Changeset 275324 in webkit

Timestamp:

Mar 31, 2021, 5:29:13 PM (4 years ago)

Author:

mark.lam@apple.com

Message:

Placate exception check validation below convertVariadicArguments().
​https://bugs.webkit.org/show_bug.cgi?id=224027
rdar://68912995

Reviewed by Saam Barati.

Source/WebCore:

Test: js/dom/missing-exception-check-in-convertVariadicArguments.html

• bindings/js/JSDOMConvertVariadic.h:

(WebCore::convertVariadicArguments):

LayoutTests:

• js/dom/missing-exception-check-in-convertVariadicArguments-expected.txt: Added.
• js/dom/missing-exception-check-in-convertVariadicArguments.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/dom/missing-exception-check-in-convertVariadicArguments-expected.txt (added)
• LayoutTests/js/dom/missing-exception-check-in-convertVariadicArguments.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/js/JSDOMConvertVariadic.h (modified) (3 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-03-31  Mark Lam  <mark.lam@apple.com>
+
+        Placate exception check validation below convertVariadicArguments().
+        https://bugs.webkit.org/show_bug.cgi?id=224027
+        rdar://68912995
+
+        Reviewed by Saam Barati.
+
+        * js/dom/missing-exception-check-in-convertVariadicArguments-expected.txt: Added.
+        * js/dom/missing-exception-check-in-convertVariadicArguments.html: Added.
+
 2021-03-31  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-03-31  Mark Lam  <mark.lam@apple.com>
+
+        Placate exception check validation below convertVariadicArguments().
+        https://bugs.webkit.org/show_bug.cgi?id=224027
+        rdar://68912995
+
+        Reviewed by Saam Barati.
+
+        Test: js/dom/missing-exception-check-in-convertVariadicArguments.html
+
+        * bindings/js/JSDOMConvertVariadic.h:
+        (WebCore::convertVariadicArguments):
+
 2021-03-31  Venky Dass  <yaranamavenkataramana@apple.com>
 

trunk/Source/WebCore/bindings/js/JSDOMConvertVariadic.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2016-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -49 +49 @@
 template<typename IDLType> Vector<typename VariadicConverter<IDLType>::Item> convertVariadicArguments(JSC::JSGlobalObject& lexicalGlobalObject, JSC::CallFrame& callFrame, size_t startIndex)
 {
+    auto& vm = JSC::getVM(&lexicalGlobalObject);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     size_t length = callFrame.argumentCount();
     if (startIndex >= length)
@@ -58 +61 @@
     for (size_t i = startIndex; i < length; ++i) {
         auto value = VariadicConverter<IDLType>::convert(lexicalGlobalObject, callFrame.uncheckedArgument(i));
+        EXCEPTION_ASSERT_UNUSED(scope, !!scope.exception() == !value);
         if (!value)
             return { };