Changeset 243665 in webkit

Timestamp:

Mar 29, 2019 2:53:54 PM (5 years ago)

Author:

Tadeu Zagallo

Message:

Assertion failed in JSC::createError
​https://bugs.webkit.org/show_bug.cgi?id=196305
<rdar://problem/49387382>

Reviewed by Saam Barati.

JSTests:

• stress/create-error-out-of-memory-rope-string-2.js: Added.

(assert):
(catch):

Source/JavaScriptCore:

JSC::createError assumes that errorDescriptionForValue will either
throw an exception or return a valid description string. However, that
is not true if the value is a rope string and we successfully resolve it,
but later fail to wrap the string in quotes with tryMakeString.

• runtime/ExceptionHelpers.cpp:

(JSC::createError):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/create-error-out-of-memory-rope-string-2.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ExceptionHelpers.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-03-29  Tadeu Zagallo  <tzagallo@apple.com>
+
+        Assertion failed in JSC::createError
+        https://bugs.webkit.org/show_bug.cgi?id=196305
+        <rdar://problem/49387382>
+
+        Reviewed by Saam Barati.
+
+        * stress/create-error-out-of-memory-rope-string-2.js: Added.
+        (assert):
+        (catch):
+
 2019-03-28  Saam Barati  <sbarati@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-03-29  Tadeu Zagallo  <tzagallo@apple.com>
+
+        Assertion failed in JSC::createError
+        https://bugs.webkit.org/show_bug.cgi?id=196305
+        <rdar://problem/49387382>
+
+        Reviewed by Saam Barati.
+
+        JSC::createError assumes that `errorDescriptionForValue` will either
+        throw an exception or return a valid description string. However, that
+        is not true if the value is a rope string and we successfully resolve it,
+        but later fail to wrap the string in quotes with `tryMakeString`.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+
 2019-03-29  Devin Rousso  <drousso@apple.com>
 

trunk/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp

@@ -276 +276 @@
 
     String valueDescription = errorDescriptionForValue(exec, value);
-    ASSERT(scope.exception() || !!valueDescription);
-    if (!valueDescription) {
+    if (scope.exception() || !valueDescription) {
         scope.clearException();
         return createOutOfMemoryError(exec);