Title: [271570] trunk
- Revision
- 271570
- Author
- [email protected]
- Date
- 2021-01-17 22:36:18 -0800 (Sun, 17 Jan 2021)
Log Message
[JSC] GenericArguments<Type>::defineOwnProperty's assumption about error is not correct
https://bugs.webkit.org/show_bug.cgi?id=220693
<rdar://problem/72929171>
Reviewed by Mark Lam.
JSTests:
* stress/freeze-invokes-out-of-memory.js: Added.
(shouldThrow):
Source/_javascript_Core:
Any function taking JSGlobalObject* can cause out-of-memory error potentially. And we have a way to invoke it.
But GenericArguments<Type>::defineOwnProperty didn't assume OutOfMemory error. This patch fixes it.
* runtime/GenericArgumentsInlines.h:
(JSC::GenericArguments<Type>::defineOwnProperty):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (271569 => 271570)
--- trunk/JSTests/ChangeLog 2021-01-18 06:25:17 UTC (rev 271569)
+++ trunk/JSTests/ChangeLog 2021-01-18 06:36:18 UTC (rev 271570)
@@ -1,5 +1,16 @@
2021-01-17 Yusuke Suzuki <[email protected]>
+ [JSC] GenericArguments<Type>::defineOwnProperty's assumption about error is not correct
+ https://bugs.webkit.org/show_bug.cgi?id=220693
+ <rdar://problem/72929171>
+
+ Reviewed by Mark Lam.
+
+ * stress/freeze-invokes-out-of-memory.js: Added.
+ (shouldThrow):
+
+2021-01-17 Yusuke Suzuki <[email protected]>
+
[JSC] Add some more exception checks in globalFuncCopyDataProperties
https://bugs.webkit.org/show_bug.cgi?id=220691
Added: trunk/JSTests/stress/freeze-invokes-out-of-memory.js (0 => 271570)
--- trunk/JSTests/stress/freeze-invokes-out-of-memory.js (rev 0)
+++ trunk/JSTests/stress/freeze-invokes-out-of-memory.js 2021-01-18 06:36:18 UTC (rev 271570)
@@ -0,0 +1,24 @@
+function shouldThrow(func, errorMessage) {
+ var errorThrown = false;
+ var error = null;
+ try {
+ func();
+ } catch (e) {
+ errorThrown = true;
+ error = e;
+ }
+ if (!errorThrown)
+ throw new Error('not thrown');
+ if (String(error) !== errorMessage)
+ throw new Error(`bad error: ${String(error)}`);
+}
+
+function foo() {
+ Object.freeze(arguments);
+}
+
+let s = [0.1].toLocaleString().padEnd(2**31-1, 'ab');
+
+shouldThrow(() => {
+ foo(s);
+}, `RangeError: Out of memory`);
Modified: trunk/Source/_javascript_Core/ChangeLog (271569 => 271570)
--- trunk/Source/_javascript_Core/ChangeLog 2021-01-18 06:25:17 UTC (rev 271569)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-01-18 06:36:18 UTC (rev 271570)
@@ -1,5 +1,19 @@
2021-01-17 Yusuke Suzuki <[email protected]>
+ [JSC] GenericArguments<Type>::defineOwnProperty's assumption about error is not correct
+ https://bugs.webkit.org/show_bug.cgi?id=220693
+ <rdar://problem/72929171>
+
+ Reviewed by Mark Lam.
+
+ Any function taking JSGlobalObject* can cause out-of-memory error potentially. And we have a way to invoke it.
+ But GenericArguments<Type>::defineOwnProperty didn't assume OutOfMemory error. This patch fixes it.
+
+ * runtime/GenericArgumentsInlines.h:
+ (JSC::GenericArguments<Type>::defineOwnProperty):
+
+2021-01-17 Yusuke Suzuki <[email protected]>
+
[JSC] Add some more exception checks in globalFuncCopyDataProperties
https://bugs.webkit.org/show_bug.cgi?id=220691
Modified: trunk/Source/_javascript_Core/runtime/GenericArgumentsInlines.h (271569 => 271570)
--- trunk/Source/_javascript_Core/runtime/GenericArgumentsInlines.h 2021-01-18 06:25:17 UTC (rev 271569)
+++ trunk/Source/_javascript_Core/runtime/GenericArgumentsInlines.h 2021-01-18 06:36:18 UTC (rev 271570)
@@ -238,12 +238,12 @@
}
bool status = thisObject->defineOwnIndexedProperty(globalObject, index, newDescriptor, shouldThrow);
+ RETURN_IF_EXCEPTION(scope, false);
if (!status) {
ASSERT(!isMapped || thisObject->isModifiedArgumentDescriptor(index));
- RELEASE_AND_RETURN(scope, false);
+ return false;
}
- scope.assertNoException();
thisObject->setModifiedArgumentDescriptor(globalObject, index);
RETURN_IF_EXCEPTION(scope, false);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
