Changeset 33566 in webkit

Timestamp:

May 18, 2008 5:36:04 PM (16 years ago)

Author:

oliver@apple.com

Message:

Bug 18752: SQUIRRELFISH: exceptions are not always handled by the vm
<​https://bugs.webkit.org/show_bug.cgi?id=18752>

Reviewed by Maciej

Handle exceptions thrown by toString conversion in subscript operators,
this should basically complete exception handling in SquirrelFish.

Sunspider reports no regression.

Location:

branches/squirrelfish

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/VM/Machine.cpp (modified) (4 diffs)
• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/resources/tostring-exception-in-property-access.js (added)
• LayoutTests/fast/js/tostring-exception-in-property-access-expected.txt (added)
• LayoutTests/fast/js/tostring-exception-in-property-access.html (added)

branches/squirrelfish/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-05-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18752: SQUIRRELFISH: exceptions are not always handled by the vm
+        <https://bugs.webkit.org/show_bug.cgi?id=18752>
+
+        Handle exceptions thrown by toString conversion in subscript operators,
+        this should basically complete exception handling in SquirrelFish.
+
+        Sunspider reports no regression.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
 2008-05-17  Geoffrey Garen  <ggaren@apple.com>
 

branches/squirrelfish/JavaScriptCore/VM/Machine.cpp

@@ -1387 +1387 @@
         if (propName->getUInt32(i))
             r[dst].u.jsValue = jsBoolean(baseObj->hasProperty(exec, i));
-        else
-            r[dst].u.jsValue = jsBoolean(baseObj->hasProperty(exec, Identifier(propName->toString(exec))));
+        else {
+            Identifier property(propName->toString(exec));
+            VM_CHECK_EXCEPTION();
+            r[dst].u.jsValue = jsBoolean(baseObj->hasProperty(exec, property));
+        }
 
         ++vPC;
@@ -1548 +1551 @@
             result = baseObj->get(exec, i);
         else {
-            VM_CHECK_EXCEPTION(); // If toObject threw, we must not call toString, which may execute arbitrary code
-            result = baseObj->get(exec, Identifier(subscript->toString(exec)));
+            Identifier property;
+            if (subscript->isObject()) {
+                VM_CHECK_EXCEPTION(); // If toObject threw, we must not call toString, which may execute arbitrary code
+                property = Identifier(subscript->toString(exec));
+            } else
+                property = Identifier(subscript->toString(exec));
+
+            VM_CHECK_EXCEPTION(); // This check is needed to prevent us from incorrectly calling a getter after an exception is thrown
+            result = baseObj->get(exec, property);
         }
         
@@ -1580 +1590 @@
             baseObj->put(exec, i, r[value].u.jsValue);
         else {
-            VM_CHECK_EXCEPTION(); // If toObject threw, we must not call toString, which may execute arbitrary code
-            baseObj->put(exec, Identifier(subscript->toString(exec)), r[value].u.jsValue);
+            Identifier property;
+            if (subscript->isObject()) {
+                VM_CHECK_EXCEPTION(); // If toObject threw, we must not call toString, which may execute arbitrary code
+                property = Identifier(subscript->toString(exec));
+            } else
+                property = Identifier(subscript->toString(exec));
+
+            VM_CHECK_EXCEPTION(); // This check is needed to prevent us from incorrectly calling a setter after an exception is thrown
+            baseObj->put(exec, property, r[value].u.jsValue);
         }
         
@@ -1609 +1626 @@
         else {
             VM_CHECK_EXCEPTION(); // If toObject threw, we must not call toString, which may execute arbitrary code
-            result = jsBoolean(baseObj->deleteProperty(exec, Identifier(subscript->toString(exec))));
+            Identifier property(subscript->toString(exec));
+            VM_CHECK_EXCEPTION();
+            result = jsBoolean(baseObj->deleteProperty(exec, property));
         }
         

branches/squirrelfish/LayoutTests/ChangeLog

@@ +1 @@
+2008-05-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej.
+
+        Bug 18752: SQUIRRELFISH: exceptions are not always handled by the vm
+        <https://bugs.webkit.org/show_bug.cgi?id=18752>
+
+        Test cases for subscript access that throw exceptions. 
+
+        * fast/js/resources/tostring-exception-in-property-access.js: Added.
+        * fast/js/tostring-exception-in-property-access-expected.txt: Added.
+        * fast/js/tostring-exception-in-property-access.html: Added.
+
 2008-05-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>