Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (203314 => 203315)
--- trunk/Source/_javascript_Core/ChangeLog 2016-07-16 00:55:12 UTC (rev 203314)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-07-16 01:14:57 UTC (rev 203315)
@@ -1,3 +1,19 @@
+2016-07-15 Mark Lam <[email protected]>
+
+ Assertion failures and crashes with missing TDZ checks for catch-node bindings.
+ https://bugs.webkit.org/show_bug.cgi?id=158797
+
+ Reviewed by Saam Barati.
+
+ * bytecompiler/BytecodeGenerator.cpp:
+ (JSC::BytecodeGenerator::emitPushCatchScope):
+ (JSC::BytecodeGenerator::emitPopCatchScope):
+ * tests/stress/catch-clause-should-be-under-tdz1.js: Added.
+ * tests/stress/catch-clause-should-be-under-tdz2.js: Added.
+ * tests/stress/catch-clause-should-be-under-tdz3.js: Added.
+ * tests/stress/catch-clause-should-be-under-tdz4.js: Added.
+ * tests/stress/catch-clause-should-be-under-tdz5.js: Added.
+
2016-07-15 Geoffrey Garen <[email protected]>
Added a makeRef<T> helper
Modified: trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp (203314 => 203315)
--- trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp 2016-07-16 00:55:12 UTC (rev 203314)
+++ trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp 2016-07-16 01:14:57 UTC (rev 203315)
@@ -3862,7 +3862,7 @@
void BytecodeGenerator::emitPushCatchScope(VariableEnvironment& environment)
{
- pushLexicalScopeInternal(environment, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, TDZRequirement::NotUnderTDZ, ScopeType::CatchScope, ScopeRegisterType::Block);
+ pushLexicalScopeInternal(environment, TDZCheckOptimization::Optimize, NestedScopeType::IsNotNested, nullptr, TDZRequirement::UnderTDZ, ScopeType::CatchScope, ScopeRegisterType::Block);
}
void BytecodeGenerator::emitPopCatchScope(VariableEnvironment& environment)
Added: trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz1.js (0 => 203315)
--- trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz1.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz1.js 2016-07-16 01:14:57 UTC (rev 203315)
@@ -0,0 +1,10 @@
+// This test should not crash.
+var caughtReferenceError = false;
+try {
+ try { throw [void 0]; } catch ([{constructor} = new constructor]) { }
+} catch (e) {
+ caughtReferenceError = true;
+}
+
+if (!caughtReferenceError)
+ throw Error("Missing ReferenceError");
Added: trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz2.js (0 => 203315)
--- trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz2.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz2.js 2016-07-16 01:14:57 UTC (rev 203315)
@@ -0,0 +1,10 @@
+// This test should not crash.
+var caughtReferenceError = false;
+try {
+ try { throw []; } catch ({c = new class extends C {}, constructor: C}) { }
+} catch (e) {
+ caughtReferenceError = true;
+}
+
+if (!caughtReferenceError)
+ throw Error("Missing ReferenceError");
Added: trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz3.js (0 => 203315)
--- trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz3.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz3.js 2016-07-16 01:14:57 UTC (rev 203315)
@@ -0,0 +1,10 @@
+// This test should not crash.
+var caughtReferenceError = false;
+try {
+ try { throw {}; } catch ({a = (print(a), b), b}) { }
+} catch (e) {
+ caughtReferenceError = true;
+}
+
+if (!caughtReferenceError)
+ throw Error("Missing ReferenceError");
Added: trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz4.js (0 => 203315)
--- trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz4.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz4.js 2016-07-16 01:14:57 UTC (rev 203315)
@@ -0,0 +1,11 @@
+// This test should not crash.
+var caughtReferenceError = false;
+try {
+ function* m(){ try {throw [void 0]} catch ([c = (yield c)]) {} }
+ [...m()]
+} catch (e) {
+ caughtReferenceError = true;
+}
+
+if (!caughtReferenceError)
+ throw Error("Missing ReferenceError");
Added: trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz5.js (0 => 203315)
--- trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz5.js (rev 0)
+++ trunk/Source/_javascript_Core/tests/stress/catch-clause-should-be-under-tdz5.js 2016-07-16 01:14:57 UTC (rev 203315)
@@ -0,0 +1,10 @@
+// This test should not crash.
+var caughtReferenceError = false;
+try {
+ while(1) try {throw {}} catch({a=({}={__proto__}), __proto__}){}
+} catch (e) {
+ caughtReferenceError = true;
+}
+
+if (!caughtReferenceError)
+ throw Error("Missing ReferenceError");
