Title: [214767] releases/WebKitGTK/webkit-2.16
- Revision
- 214767
- Author
- carlo...@webkit.org
- Date
- 2017-04-03 04:07:46 -0700 (Mon, 03 Apr 2017)
Log Message
Merge r214143 - import(arg) crashes when ToString(arg) throws
https://bugs.webkit.org/show_bug.cgi?id=169778
Reviewed by Saam Barati.
JSTests:
* stress/import-reject-with-exception.js: Added.
(shouldBe):
(let.x.get toString):
Source/_javascript_Core:
JSPromiseDeferred should not be rejected with Exception*.
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncImportModule):
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.16/JSTests/ChangeLog (214766 => 214767)
--- releases/WebKitGTK/webkit-2.16/JSTests/ChangeLog 2017-04-03 11:03:11 UTC (rev 214766)
+++ releases/WebKitGTK/webkit-2.16/JSTests/ChangeLog 2017-04-03 11:07:46 UTC (rev 214767)
@@ -1,3 +1,14 @@
+2017-03-19 Yusuke Suzuki <utatane....@gmail.com>
+
+ import(arg) crashes when ToString(arg) throws
+ https://bugs.webkit.org/show_bug.cgi?id=169778
+
+ Reviewed by Saam Barati.
+
+ * stress/import-reject-with-exception.js: Added.
+ (shouldBe):
+ (let.x.get toString):
+
2017-03-15 Yusuke Suzuki <utatane....@gmail.com>
[JSC] Default parameter part should be retrieved by op_get_argument opcode instead of changing arity
Added: releases/WebKitGTK/webkit-2.16/JSTests/stress/import-reject-with-exception.js (0 => 214767)
--- releases/WebKitGTK/webkit-2.16/JSTests/stress/import-reject-with-exception.js (rev 0)
+++ releases/WebKitGTK/webkit-2.16/JSTests/stress/import-reject-with-exception.js 2017-04-03 11:07:46 UTC (rev 214767)
@@ -0,0 +1,15 @@
+function shouldBe(actual, expected)
+{
+ if (actual !== expected)
+ abort();
+}
+
+let x = {
+ get toString() {
+ throw new Error('bad');
+ }
+};
+
+import(x).then(abort, function (error) {
+ shouldBe(String(error), `Error: bad`);
+});
Modified: releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/ChangeLog (214766 => 214767)
--- releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/ChangeLog 2017-04-03 11:03:11 UTC (rev 214766)
+++ releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/ChangeLog 2017-04-03 11:07:46 UTC (rev 214767)
@@ -1,3 +1,15 @@
+2017-03-19 Yusuke Suzuki <utatane....@gmail.com>
+
+ import(arg) crashes when ToString(arg) throws
+ https://bugs.webkit.org/show_bug.cgi?id=169778
+
+ Reviewed by Saam Barati.
+
+ JSPromiseDeferred should not be rejected with Exception*.
+
+ * runtime/JSGlobalObjectFunctions.cpp:
+ (JSC::globalFuncImportModule):
+
2017-03-16 Mark Lam <mark....@apple.com>
Fix exception scope verification failures in GenericArgumentsInlines.h.
Modified: releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp (214766 => 214767)
--- releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp 2017-04-03 11:03:11 UTC (rev 214766)
+++ releases/WebKitGTK/webkit-2.16/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp 2017-04-03 11:07:46 UTC (rev 214767)
@@ -948,7 +948,7 @@
auto* specifier = exec->uncheckedArgument(0).toString(exec);
if (Exception* exception = catchScope.exception()) {
catchScope.clearException();
- promise->reject(exec, exception);
+ promise->reject(exec, exception->value());
return JSValue::encode(promise->promise());
}
@@ -955,7 +955,7 @@
auto* internalPromise = globalObject->moduleLoader()->importModule(exec, specifier, sourceOrigin);
if (Exception* exception = catchScope.exception()) {
catchScope.clearException();
- promise->reject(exec, exception);
+ promise->reject(exec, exception->value());
return JSValue::encode(promise->promise());
}
promise->resolve(exec, internalPromise);
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
