Changeset 235582 in webkit

Timestamp:

Sep 1, 2018 1:03:43 AM (6 years ago)

Author:

yusukesuzuki@slowstart.org

Message:

Function object should convert params to string before throw a parsing error
​https://bugs.webkit.org/show_bug.cgi?id=188874

Reviewed by Darin Adler.

JSTests:

• stress/function-body-to-string-before-parameter-syntax-check.js: Added.

(shouldThrow):

Source/JavaScriptCore:

ToString operation onto the body of the Function constructor should be performed
before checking syntax correctness of the parameters.

• runtime/FunctionConstructor.cpp:

(JSC::constructFunctionSkippingEvalEnabledCheck):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/function-body-to-string-before-parameter-syntax-check.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/FunctionConstructor.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-08-24  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
+
+        Function object should convert params to string before throw a parsing error
+        https://bugs.webkit.org/show_bug.cgi?id=188874
+
+        Reviewed by Darin Adler.
+
+        * stress/function-body-to-string-before-parameter-syntax-check.js: Added.
+        (shouldThrow):
+
 2018-08-31  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-08-24  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
+
+        Function object should convert params to string before throw a parsing error
+        https://bugs.webkit.org/show_bug.cgi?id=188874
+
+        Reviewed by Darin Adler.
+
+        ToString operation onto the `body` of the Function constructor should be performed
+        before checking syntax correctness of the parameters.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+
 2018-08-31  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/runtime/FunctionConstructor.cpp

@@ -140 +140 @@
             parameterBuilder.append(viewWithString.view);
         }
+        auto body = args.at(args.size() - 1).toWTFString(exec);
+        RETURN_IF_EXCEPTION(scope, nullptr);
 
         {
@@ -156 +158 @@
         builder.append(parameterBuilder);
         builder.appendLiteral(") {\n");
-        auto body = args.at(args.size() - 1).toWTFString(exec);
-        RETURN_IF_EXCEPTION(scope, nullptr);
         checkBody(body);
         RETURN_IF_EXCEPTION(scope, nullptr);