<Root*>(exec->argument(0));
     if (!root)
-        return JSValue::encode(jsUndefined());
+        return JSValue::encode(exec->vm().throwException(exec, createError(exec, ASCIILiteral("Cannot create Element without a Root."))));
     return JSValue::encode(Element::create(exec->vm(), exec->lexicalGlobalObject(), root));
 }