Changeset 235491 in webkit

Timestamp:

Aug 29, 2018, 6:20:20 PM (7 years ago)

Author:

mark.lam@apple.com

Message:

Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
​https://bugs.webkit.org/show_bug.cgi?id=189132
<rdar://problem/42513068>

Reviewed by Saam Barati.

JSTests:

• stress/regress-189132.js: Added.

Source/JavaScriptCore:

• runtime/JSCJSValueInlines.h:

(JSC::JSValue::toPropertyKey const):

• runtime/JSString.cpp:

(JSC::JSRopeString::resolveRopeToAtomicString const):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/regress-189132.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSCJSValueInlines.h (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSString.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-08-29  Mark Lam  <mark.lam@apple.com>
+
+        Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
+        https://bugs.webkit.org/show_bug.cgi?id=189132
+        <rdar://problem/42513068>
+
+        Reviewed by Saam Barati.
+
+        * stress/regress-189132.js: Added.
+
 2018-08-27  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-08-29  Mark Lam  <mark.lam@apple.com>
+
+        Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
+        https://bugs.webkit.org/show_bug.cgi?id=189132
+        <rdar://problem/42513068>
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSCJSValueInlines.h:
+        (JSC::JSValue::toPropertyKey const):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::resolveRopeToAtomicString const):
+
 2018-08-29  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/JavaScriptCore/runtime/JSCJSValueInlines.h

@@ -650 +650 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
 
-    if (isString())
+    if (isString()) {
+        scope.release();
         return asString(*this)->toIdentifier(exec);
+    }
 
     JSValue primitive = toPrimitive(exec, PreferString);
     RETURN_IF_EXCEPTION(scope, vm.propertyNames->emptyIdentifier);
-    if (primitive.isSymbol())
+    if (primitive.isSymbol()) {
+        scope.release();
         return Identifier::fromUid(asSymbol(primitive)->privateName());
+    }
     scope.release();
     return primitive.toString(exec)->toIdentifier(exec);

trunk/Source/JavaScriptCore/runtime/JSString.cpp

@@ -179 +179 @@
 void JSRopeString::resolveRopeToAtomicString(ExecState* exec) const
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (length() > maxLengthForOnStackResolve) {
         resolveRope(exec);
+        RETURN_IF_EXCEPTION(scope, void());
         m_value = AtomicString(m_value);
         setIs8Bit(m_value.impl()->is8Bit());