Title: [263883] trunk/Source/WebCore
Revision
263883
Author
[email protected]
Date
2020-07-02 22:51:58 -0700 (Thu, 02 Jul 2020)

Log Message

ReadableStream::create() should handle any exceptions that may be thrown during construction.
https://bugs.webkit.org/show_bug.cgi?id=213819

Reviewed by Youenn Fablet and Yusuke Suzuki.

Win EWS detected that ReadableStream::create() can throw exceptions, and we were
failing to handle it.  This patch fixes that.

* Modules/cache/DOMCache.cpp:
(WebCore::DOMCache::put):
* Modules/fetch/FetchBodyOwner.cpp:
(WebCore::FetchBodyOwner::readableStream):
(WebCore::FetchBodyOwner::createReadableStream):
* Modules/fetch/FetchBodyOwner.h:
* Modules/fetch/FetchResponse.cpp:
(WebCore::FetchResponse::clone):
* bindings/js/ReadableStream.cpp:
(WebCore::ReadableStream::create):
* bindings/js/ReadableStream.h:

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (263882 => 263883)


--- trunk/Source/WebCore/ChangeLog	2020-07-03 04:17:54 UTC (rev 263882)
+++ trunk/Source/WebCore/ChangeLog	2020-07-03 05:51:58 UTC (rev 263883)
@@ -1,3 +1,25 @@
+2020-07-02  Mark Lam  <[email protected]>
+
+        ReadableStream::create() should handle any exceptions that may be thrown during construction.
+        https://bugs.webkit.org/show_bug.cgi?id=213819
+
+        Reviewed by Youenn Fablet and Yusuke Suzuki.
+
+        Win EWS detected that ReadableStream::create() can throw exceptions, and we were
+        failing to handle it.  This patch fixes that.
+
+        * Modules/cache/DOMCache.cpp:
+        (WebCore::DOMCache::put):
+        * Modules/fetch/FetchBodyOwner.cpp:
+        (WebCore::FetchBodyOwner::readableStream):
+        (WebCore::FetchBodyOwner::createReadableStream):
+        * Modules/fetch/FetchBodyOwner.h:
+        * Modules/fetch/FetchResponse.cpp:
+        (WebCore::FetchResponse::clone):
+        * bindings/js/ReadableStream.cpp:
+        (WebCore::ReadableStream::create):
+        * bindings/js/ReadableStream.h:
+
 2020-07-02  Alex Christensen  <[email protected]>
 
         Update Mac CMake build

Modified: trunk/Source/WebCore/Modules/cache/DOMCache.cpp (263882 => 263883)


--- trunk/Source/WebCore/Modules/cache/DOMCache.cpp	2020-07-03 04:17:54 UTC (rev 263882)
+++ trunk/Source/WebCore/Modules/cache/DOMCache.cpp	2020-07-03 05:51:58 UTC (rev 263883)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2017-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -365,8 +365,13 @@
     }
 
     // FIXME: for efficiency, we should load blobs directly instead of going through the readableStream path.
-    if (response->isBlobBody())
-        response->readableStream(*scriptExecutionContext()->execState());
+    if (response->isBlobBody()) {
+        auto streamOrException = response->readableStream(*scriptExecutionContext()->execState());
+        if (UNLIKELY(streamOrException.hasException())) {
+            promise.reject(streamOrException.releaseException());
+            return;
+        }
+    }
 
     if (response->isBodyReceivedByChunk()) {
         auto& responseRef = response.get();

Modified: trunk/Source/WebCore/Modules/fetch/FetchBodyOwner.cpp (263882 => 263883)


--- trunk/Source/WebCore/Modules/fetch/FetchBodyOwner.cpp	2020-07-03 04:17:54 UTC (rev 263882)
+++ trunk/Source/WebCore/Modules/fetch/FetchBodyOwner.cpp	2020-07-03 05:51:58 UTC (rev 263883)
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2016 Canon Inc.
+ * Copyright (C) 2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted, provided that the following conditions
@@ -311,27 +312,40 @@
         owner.blobLoadingFailed();
 }
 
-RefPtr<ReadableStream> FetchBodyOwner::readableStream(JSC::JSGlobalObject& state)
+ExceptionOr<RefPtr<ReadableStream>> FetchBodyOwner::readableStream(JSC::JSGlobalObject& state)
 {
     if (isBodyNullOrOpaque())
         return nullptr;
 
-    if (!m_body->hasReadableStream())
-        createReadableStream(state);
+    if (!m_body->hasReadableStream()) {
+        auto voidOrException = createReadableStream(state);
+        if (UNLIKELY(voidOrException.hasException()))
+            return voidOrException.releaseException();
+    }
 
     return m_body->readableStream();
 }
 
-void FetchBodyOwner::createReadableStream(JSC::JSGlobalObject& state)
+ExceptionOr<void> FetchBodyOwner::createReadableStream(JSC::JSGlobalObject& state)
 {
     ASSERT(!m_readableStreamSource);
     if (isDisturbed()) {
-        m_body->setReadableStream(ReadableStream::create(state, nullptr));
+        auto streamOrException = ReadableStream::create(state, nullptr);
+        if (UNLIKELY(streamOrException.hasException()))
+            return streamOrException.releaseException();
+        m_body->setReadableStream(streamOrException.releaseReturnValue());
         m_body->readableStream()->lock();
-    } else {
-        m_readableStreamSource = adoptRef(*new FetchBodySource(*this));
-        m_body->setReadableStream(ReadableStream::create(state, m_readableStreamSource));
+        return { };
     }
+
+    m_readableStreamSource = adoptRef(*new FetchBodySource(*this));
+    auto streamOrException = ReadableStream::create(state, m_readableStreamSource);
+    if (UNLIKELY(streamOrException.hasException())) {
+        m_readableStreamSource = nullptr;
+        return streamOrException.releaseException();
+    }
+    m_body->setReadableStream(streamOrException.releaseReturnValue());
+    return { };
 }
 
 void FetchBodyOwner::consumeBodyAsStream()

Modified: trunk/Source/WebCore/Modules/fetch/FetchBodyOwner.h (263882 => 263883)


--- trunk/Source/WebCore/Modules/fetch/FetchBodyOwner.h	2020-07-03 04:17:54 UTC (rev 263882)
+++ trunk/Source/WebCore/Modules/fetch/FetchBodyOwner.h	2020-07-03 05:51:58 UTC (rev 263883)
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2016 Canon Inc.
+ * Copyright (C) 2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted, provided that the following conditions
@@ -29,6 +30,7 @@
 #pragma once
 
 #include "ActiveDOMObject.h"
+#include "ExceptionOr.h"
 #include "FetchBody.h"
 #include "FetchBodySource.h"
 #include "FetchHeaders.h"
@@ -57,7 +59,7 @@
 
     bool isActive() const { return !!m_blobLoader; }
 
-    RefPtr<ReadableStream> readableStream(JSC::JSGlobalObject&);
+    ExceptionOr<RefPtr<ReadableStream>> readableStream(JSC::JSGlobalObject&);
     bool hasReadableStreamBody() const { return m_body && m_body->hasReadableStream(); }
 
     virtual void consumeBodyAsStream();
@@ -80,7 +82,7 @@
     void consumeOnceLoadingFinished(FetchBodyConsumer::Type, Ref<DeferredPromise>&&);
 
     void setBody(FetchBody&& body) { m_body = WTFMove(body); }
-    void createReadableStream(JSC::JSGlobalObject&);
+    ExceptionOr<void> createReadableStream(JSC::JSGlobalObject&);
 
     // ActiveDOMObject API
     void stop() override;

Modified: trunk/Source/WebCore/Modules/fetch/FetchResponse.cpp (263882 => 263883)


--- trunk/Source/WebCore/Modules/fetch/FetchResponse.cpp	2020-07-03 04:17:54 UTC (rev 263882)
+++ trunk/Source/WebCore/Modules/fetch/FetchResponse.cpp	2020-07-03 05:51:58 UTC (rev 263883)
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2016 Canon Inc.
+ * Copyright (C) 2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted, provided that the following conditions
@@ -176,8 +177,11 @@
     ASSERT(scriptExecutionContext());
 
     // If loading, let's create a stream so that data is teed on both clones.
-    if (isLoading() && !m_readableStreamSource)
-        createReadableStream(*context.execState());
+    if (isLoading() && !m_readableStreamSource) {
+        auto voidOrException = createReadableStream(*context.execState());
+        if (UNLIKELY(voidOrException.hasException()))
+            return voidOrException.releaseException();
+    }
 
     // Synthetic responses do not store headers in m_internalResponse.
     if (m_internalResponse.type() == ResourceResponse::Type::Default)

Modified: trunk/Source/WebCore/bindings/js/ReadableStream.cpp (263882 => 263883)


--- trunk/Source/WebCore/bindings/js/ReadableStream.cpp	2020-07-03 04:17:54 UTC (rev 263882)
+++ trunk/Source/WebCore/bindings/js/ReadableStream.cpp	2020-07-03 05:51:58 UTC (rev 263883)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2017-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ReadableStream.h"
 
+#include "Exception.h"
+#include "ExceptionCode.h"
 #include "JSDOMConvertSequences.h"
 #include "JSReadableStreamSink.h"
 #include "JSReadableStreamSource.h"
@@ -35,10 +37,10 @@
 namespace WebCore {
 using namespace JSC;
 
-Ref<ReadableStream> ReadableStream::create(JSC::JSGlobalObject& lexicalGlobalObject, RefPtr<ReadableStreamSource>&& source)
+ExceptionOr<Ref<ReadableStream>> ReadableStream::create(JSC::JSGlobalObject& lexicalGlobalObject, RefPtr<ReadableStreamSource>&& source)
 {
     VM& vm = lexicalGlobalObject.vm();
-    auto scope = DECLARE_CATCH_SCOPE(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
 
     auto& clientData = *static_cast<JSVMClientData*>(vm.clientData);
     auto& globalObject = *JSC::jsCast<JSDOMGlobalObject*>(&lexicalGlobalObject);
@@ -52,10 +54,11 @@
     args.append(source ? toJSNewlyCreated(&lexicalGlobalObject, &globalObject, source.releaseNonNull()) : JSC::jsUndefined());
     ASSERT(!args.hasOverflowed());
 
-    auto newReadableStream = jsDynamicCast<JSReadableStream*>(vm, JSC::construct(&lexicalGlobalObject, constructor, constructData, args));
-    scope.assertNoException();
+    JSObject* object = JSC::construct(&lexicalGlobalObject, constructor, constructData, args);
+    ASSERT(!!scope.exception() == !object);
+    RETURN_IF_EXCEPTION(scope, Exception { ExistingExceptionError });
 
-    return create(globalObject, *newReadableStream);
+    return create(globalObject, *jsCast<JSReadableStream*>(object));
 }
 
 namespace ReadableStreamInternal {

Modified: trunk/Source/WebCore/bindings/js/ReadableStream.h (263882 => 263883)


--- trunk/Source/WebCore/bindings/js/ReadableStream.h	2020-07-03 04:17:54 UTC (rev 263882)
+++ trunk/Source/WebCore/bindings/js/ReadableStream.h	2020-07-03 05:51:58 UTC (rev 263883)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2017-2020 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -25,6 +25,7 @@
 
 #pragma once
 
+#include "ExceptionOr.h"
 #include "JSDOMBinding.h"
 #include "JSDOMConvert.h"
 #include "JSDOMGuardedObject.h"
@@ -39,7 +40,7 @@
 public:
     static Ref<ReadableStream> create(JSDOMGlobalObject& globalObject, JSReadableStream& readableStream) { return adoptRef(*new ReadableStream(globalObject, readableStream)); }
 
-    static Ref<ReadableStream> create(JSC::JSGlobalObject&, RefPtr<ReadableStreamSource>&&);
+    static ExceptionOr<Ref<ReadableStream>> create(JSC::JSGlobalObject&, RefPtr<ReadableStreamSource>&&);
 
     WEBCORE_EXPORT static bool isDisturbed(JSC::JSGlobalObject&, JSC::JSValue);
 
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to