Title: [239256] trunk/Source
Revision
239256
Author
[email protected]
Date
2018-12-15 21:49:01 -0800 (Sat, 15 Dec 2018)

Log Message

Null pointer dereference in JSC::WriteBarrierBase()
https://bugs.webkit.org/show_bug.cgi?id=191252

Reviewed by Keith Miller.

Source/_javascript_Core:

JSPromiseDeferred::create can return nullptr and an exception if stack overflow happens.
We would like to make it RELEASE_ASSERT since the current module mechanism is not immune
to stack overflow.

This patch renames JSPromiseDeferred::create to JSPromiseDeferred::tryCreate to tell that
it can return nullptr. And we insert error checks or assertions after this call.

* jsc.cpp:
(GlobalObject::moduleLoaderImportModule):
(GlobalObject::moduleLoaderFetch):
* runtime/Completion.cpp:
(JSC::rejectPromise):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncImportModule):
* runtime/JSInternalPromiseDeferred.cpp:
(JSC::JSInternalPromiseDeferred::tryCreate):
(JSC::JSInternalPromiseDeferred::create): Deleted.
* runtime/JSInternalPromiseDeferred.h:
* runtime/JSModuleLoader.cpp:
(JSC::JSModuleLoader::importModule):
(JSC::JSModuleLoader::resolve):
(JSC::JSModuleLoader::fetch):
(JSC::moduleLoaderParseModule):
* runtime/JSPromise.h:
* runtime/JSPromiseDeferred.cpp:
(JSC::JSPromiseDeferred::tryCreate):
* runtime/JSPromiseDeferred.h:
* wasm/js/WebAssemblyPrototype.cpp:
(JSC::webAssemblyCompileFunc):
(JSC::webAssemblyInstantiateFunc):
(JSC::webAssemblyCompileStreamingInternal):
(JSC::webAssemblyInstantiateStreamingInternal):

Source/WebCore:

* bindings/js/JSCustomElementRegistryCustom.cpp:
(WebCore::JSCustomElementRegistry::whenDefined):
* bindings/js/JSDOMPromiseDeferred.cpp:
(WebCore::createDeferredPromise):
* bindings/js/JSDOMPromiseDeferred.h:
(WebCore::DeferredPromise::create):
(WebCore::callPromiseFunction):
* bindings/js/JSDOMWindowBase.cpp:
(WebCore::JSDOMWindowBase::moduleLoaderFetch):
(WebCore::JSDOMWindowBase::moduleLoaderImportModule):
* bindings/js/ScriptModuleLoader.cpp:
(WebCore::ScriptModuleLoader::fetch):
(WebCore::rejectPromise):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (239255 => 239256)


--- trunk/Source/_javascript_Core/ChangeLog	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/ChangeLog	2018-12-16 05:49:01 UTC (rev 239256)
@@ -1,3 +1,43 @@
+2018-12-15  Yusuke Suzuki  <[email protected]>
+
+        Null pointer dereference in JSC::WriteBarrierBase()
+        https://bugs.webkit.org/show_bug.cgi?id=191252
+
+        Reviewed by Keith Miller.
+
+        JSPromiseDeferred::create can return nullptr and an exception if stack overflow happens.
+        We would like to make it RELEASE_ASSERT since the current module mechanism is not immune
+        to stack overflow.
+
+        This patch renames JSPromiseDeferred::create to JSPromiseDeferred::tryCreate to tell that
+        it can return nullptr. And we insert error checks or assertions after this call.
+
+        * jsc.cpp:
+        (GlobalObject::moduleLoaderImportModule):
+        (GlobalObject::moduleLoaderFetch):
+        * runtime/Completion.cpp:
+        (JSC::rejectPromise):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncImportModule):
+        * runtime/JSInternalPromiseDeferred.cpp:
+        (JSC::JSInternalPromiseDeferred::tryCreate):
+        (JSC::JSInternalPromiseDeferred::create): Deleted.
+        * runtime/JSInternalPromiseDeferred.h:
+        * runtime/JSModuleLoader.cpp:
+        (JSC::JSModuleLoader::importModule):
+        (JSC::JSModuleLoader::resolve):
+        (JSC::JSModuleLoader::fetch):
+        (JSC::moduleLoaderParseModule):
+        * runtime/JSPromise.h:
+        * runtime/JSPromiseDeferred.cpp:
+        (JSC::JSPromiseDeferred::tryCreate):
+        * runtime/JSPromiseDeferred.h:
+        * wasm/js/WebAssemblyPrototype.cpp:
+        (JSC::webAssemblyCompileFunc):
+        (JSC::webAssemblyInstantiateFunc):
+        (JSC::webAssemblyCompileStreamingInternal):
+        (JSC::webAssemblyInstantiateStreamingInternal):
+
 2018-12-15  Darin Adler  <[email protected]>
 
         Use warning-ignoring macros more consistently and simply

Modified: trunk/Source/_javascript_Core/jsc.cpp (239255 => 239256)


--- trunk/Source/_javascript_Core/jsc.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/jsc.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -806,7 +806,7 @@
     VM& vm = globalObject->vm();
     auto throwScope = DECLARE_THROW_SCOPE(vm);
 
-    auto* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    auto* deferred = JSInternalPromiseDeferred::tryCreate(exec, globalObject);
     RETURN_IF_EXCEPTION(throwScope, nullptr);
 
     auto catchScope = DECLARE_CATCH_SCOPE(vm);
@@ -1000,7 +1000,7 @@
 {
     VM& vm = globalObject->vm();
     auto throwScope = DECLARE_THROW_SCOPE(vm);
-    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::tryCreate(exec, globalObject);
     RETURN_IF_EXCEPTION(throwScope, nullptr);
 
     auto catchScope = DECLARE_CATCH_SCOPE(vm);

Modified: trunk/Source/_javascript_Core/runtime/Completion.cpp (239255 => 239256)


--- trunk/Source/_javascript_Core/runtime/Completion.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/runtime/Completion.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -154,8 +154,10 @@
     scope.assertNoException();
     JSValue exception = scope.exception()->value();
     scope.clearException();
-    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::tryCreate(exec, globalObject);
+    scope.releaseAssertNoException();
     deferred->reject(exec, exception);
+    scope.releaseAssertNoException();
     return deferred->promise();
 }
 

Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp (239255 => 239256)


--- trunk/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObjectFunctions.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -787,7 +787,7 @@
 
     auto* globalObject = exec->lexicalGlobalObject();
 
-    auto* promise = JSPromiseDeferred::create(exec, globalObject);
+    auto* promise = JSPromiseDeferred::tryCreate(exec, globalObject);
     RETURN_IF_EXCEPTION(throwScope, encodedJSValue());
 
     auto catchScope = DECLARE_CATCH_SCOPE(vm);

Modified: trunk/Source/_javascript_Core/runtime/JSInternalPromiseDeferred.cpp (239255 => 239256)


--- trunk/Source/_javascript_Core/runtime/JSInternalPromiseDeferred.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/runtime/JSInternalPromiseDeferred.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -37,7 +37,7 @@
 
 const ClassInfo JSInternalPromiseDeferred::s_info = { "JSInternalPromiseDeferred", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSInternalPromiseDeferred) };
 
-JSInternalPromiseDeferred* JSInternalPromiseDeferred::create(ExecState* exec, JSGlobalObject* globalObject)
+JSInternalPromiseDeferred* JSInternalPromiseDeferred::tryCreate(ExecState* exec, JSGlobalObject* globalObject)
 {
     VM& vm = exec->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);

Modified: trunk/Source/_javascript_Core/runtime/JSInternalPromiseDeferred.h (239255 => 239256)


--- trunk/Source/_javascript_Core/runtime/JSInternalPromiseDeferred.h	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/runtime/JSInternalPromiseDeferred.h	2018-12-16 05:49:01 UTC (rev 239256)
@@ -36,7 +36,7 @@
     typedef JSPromiseDeferred Base;
     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
 
-    JS_EXPORT_PRIVATE static JSInternalPromiseDeferred* create(ExecState*, JSGlobalObject*);
+    JS_EXPORT_PRIVATE static JSInternalPromiseDeferred* tryCreate(ExecState*, JSGlobalObject*);
 
     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
     {

Modified: trunk/Source/_javascript_Core/runtime/JSModuleLoader.cpp (239255 => 239256)


--- trunk/Source/_javascript_Core/runtime/JSModuleLoader.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/runtime/JSModuleLoader.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -238,7 +238,7 @@
     if (globalObject->globalObjectMethodTable()->moduleLoaderImportModule)
         RELEASE_AND_RETURN(throwScope, globalObject->globalObjectMethodTable()->moduleLoaderImportModule(globalObject, exec, this, moduleName, parameters, referrer));
 
-    auto* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    auto* deferred = JSInternalPromiseDeferred::tryCreate(exec, globalObject);
     RETURN_IF_EXCEPTION(throwScope, nullptr);
 
     auto catchScope = DECLARE_CATCH_SCOPE(vm);
@@ -271,7 +271,7 @@
     VM& vm = exec->vm();
     auto throwScope = DECLARE_THROW_SCOPE(vm);
 
-    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, exec->lexicalGlobalObject());
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::tryCreate(exec, exec->lexicalGlobalObject());
     RETURN_IF_EXCEPTION(throwScope, nullptr);
 
     auto catchScope = DECLARE_CATCH_SCOPE(vm);
@@ -301,7 +301,7 @@
     if (globalObject->globalObjectMethodTable()->moduleLoaderFetch)
         RELEASE_AND_RETURN(throwScope, globalObject->globalObjectMethodTable()->moduleLoaderFetch(globalObject, exec, this, key, parameters, scriptFetcher));
 
-    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, globalObject);
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::tryCreate(exec, globalObject);
     RETURN_IF_EXCEPTION(throwScope, nullptr);
 
     auto catchScope = DECLARE_CATCH_SCOPE(vm);
@@ -362,7 +362,7 @@
     VM& vm = exec->vm();
     auto throwScope = DECLARE_THROW_SCOPE(vm);
 
-    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::create(exec, exec->lexicalGlobalObject());
+    JSInternalPromiseDeferred* deferred = JSInternalPromiseDeferred::tryCreate(exec, exec->lexicalGlobalObject());
     RETURN_IF_EXCEPTION(throwScope, encodedJSValue());
 
     auto catchScope = DECLARE_CATCH_SCOPE(vm);

Modified: trunk/Source/_javascript_Core/runtime/JSPromise.h (239255 => 239256)


--- trunk/Source/_javascript_Core/runtime/JSPromise.h	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/runtime/JSPromise.h	2018-12-16 05:49:01 UTC (rev 239256)
@@ -31,16 +31,9 @@
 
 class JSPromise : public JSNonFinalObject {
 public:
-    typedef JSNonFinalObject Base;
+    using Base = JSNonFinalObject;
 
     static JSPromise* create(VM&, Structure*);
-    struct JSPromiseAndCallbacks {
-        JSPromise* promise;
-        JSFunction* resolve;
-        JSFunction* reject;
-    };
-    static JSPromiseAndCallbacks createWithCallbacks(VM&, Structure*);
-
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
 
     DECLARE_EXPORT_INFO;

Modified: trunk/Source/_javascript_Core/runtime/JSPromiseDeferred.cpp (239255 => 239256)


--- trunk/Source/_javascript_Core/runtime/JSPromiseDeferred.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/runtime/JSPromiseDeferred.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -66,7 +66,7 @@
     return result;
 }
 
-JSPromiseDeferred* JSPromiseDeferred::create(ExecState* exec, JSGlobalObject* globalObject)
+JSPromiseDeferred* JSPromiseDeferred::tryCreate(ExecState* exec, JSGlobalObject* globalObject)
 {
     VM& vm = exec->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);

Modified: trunk/Source/_javascript_Core/runtime/JSPromiseDeferred.h (239255 => 239256)


--- trunk/Source/_javascript_Core/runtime/JSPromiseDeferred.h	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/runtime/JSPromiseDeferred.h	2018-12-16 05:49:01 UTC (rev 239256)
@@ -49,7 +49,7 @@
     };
     static DeferredData createDeferredData(ExecState*, JSGlobalObject*, JSPromiseConstructor*);
 
-    JS_EXPORT_PRIVATE static JSPromiseDeferred* create(ExecState*, JSGlobalObject*);
+    JS_EXPORT_PRIVATE static JSPromiseDeferred* tryCreate(ExecState*, JSGlobalObject*);
     JS_EXPORT_PRIVATE static JSPromiseDeferred* create(VM&, JSPromise*, JSFunction* resolve, JSFunction* reject);
 
     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyPrototype.cpp (239255 => 239256)


--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyPrototype.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyPrototype.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -115,7 +115,7 @@
     auto throwScope = DECLARE_THROW_SCOPE(vm);
     auto* globalObject = exec->lexicalGlobalObject();
 
-    JSPromiseDeferred* promise = JSPromiseDeferred::create(exec, globalObject);
+    JSPromiseDeferred* promise = JSPromiseDeferred::tryCreate(exec, globalObject);
     RETURN_IF_EXCEPTION(throwScope, encodedJSValue());
 
     {
@@ -261,7 +261,7 @@
     auto throwScope = DECLARE_THROW_SCOPE(vm);
     auto* globalObject = exec->lexicalGlobalObject();
 
-    JSPromiseDeferred* promise = JSPromiseDeferred::create(exec, globalObject);
+    JSPromiseDeferred* promise = JSPromiseDeferred::tryCreate(exec, globalObject);
     RETURN_IF_EXCEPTION(throwScope, encodedJSValue());
 
     {
@@ -306,7 +306,7 @@
     auto* globalObject = exec->lexicalGlobalObject();
     auto catchScope = DECLARE_CATCH_SCOPE(vm);
 
-    JSPromiseDeferred* promise = JSPromiseDeferred::create(exec, globalObject);
+    JSPromiseDeferred* promise = JSPromiseDeferred::tryCreate(exec, globalObject);
 
     Vector<Strong<JSCell>> dependencies;
     dependencies.append(Strong<JSCell>(vm, globalObject));
@@ -330,8 +330,7 @@
     auto throwScope = DECLARE_THROW_SCOPE(vm);
     auto* globalObject = exec->lexicalGlobalObject();
 
-    JSPromiseDeferred* promise = JSPromiseDeferred::create(exec, globalObject);
-
+    JSPromiseDeferred* promise = JSPromiseDeferred::tryCreate(exec, globalObject);
     RETURN_IF_EXCEPTION(throwScope, encodedJSValue());
     {
         auto catchScope = DECLARE_CATCH_SCOPE(vm);

Modified: trunk/Source/WebCore/ChangeLog (239255 => 239256)


--- trunk/Source/WebCore/ChangeLog	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/WebCore/ChangeLog	2018-12-16 05:49:01 UTC (rev 239256)
@@ -1,3 +1,24 @@
+2018-12-15  Yusuke Suzuki  <[email protected]>
+
+        Null pointer dereference in JSC::WriteBarrierBase()
+        https://bugs.webkit.org/show_bug.cgi?id=191252
+
+        Reviewed by Keith Miller.
+
+        * bindings/js/JSCustomElementRegistryCustom.cpp:
+        (WebCore::JSCustomElementRegistry::whenDefined):
+        * bindings/js/JSDOMPromiseDeferred.cpp:
+        (WebCore::createDeferredPromise):
+        * bindings/js/JSDOMPromiseDeferred.h:
+        (WebCore::DeferredPromise::create):
+        (WebCore::callPromiseFunction):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::moduleLoaderFetch):
+        (WebCore::JSDOMWindowBase::moduleLoaderImportModule):
+        * bindings/js/ScriptModuleLoader.cpp:
+        (WebCore::ScriptModuleLoader::fetch):
+        (WebCore::rejectPromise):
+
 2018-12-15  Darin Adler  <[email protected]>
 
         Use warning-ignoring macros more consistently and simply

Modified: trunk/Source/WebCore/bindings/js/JSCustomElementRegistryCustom.cpp (239255 => 239256)


--- trunk/Source/WebCore/bindings/js/JSCustomElementRegistryCustom.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/WebCore/bindings/js/JSCustomElementRegistryCustom.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -207,8 +207,8 @@
     auto scope = DECLARE_CATCH_SCOPE(state.vm());
 
     ASSERT(globalObject());
-    auto promiseDeferred = JSPromiseDeferred::create(&state, globalObject());
-    ASSERT(promiseDeferred);
+    auto promiseDeferred = JSPromiseDeferred::tryCreate(&state, globalObject());
+    RELEASE_ASSERT(promiseDeferred);
     JSValue promise = whenDefinedPromise(state, *globalObject(), wrapped(), *promiseDeferred);
 
     if (UNLIKELY(scope.exception())) {

Modified: trunk/Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp (239255 => 239256)


--- trunk/Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -191,9 +191,9 @@
 
 Ref<DeferredPromise> createDeferredPromise(JSC::ExecState& state, JSDOMWindow& domWindow)
 {
-    JSC::JSPromiseDeferred* deferred = JSC::JSPromiseDeferred::create(&state, &domWindow);
+    JSC::JSPromiseDeferred* deferred = JSC::JSPromiseDeferred::tryCreate(&state, &domWindow);
     // deferred can only be null in workers.
-    ASSERT(deferred);
+    RELEASE_ASSERT(deferred);
     return DeferredPromise::create(domWindow, *deferred);
 }
 

Modified: trunk/Source/WebCore/bindings/js/JSDOMPromiseDeferred.h (239255 => 239256)


--- trunk/Source/WebCore/bindings/js/JSDOMPromiseDeferred.h	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/WebCore/bindings/js/JSDOMPromiseDeferred.h	2018-12-16 05:49:01 UTC (rev 239256)
@@ -44,7 +44,7 @@
 
     static RefPtr<DeferredPromise> create(JSC::ExecState& state, JSDOMGlobalObject& globalObject, Mode mode = Mode::ClearPromiseOnResolve)
     {
-        auto* promiseDeferred = JSC::JSPromiseDeferred::create(&state, &globalObject);
+        auto* promiseDeferred = JSC::JSPromiseDeferred::tryCreate(&state, &globalObject);
         if (!promiseDeferred)
             return nullptr;
         return adoptRef(new DeferredPromise(globalObject, *promiseDeferred, mode));
@@ -270,7 +270,7 @@
     auto scope = DECLARE_CATCH_SCOPE(vm);
 
     auto& globalObject = callerGlobalObject(state);
-    JSC::JSPromiseDeferred* promiseDeferred = JSC::JSPromiseDeferred::create(&state, &globalObject);
+    JSC::JSPromiseDeferred* promiseDeferred = JSC::JSPromiseDeferred::tryCreate(&state, &globalObject);
 
     // promiseDeferred can be null when terminating a Worker abruptly.
     if (executionScope == PromiseExecutionScope::WindowOrWorker && !promiseDeferred)
@@ -290,7 +290,7 @@
     auto scope = DECLARE_CATCH_SCOPE(vm);
 
     auto& globalObject = callerGlobalObject(state);
-    JSC::JSPromiseDeferred* promiseDeferred = JSC::JSPromiseDeferred::create(&state, &globalObject);
+    JSC::JSPromiseDeferred* promiseDeferred = JSC::JSPromiseDeferred::tryCreate(&state, &globalObject);
 
     // promiseDeferred can be null when terminating a Worker abruptly.
     if (executionScope == PromiseExecutionScope::WindowOrWorker && !promiseDeferred)

Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp (239255 => 239256)


--- trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -312,11 +312,14 @@
 
 JSC::JSInternalPromise* JSDOMWindowBase::moduleLoaderFetch(JSC::JSGlobalObject* globalObject, JSC::ExecState* exec, JSC::JSModuleLoader* moduleLoader, JSC::JSValue moduleKey, JSC::JSValue parameters, JSC::JSValue scriptFetcher)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSDOMWindowBase* thisObject = JSC::jsCast<JSDOMWindowBase*>(globalObject);
     if (RefPtr<Document> document = thisObject->wrapped().document())
-        return document->moduleLoader()->fetch(globalObject, exec, moduleLoader, moduleKey, parameters, scriptFetcher);
-    JSC::JSInternalPromiseDeferred* deferred = JSC::JSInternalPromiseDeferred::create(exec, globalObject);
-    return deferred->reject(exec, jsUndefined());
+        RELEASE_AND_RETURN(scope, document->moduleLoader()->fetch(globalObject, exec, moduleLoader, moduleKey, parameters, scriptFetcher));
+    JSC::JSInternalPromiseDeferred* deferred = JSC::JSInternalPromiseDeferred::tryCreate(exec, globalObject);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    RELEASE_AND_RETURN(scope, deferred->reject(exec, jsUndefined()));
 }
 
 JSC::JSValue JSDOMWindowBase::moduleLoaderEvaluate(JSC::JSGlobalObject* globalObject, JSC::ExecState* exec, JSC::JSModuleLoader* moduleLoader, JSC::JSValue moduleKey, JSC::JSValue moduleRecord, JSC::JSValue scriptFetcher)
@@ -329,11 +332,14 @@
 
 JSC::JSInternalPromise* JSDOMWindowBase::moduleLoaderImportModule(JSC::JSGlobalObject* globalObject, JSC::ExecState* exec, JSC::JSModuleLoader* moduleLoader, JSC::JSString* moduleName, JSC::JSValue parameters, const JSC::SourceOrigin& sourceOrigin)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     JSDOMWindowBase* thisObject = JSC::jsCast<JSDOMWindowBase*>(globalObject);
     if (RefPtr<Document> document = thisObject->wrapped().document())
-        return document->moduleLoader()->importModule(globalObject, exec, moduleLoader, moduleName, parameters, sourceOrigin);
-    JSC::JSInternalPromiseDeferred* deferred = JSC::JSInternalPromiseDeferred::create(exec, globalObject);
-    return deferred->reject(exec, jsUndefined());
+        RELEASE_AND_RETURN(scope, document->moduleLoader()->importModule(globalObject, exec, moduleLoader, moduleName, parameters, sourceOrigin));
+    JSC::JSInternalPromiseDeferred* deferred = JSC::JSInternalPromiseDeferred::tryCreate(exec, globalObject);
+    RETURN_IF_EXCEPTION(scope, nullptr);
+    RELEASE_AND_RETURN(scope, deferred->reject(exec, jsUndefined()));
 }
 
 JSC::JSObject* JSDOMWindowBase::moduleLoaderCreateImportMetaProperties(JSC::JSGlobalObject* globalObject, JSC::ExecState* exec, JSC::JSModuleLoader* moduleLoader, JSC::JSValue moduleKey, JSC::JSModuleRecord* moduleRecord, JSC::JSValue scriptFetcher)

Modified: trunk/Source/WebCore/bindings/js/ScriptModuleLoader.cpp (239255 => 239256)


--- trunk/Source/WebCore/bindings/js/ScriptModuleLoader.cpp	2018-12-16 00:21:25 UTC (rev 239255)
+++ trunk/Source/WebCore/bindings/js/ScriptModuleLoader.cpp	2018-12-16 05:49:01 UTC (rev 239256)
@@ -146,16 +146,17 @@
     ASSERT(JSC::jsDynamicCast<JSC::JSScriptFetcher*>(vm, scriptFetcher));
 
     auto& globalObject = *JSC::jsCast<JSDOMGlobalObject*>(jsGlobalObject);
-    auto& jsPromise = *JSC::JSInternalPromiseDeferred::create(exec, &globalObject);
-    auto deferred = DeferredPromise::create(globalObject, jsPromise);
+    auto* jsPromise = JSC::JSInternalPromiseDeferred::tryCreate(exec, &globalObject);
+    RELEASE_ASSERT(jsPromise);
+    auto deferred = DeferredPromise::create(globalObject, *jsPromise);
     if (moduleKeyValue.isSymbol()) {
         deferred->reject(TypeError, "Symbol module key should be already fulfilled with the inlined resource."_s);
-        return jsPromise.promise();
+        return jsPromise->promise();
     }
 
     if (!moduleKeyValue.isString()) {
         deferred->reject(TypeError, "Module key is not Symbol or String."_s);
-        return jsPromise.promise();
+        return jsPromise->promise();
     }
 
     // https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-single-module-script
@@ -163,7 +164,7 @@
     URL completedURL(URL(), asString(moduleKeyValue)->value(exec));
     if (!completedURL.isValid()) {
         deferred->reject(TypeError, "Module key is a valid URL."_s);
-        return jsPromise.promise();
+        return jsPromise->promise();
     }
 
     RefPtr<ModuleFetchParameters> topLevelFetchParameters;
@@ -176,10 +177,10 @@
         loader->clearClient();
         m_loaders.remove(WTFMove(loader));
         rejectToPropagateNetworkError(deferred.get(), ModuleFetchFailureKind::WasErrored, "Importing a module script failed."_s);
-        return jsPromise.promise();
+        return jsPromise->promise();
     }
 
-    return jsPromise.promise();
+    return jsPromise->promise();
 }
 
 URL ScriptModuleLoader::moduleURL(JSC::ExecState& state, JSC::JSValue moduleKeyValue)
@@ -214,10 +215,11 @@
 
 static JSC::JSInternalPromise* rejectPromise(JSC::ExecState& state, JSDOMGlobalObject& globalObject, ExceptionCode ec, ASCIILiteral message)
 {
-    auto& jsPromise = *JSC::JSInternalPromiseDeferred::create(&state, &globalObject);
-    auto deferred = DeferredPromise::create(globalObject, jsPromise);
+    auto* jsPromise = JSC::JSInternalPromiseDeferred::tryCreate(&state, &globalObject);
+    RELEASE_ASSERT(jsPromise);
+    auto deferred = DeferredPromise::create(globalObject, *jsPromise);
     deferred->reject(ec, WTFMove(message));
-    return jsPromise.promise();
+    return jsPromise->promise();
 }
 
 JSC::JSInternalPromise* ScriptModuleLoader::importModule(JSC::JSGlobalObject* jsGlobalObject, JSC::ExecState* exec, JSC::JSModuleLoader*, JSC::JSString* moduleName, JSC::JSValue parameters, const JSC::SourceOrigin& sourceOrigin)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to