Changeset 207906 in webkit

Timestamp:

Oct 26, 2016 12:23:55 PM (7 years ago)

Author:

mark.lam@apple.com

Message:

JSGenericTypedArrayView::set() should check for exceptions.
​https://bugs.webkit.org/show_bug.cgi?id=164007
<rdar://problem/28853775>

Reviewed by Filip Pizlo.

JSTests:

• stress/typed-array-view-set-should-not-crash-on-exception.js: Added.

Source/JavaScriptCore:

• runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::set):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/typed-array-view-set-should-not-crash-on-exception.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h (modified) (4 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2016-10-26  Mark Lam  <mark.lam@apple.com>
+
+        JSGenericTypedArrayView::set() should check for exceptions.
+        https://bugs.webkit.org/show_bug.cgi?id=164007
+        <rdar://problem/28853775>
+
+        Reviewed by Filip Pizlo.
+
+        * stress/typed-array-view-set-should-not-crash-on-exception.js: Added.
+
 2016-10-25  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-10-26  Mark Lam  <mark.lam@apple.com>
+
+        JSGenericTypedArrayView::set() should check for exceptions.
+        https://bugs.webkit.org/show_bug.cgi?id=164007
+        <rdar://problem/28853775>
+
+        Reviewed by Filip Pizlo.
+
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView<Adaptor>::set):
+
 2016-10-25  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h

@@ -243 +243 @@
     ExecState* exec, unsigned offset, JSObject* object, unsigned objectOffset, unsigned length, CopyType type)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     const ClassInfo* ci = object->classInfo();
     if (ci->typedArrayStorageType == Adaptor::typeValue) {
@@ -250 +253 @@
         
         RELEASE_ASSERT(other->canAccessRangeQuickly(objectOffset, length));
-        if (!validateRange(exec, offset, length))
+        bool success = validateRange(exec, offset, length);
+        ASSERT(!scope.exception() == success);
+        if (!success)
             return false;
 
@@ -287 +292 @@
     case NotTypedArray:
     case TypeDataView: {
-        if (!validateRange(exec, offset, length))
+        bool success = validateRange(exec, offset, length);
+        ASSERT(!scope.exception() == success);
+        if (!success)
             return false;
 
@@ -293 +300 @@
         for (unsigned i = 0; i < length; ++i) {
             JSValue value = object->get(exec, i + objectOffset);
-            if (!setIndex(exec, offset + i, value))
+            RETURN_IF_EXCEPTION(scope, false);
+            bool success = setIndex(exec, offset + i, value);
+            ASSERT(!scope.exception() || !success);
+            if (!success)
                 return false;
         }