Title: [276719] trunk
Revision
276719
Author
[email protected]
Date
2021-04-28 10:13:40 -0700 (Wed, 28 Apr 2021)

Log Message

Fix exception assertions in light of the TerminationException.
https://bugs.webkit.org/show_bug.cgi?id=225128
rdar://76694909

Reviewed by Robin Morisset.

JSTests:

* stress/suppress-TerminationException-in-JSFunction-prototypeForConstruction.js: Added.

Source/_javascript_Core:

Some pre-existing functions assertNoException() or releaseAssertNoException().
These assertion may not be valid anymore in light of the TerminationException, and
require some fix up:

1. If it makes sense to convert the assertion into an exception check, then do so.

   For example, see objectPrototypeToString(), slow_path_create_this().

2. If the assertion is at the end of a function just before it returns, or if the
   remaining code in the function will not be affected by the pending exception,
   then we can replace the assertion as follows:

       assertNoException() => assertNoExceptionExceptTermination()
       releaseAssertNoException() => releaseAssertNoExceptionExceptTermination()

   For example, see objectPrototypeHasOwnProperty(), JSObject::getOwnNonIndexPropertyNames().

3. If the assertion is in a function where perf is not absolutely critical, and the
   function isn't calling any other functions that will re-enter the VM or potentially
   get stuck in an infinite loop, then we can use a DeferTermination scope to defer
   termination.

   For example, see Debugger::pauseIfNeeded(), SamplingProfiler::StackFrame::nameFromCallee().

4. If the assertion is in an initializer function is only run once and adding
   exception checks would complicate the code more than it's worth (an engineering
   judgement), then use a DeferTermination scope.

   For example, see ProgramExecutable::initializeGlobalProperties(), setupAdaptiveWatchpoint().

   Some leaf (or near-leaf) functions that currently DECLARE_CATCH_SCOPE() may also
   fall under this category.

   For example, see JSFunction::prototypeForConstruction().

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::addBigIntConstant):
* debugger/Debugger.cpp:
(JSC::Debugger::pauseIfNeeded):
* dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* interpreter/Interpreter.cpp:
(JSC::notifyDebuggerOfUnwinding):
(JSC::Interpreter::executeProgram):
(JSC::Interpreter::debug):
* interpreter/ShadowChicken.cpp:
(JSC::ShadowChicken::functionsOnStack):
* jsc.cpp:
(runWithOptions):
* parser/ParserArena.cpp:
(JSC::IdentifierArena::makeBigIntDecimalIdentifier):
* runtime/AbstractModuleRecord.cpp:
(JSC::AbstractModuleRecord::finishCreation):
* runtime/CommonSlowPaths.cpp:
(JSC::JSC_DEFINE_COMMON_SLOW_PATH):
* runtime/ErrorInstance.cpp:
(JSC::ErrorInstance::sanitizedMessageString):
(JSC::ErrorInstance::sanitizedNameString):
* runtime/ExceptionScope.h:
(JSC::ExceptionScope::assertNoExceptionExceptTermination):
(JSC::ExceptionScope::releaseAssertNoExceptionExceptTermination):
* runtime/JSFunction.cpp:
(JSC::JSFunction::prototypeForConstruction):
* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoFuncIncludes):
(JSC::genericTypedArrayViewProtoFuncIndexOf):
(JSC::genericTypedArrayViewProtoFuncLastIndexOf):
(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
* runtime/JSGlobalObject.cpp:
(JSC::setupAdaptiveWatchpoint):
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::defineOwnProperty):
(JSC::JSGlobalObject::tryInstallSpeciesWatchpoint):
* runtime/JSModuleLoader.cpp:
(JSC::printableModuleKey):
* runtime/JSModuleNamespaceObject.cpp:
(JSC::JSModuleNamespaceObject::finishCreation):
* runtime/JSObject.cpp:
(JSC::JSObject::ordinaryToPrimitive const):
(JSC::JSObject::getOwnNonIndexPropertyNames):
* runtime/JSTemplateObjectDescriptor.cpp:
(JSC::JSTemplateObjectDescriptor::createTemplateObject):
* runtime/JSTypedArrayViewPrototype.cpp:
* runtime/ObjectPrototype.cpp:
(JSC::objectPrototypeHasOwnProperty):
(JSC::objectPrototypeToString):
* runtime/ProgramExecutable.cpp:
(JSC::ProgramExecutable::initializeGlobalProperties):
* runtime/SamplingProfiler.cpp:
(JSC::SamplingProfiler::StackFrame::nameFromCallee):
* tools/JSDollarVM.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):

Source/WebCore:

A few changes plus rebasing bindings test results.

* Modules/plugins/QuickTimePluginReplacement.mm:
(WebCore::QuickTimePluginReplacement::installReplacement):
* bindings/js/JSDOMExceptionHandling.cpp:
(WebCore::propagateExceptionSlowPath):
(WebCore::throwNotSupportedError):
(WebCore::throwInvalidStateError):
(WebCore::throwSecurityError):
(WebCore::throwDOMSyntaxError):
(WebCore::throwDataCloneError):
* bindings/js/JSDOMGlobalObject.cpp:
(WebCore::JSC_DEFINE_HOST_FUNCTION):
* bindings/js/JSDOMGlobalObjectTask.cpp:
* bindings/js/JSDOMMapLike.cpp:
(WebCore::getBackingMap):
* bindings/js/JSDOMSetLike.cpp:
(WebCore::getBackingSet):
* bindings/js/JSMicrotaskCallback.h:
(WebCore::JSMicrotaskCallback::call):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneDeserializer::readTerminal):
* bindings/js/WritableStream.cpp:
(WebCore::WritableStreamInternal::callFunction):
(WebCore::WritableStream::lock):
* bindings/scripts/CodeGeneratorJS.pm:
(GeneratePut):
(GeneratePutByIndex):
(GenerateDefineOwnProperty):

* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp:
(WebCore::JSTestNamedAndIndexedSetterNoIdentifier::put):
(WebCore::JSTestNamedAndIndexedSetterNoIdentifier::putByIndex):
(WebCore::JSTestNamedAndIndexedSetterNoIdentifier::defineOwnProperty):
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp:
(WebCore::JSTestNamedAndIndexedSetterThrowingException::put):
(WebCore::JSTestNamedAndIndexedSetterThrowingException::putByIndex):
(WebCore::JSTestNamedAndIndexedSetterThrowingException::defineOwnProperty):
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp:
(WebCore::JSTestNamedAndIndexedSetterWithIdentifier::put):
(WebCore::JSTestNamedAndIndexedSetterWithIdentifier::putByIndex):
(WebCore::JSTestNamedAndIndexedSetterWithIdentifier::defineOwnProperty):
* bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp:
(WebCore::JSTestNamedSetterNoIdentifier::put):
(WebCore::JSTestNamedSetterNoIdentifier::putByIndex):
(WebCore::JSTestNamedSetterNoIdentifier::defineOwnProperty):
* bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp:
(WebCore::JSTestNamedSetterThrowingException::put):
(WebCore::JSTestNamedSetterThrowingException::putByIndex):
(WebCore::JSTestNamedSetterThrowingException::defineOwnProperty):
* bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp:
(WebCore::JSTestNamedSetterWithIdentifier::put):
(WebCore::JSTestNamedSetterWithIdentifier::putByIndex):
(WebCore::JSTestNamedSetterWithIdentifier::defineOwnProperty):
* bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp:
(WebCore::JSTestNamedSetterWithIndexedGetter::put):
(WebCore::JSTestNamedSetterWithIndexedGetter::putByIndex):
(WebCore::JSTestNamedSetterWithIndexedGetter::defineOwnProperty):
* bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp:
(WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::put):
(WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::putByIndex):
(WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::defineOwnProperty):
* bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp:
(WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::put):
(WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::putByIndex):
(WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::defineOwnProperty):

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
(WebCore::HTMLMediaElement::updateMediaControlsAfterPresentationModeChange):
(WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):

Modified Paths

Added Paths

Diff

Modified: trunk/JSTests/ChangeLog (276718 => 276719)


--- trunk/JSTests/ChangeLog	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/JSTests/ChangeLog	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,3 +1,13 @@
+2021-04-28  Mark Lam  <[email protected]>
+
+        Fix exception assertions in light of the TerminationException.
+        https://bugs.webkit.org/show_bug.cgi?id=225128
+        rdar://76694909
+
+        Reviewed by Robin Morisset.
+
+        * stress/suppress-TerminationException-in-JSFunction-prototypeForConstruction.js: Added.
+
 2021-04-27  Angelos Oikonomopoulos  <[email protected]>
 
         [JSC] Skip tests failing on Loongson 3A4000

Added: trunk/JSTests/stress/suppress-TerminationException-in-JSFunction-prototypeForConstruction.js (0 => 276719)


--- trunk/JSTests/stress/suppress-TerminationException-in-JSFunction-prototypeForConstruction.js	                        (rev 0)
+++ trunk/JSTests/stress/suppress-TerminationException-in-JSFunction-prototypeForConstruction.js	2021-04-28 17:13:40 UTC (rev 276719)
@@ -0,0 +1,15 @@
+//@ runDefault("--watchdog=300", "--watchdog-exception-ok")
+
+class U {}
+
+function foo() {
+  class C extends U {
+    constructor() {
+      gc();
+      super();
+    }
+  }
+  new C();
+}
+
+while(1) foo();

Modified: trunk/Source/_javascript_Core/ChangeLog (276718 => 276719)


--- trunk/Source/_javascript_Core/ChangeLog	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/ChangeLog	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,3 +1,104 @@
+2021-04-28  Mark Lam  <[email protected]>
+
+        Fix exception assertions in light of the TerminationException.
+        https://bugs.webkit.org/show_bug.cgi?id=225128
+        rdar://76694909
+
+        Reviewed by Robin Morisset.
+
+        Some pre-existing functions assertNoException() or releaseAssertNoException().
+        These assertion may not be valid anymore in light of the TerminationException, and
+        require some fix up:
+
+        1. If it makes sense to convert the assertion into an exception check, then do so.
+
+           For example, see objectPrototypeToString(), slow_path_create_this().
+
+        2. If the assertion is at the end of a function just before it returns, or if the
+           remaining code in the function will not be affected by the pending exception,
+           then we can replace the assertion as follows:
+
+               assertNoException() => assertNoExceptionExceptTermination()
+               releaseAssertNoException() => releaseAssertNoExceptionExceptTermination()
+
+           For example, see objectPrototypeHasOwnProperty(), JSObject::getOwnNonIndexPropertyNames().
+
+        3. If the assertion is in a function where perf is not absolutely critical, and the
+           function isn't calling any other functions that will re-enter the VM or potentially
+           get stuck in an infinite loop, then we can use a DeferTermination scope to defer
+           termination.
+
+           For example, see Debugger::pauseIfNeeded(), SamplingProfiler::StackFrame::nameFromCallee().
+
+        4. If the assertion is in an initializer function is only run once and adding
+           exception checks would complicate the code more than it's worth (an engineering
+           judgement), then use a DeferTermination scope.
+
+           For example, see ProgramExecutable::initializeGlobalProperties(), setupAdaptiveWatchpoint().
+
+           Some leaf (or near-leaf) functions that currently DECLARE_CATCH_SCOPE() may also
+           fall under this category.
+
+           For example, see JSFunction::prototypeForConstruction().
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addBigIntConstant):
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::pauseIfNeeded):
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::JSC_DEFINE_JIT_OPERATION):
+        * interpreter/Interpreter.cpp:
+        (JSC::notifyDebuggerOfUnwinding):
+        (JSC::Interpreter::executeProgram):
+        (JSC::Interpreter::debug):
+        * interpreter/ShadowChicken.cpp:
+        (JSC::ShadowChicken::functionsOnStack):
+        * jsc.cpp:
+        (runWithOptions):
+        * parser/ParserArena.cpp:
+        (JSC::IdentifierArena::makeBigIntDecimalIdentifier):
+        * runtime/AbstractModuleRecord.cpp:
+        (JSC::AbstractModuleRecord::finishCreation):
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::JSC_DEFINE_COMMON_SLOW_PATH):
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::sanitizedMessageString):
+        (JSC::ErrorInstance::sanitizedNameString):
+        * runtime/ExceptionScope.h:
+        (JSC::ExceptionScope::assertNoExceptionExceptTermination):
+        (JSC::ExceptionScope::releaseAssertNoExceptionExceptTermination):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::prototypeForConstruction):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::genericTypedArrayViewProtoFuncIncludes):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::setupAdaptiveWatchpoint):
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::defineOwnProperty):
+        (JSC::JSGlobalObject::tryInstallSpeciesWatchpoint):
+        * runtime/JSModuleLoader.cpp:
+        (JSC::printableModuleKey):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::finishCreation):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::ordinaryToPrimitive const):
+        (JSC::JSObject::getOwnNonIndexPropertyNames):
+        * runtime/JSTemplateObjectDescriptor.cpp:
+        (JSC::JSTemplateObjectDescriptor::createTemplateObject):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectPrototypeHasOwnProperty):
+        (JSC::objectPrototypeToString):
+        * runtime/ProgramExecutable.cpp:
+        (JSC::ProgramExecutable::initializeGlobalProperties):
+        * runtime/SamplingProfiler.cpp:
+        (JSC::SamplingProfiler::StackFrame::nameFromCallee):
+        * tools/JSDollarVM.cpp:
+        (JSC::JSC_DEFINE_HOST_FUNCTION):
+
 2021-04-28  Daniel Kolesa  <[email protected]>
 
         [WPE][GTK] More correct fixes for stack size issues on musl libc

Modified: trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -55,6 +55,7 @@
 #include "UnlinkedMetadataTableInlines.h"
 #include "UnlinkedModuleProgramCodeBlock.h"
 #include "UnlinkedProgramCodeBlock.h"
+#include "VMTrapsInlines.h"
 #include <wtf/BitVector.h>
 #include <wtf/HashSet.h>
 #include <wtf/Optional.h>
@@ -3070,9 +3071,11 @@
 JSValue BytecodeGenerator::addBigIntConstant(const Identifier& identifier, uint8_t radix, bool sign)
 {
     return m_bigIntMap.ensure(BigIntMapEntry(identifier.impl(), radix, sign), [&] {
-        auto scope = DECLARE_CATCH_SCOPE(vm());
+        VM& vm = this->vm();
+        DeferTermination deferScope(vm);
+        auto scope = DECLARE_CATCH_SCOPE(vm);
         auto parseIntSign = sign ? JSBigInt::ParseIntSign::Signed : JSBigInt::ParseIntSign::Unsigned;
-        JSValue bigIntInMap = JSBigInt::parseInt(nullptr, vm(), identifier.string(), radix, JSBigInt::ErrorParseMode::ThrowExceptions, parseIntSign);
+        JSValue bigIntInMap = JSBigInt::parseInt(nullptr, vm, identifier.string(), radix, JSBigInt::ErrorParseMode::ThrowExceptions, parseIntSign);
         scope.assertNoException();
         addConstantValue(bigIntInMap);
 

Modified: trunk/Source/_javascript_Core/debugger/Debugger.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/debugger/Debugger.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/debugger/Debugger.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2008-2019 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008-2021 Apple Inc. All rights reserved.
  *  Copyright (C) 1999-2001 Harri Porten ([email protected])
  *  Copyright (C) 2001 Peter Kelly ([email protected])
  *
@@ -29,6 +29,7 @@
 #include "JSCInlines.h"
 #include "MarkedSpaceInlines.h"
 #include "VMEntryScope.h"
+#include "VMTrapsInlines.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
@@ -865,6 +866,7 @@
 void Debugger::pauseIfNeeded(JSGlobalObject* globalObject)
 {
     VM& vm = m_vm;
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     if (m_isPaused)

Modified: trunk/Source/_javascript_Core/dfg/DFGOperations.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/dfg/DFGOperations.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/dfg/DFGOperations.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -311,6 +311,7 @@
     JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
     auto scope = DECLARE_THROW_SCOPE(vm);
     if (constructor->type() == JSFunctionType && jsCast<JSFunction*>(constructor)->canUseAllocationProfile()) {
+        DeferTermination deferScope(vm);
         auto rareData = jsCast<JSFunction*>(constructor)->ensureRareDataAndAllocationProfile(globalObject, inlineCapacity);
         scope.releaseAssertNoException();
         ObjectAllocationProfileWithPrototype* allocationProfile = rareData->objectAllocationProfile();
@@ -2656,6 +2657,7 @@
 JSC_DEFINE_JIT_OPERATION(operationStrCat2, JSString*, (JSGlobalObject* globalObject, EncodedJSValue a, EncodedJSValue b))
 {
     VM& vm = globalObject->vm();
+    DeferTermination deferScope(vm);
     CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
     JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
     auto scope = DECLARE_THROW_SCOPE(vm);
@@ -2673,6 +2675,7 @@
 JSC_DEFINE_JIT_OPERATION(operationStrCat3, JSString*, (JSGlobalObject* globalObject, EncodedJSValue a, EncodedJSValue b, EncodedJSValue c))
 {
     VM& vm = globalObject->vm();
+    DeferTermination deferScope(vm);
     CallFrame* callFrame = DECLARE_CALL_FRAME(vm);
     JITOperationPrologueCallFrameTracer tracer(vm, callFrame);
     auto scope = DECLARE_THROW_SCOPE(vm);
@@ -2851,7 +2854,7 @@
         if (string == searchElement)
             return toUCPUStrictInt32(index);
         if (string->equal(globalObject, searchElement)) {
-            scope.assertNoException();
+            scope.assertNoExceptionExceptTermination();
             return toUCPUStrictInt32(index);
         }
         RETURN_IF_EXCEPTION(scope, { });

Modified: trunk/Source/_javascript_Core/interpreter/Interpreter.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/interpreter/Interpreter.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/interpreter/Interpreter.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -65,6 +65,7 @@
 #include "StrictEvalActivation.h"
 #include "VMEntryScope.h"
 #include "VMInlines.h"
+#include "VMTrapsInlines.h"
 #include "VirtualRegister.h"
 #include <stdio.h>
 #include <wtf/NeverDestroyed.h>
@@ -496,6 +497,7 @@
 
 ALWAYS_INLINE static void notifyDebuggerOfUnwinding(VM& vm, CallFrame* callFrame)
 {
+    DeferTermination deferScope(vm);
     JSGlobalObject* globalObject = callFrame->lexicalGlobalObject(vm);
     auto catchScope = DECLARE_CATCH_SCOPE(vm);
     if (Debugger* debugger = globalObject->debugger()) {
@@ -658,7 +660,6 @@
     EXCEPTION_ASSERT(throwScope.exception() || program);
     RETURN_IF_EXCEPTION(throwScope, { });
 
-    throwScope.assertNoException();
     ASSERT(!vm.isCollectorBusyOnCurrentThread());
     RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());
     if (vm.isCollectorBusyOnCurrentThread())
@@ -1271,6 +1272,7 @@
 NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookType debugHookType)
 {
     VM& vm = callFrame->deprecatedVM();
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_CATCH_SCOPE(vm);
 
     if (UNLIKELY(Options::debuggerTriggersBreakpointException()) && debugHookType == DidReachDebuggerStatement)

Modified: trunk/Source/_javascript_Core/interpreter/ShadowChicken.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/interpreter/ShadowChicken.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/interpreter/ShadowChicken.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -28,6 +28,7 @@
 
 #include "CodeBlock.h"
 #include "ShadowChickenInlines.h"
+#include "VMTrapsInlines.h"
 #include <wtf/ListDump.h>
 
 namespace JSC {
@@ -488,6 +489,7 @@
 JSArray* ShadowChicken::functionsOnStack(JSGlobalObject* globalObject, CallFrame* callFrame)
 {
     VM& vm = globalObject->vm();
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_THROW_SCOPE(vm);
     JSArray* result = constructEmptyArray(globalObject, nullptr);
     RETURN_IF_EXCEPTION(scope, nullptr);

Modified: trunk/Source/_javascript_Core/jsc.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/jsc.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/jsc.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -3008,7 +3008,7 @@
                 // If the passed file isn't an absolute path append "./" so the module loader doesn't think this is a bare-name specifier.
                 fileName = fileName.startsWith('/') ? fileName : makeString("./", fileName);
                 promise = loadAndEvaluateModule(globalObject, fileName, jsUndefined(), jsUndefined());
-                scope.releaseAssertNoException();
+                RETURN_IF_EXCEPTION(scope, void());
             } else {
                 if (!fetchScriptFromLocalFileSystem(fileName, scriptBuffer)) {
                     success = false; // fail early so we can catch missing files
@@ -3042,7 +3042,7 @@
             });
 
             promise->then(globalObject, fulfillHandler, rejectHandler);
-            scope.releaseAssertNoException();
+            scope.releaseAssertNoExceptionExceptTermination();
             vm.drainMicrotasks();
         } else {
             NakedPtr<Exception> evaluationException;

Modified: trunk/Source/_javascript_Core/parser/ParserArena.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/parser/ParserArena.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/parser/ParserArena.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2009-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,7 @@
 #include "JSBigInt.h"
 #include "JSCInlines.h"
 #include "Nodes.h"
+#include "VMTrapsInlines.h"
 
 namespace JSC {
 
@@ -83,6 +84,7 @@
     if (radix == 10)
         return identifier;
 
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_CATCH_SCOPE(vm);
     JSValue bigInt = JSBigInt::parseInt(nullptr, vm, identifier.string(), radix, JSBigInt::ErrorParseMode::ThrowExceptions, JSBigInt::ParseIntSign::Unsigned);
     scope.assertNoException();

Modified: trunk/Source/_javascript_Core/runtime/AbstractModuleRecord.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/AbstractModuleRecord.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/AbstractModuleRecord.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -51,6 +51,9 @@
 
 void AbstractModuleRecord::finishCreation(JSGlobalObject* globalObject, VM& vm)
 {
+    DeferTermination deferScope(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     Base::finishCreation(vm);
     ASSERT(inherits(vm, info()));
 
@@ -59,7 +62,6 @@
     for (unsigned index = 0; index < values.size(); ++index)
         Base::internalField(index).set(vm, this, values[index]);
 
-    auto scope = DECLARE_THROW_SCOPE(vm);
     JSMap* map = JSMap::create(globalObject, vm, globalObject->mapStructure());
     scope.releaseAssertNoException();
     m_dependenciesMap.set(vm, this, map);

Modified: trunk/Source/_javascript_Core/runtime/CommonSlowPaths.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/CommonSlowPaths.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/CommonSlowPaths.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011-2020 Apple Inc. All rights reserved.
+ * Copyright (C) 2011-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -235,7 +235,7 @@
 
         size_t inlineCapacity = bytecode.m_inlineCapacity;
         ObjectAllocationProfileWithPrototype* allocationProfile = constructor->ensureRareDataAndAllocationProfile(globalObject, inlineCapacity)->objectAllocationProfile();
-        throwScope.releaseAssertNoException();
+        CHECK_EXCEPTION();
         Structure* structure = allocationProfile->structure();
         result = constructEmptyObject(vm, structure);
         if (structure->hasPolyProto()) {

Modified: trunk/Source/_javascript_Core/runtime/ErrorInstance.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/ErrorInstance.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/ErrorInstance.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten ([email protected])
- *  Copyright (C) 2003-2020 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003-2021 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -155,10 +155,10 @@
     PropertySlot messageSlot(this, PropertySlot::InternalMethodType::VMInquiry, &vm);
     if (JSObject::getOwnPropertySlot(this, globalObject, messagePropertName, messageSlot) && messageSlot.isValue())
         messageValue = messageSlot.getValue(globalObject, messagePropertName);
-    scope.assertNoException();
+    RETURN_IF_EXCEPTION(scope, { });
 
     if (!messageValue)
-        return String();
+        return { };
     RELEASE_AND_RETURN(scope, messageValue.toWTFString(globalObject));
 }
 
@@ -186,7 +186,7 @@
         }
         currentObj = obj->getPrototypeDirect(vm);
     }
-    scope.assertNoException();
+    RETURN_IF_EXCEPTION(scope, { });
 
     if (!nameValue)
         return "Error"_s;

Modified: trunk/Source/_javascript_Core/runtime/ExceptionScope.h (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/ExceptionScope.h	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/ExceptionScope.h	2021-04-28 17:13:40 UTC (rev 276719)
@@ -54,6 +54,8 @@
 
     ALWAYS_INLINE void assertNoException() { RELEASE_ASSERT_WITH_MESSAGE(!exception(), "%s", unexpectedExceptionMessage().data()); }
     ALWAYS_INLINE void releaseAssertNoException() { RELEASE_ASSERT_WITH_MESSAGE(!exception(), "%s", unexpectedExceptionMessage().data()); }
+    ALWAYS_INLINE void assertNoExceptionExceptTermination() { RELEASE_ASSERT_WITH_MESSAGE(!exception() || m_vm.isTerminationException(exception()), "%s", unexpectedExceptionMessage().data()); }
+    ALWAYS_INLINE void releaseAssertNoExceptionExceptTermination() { RELEASE_ASSERT_WITH_MESSAGE(!exception() || m_vm.isTerminationException(exception()), "%s", unexpectedExceptionMessage().data()); }
 
 #if ASAN_ENABLED || ENABLE(C_LOOP)
     const void* stackPosition() const {  return m_location.stackPosition; }
@@ -88,6 +90,8 @@
 
     ALWAYS_INLINE void assertNoException() { ASSERT(!exception()); }
     ALWAYS_INLINE void releaseAssertNoException() { RELEASE_ASSERT(!exception()); }
+    ALWAYS_INLINE void assertNoExceptionExceptTermination() { ASSERT(!exception() || m_vm.isTerminationException(exception())); }
+    ALWAYS_INLINE void releaseAssertNoExceptionExceptTermination() { RELEASE_ASSERT(!exception() || m_vm.isTerminationException(exception())); }
 
 protected:
     ALWAYS_INLINE ExceptionScope(VM& vm)

Modified: trunk/Source/_javascript_Core/runtime/JSFunction.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/JSFunction.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/JSFunction.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -42,6 +42,7 @@
 #include "PropertyNameArray.h"
 #include "StackVisitor.h"
 #include "TypeError.h"
+#include "VMTrapsInlines.h"
 
 namespace JSC {
 
@@ -155,7 +156,8 @@
 {
     // This code assumes getting the prototype is not effectful. That's only
     // true when we can use the allocation profile.
-    ASSERT(canUseAllocationProfile()); 
+    ASSERT(canUseAllocationProfile());
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_CATCH_SCOPE(vm);
     JSValue prototype = get(globalObject, vm.propertyNames->prototype);
     scope.releaseAssertNoException();

Modified: trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -205,7 +205,7 @@
     if (!targetOption)
         return JSValue::encode(jsBoolean(false));
 
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
     RELEASE_ASSERT(!thisObject->isDetached());
 
     if (std::isnan(static_cast<double>(*targetOption))) {
@@ -249,7 +249,7 @@
     auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
     if (!targetOption)
         return JSValue::encode(jsNumber(-1));
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
     RELEASE_ASSERT(!thisObject->isDetached());
 
     for (; index < length; ++index) {
@@ -374,7 +374,7 @@
         return JSValue::encode(jsNumber(-1));
 
     typename ViewClass::ElementType* array = thisObject->typedVector();
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
     RELEASE_ASSERT(!thisObject->isDetached());
 
     for (; index >= 0; --index) {
@@ -557,8 +557,9 @@
 }
 
 template<typename ViewClass>
-ALWAYS_INLINE EncodedJSValue genericTypedArrayViewPrivateFuncSubarrayCreate(VM&vm, JSGlobalObject* globalObject, CallFrame* callFrame)
+ALWAYS_INLINE EncodedJSValue genericTypedArrayViewPrivateFuncSubarrayCreate(VM& vm, JSGlobalObject* globalObject, CallFrame* callFrame)
 {
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     // 22.2.3.23

Modified: trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/JSGlobalObject.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -549,6 +549,7 @@
 {
     // Performing these gets should not throw.
     VM& vm = globalObject->vm();
+    DeferTermination deferScope(vm);
     auto catchScope = DECLARE_CATCH_SCOPE(vm);
     PropertySlot slot(base, PropertySlot::InternalMethodType::Get);
     bool result = base->getOwnPropertySlot(base, globalObject, ident, slot);
@@ -598,6 +599,7 @@
 
 void JSGlobalObject::init(VM& vm)
 {
+    ASSERT(vm.traps().isDeferringTermination());
     ASSERT(vm.currentThreadIsHoldingAPILock());
     auto catchScope = DECLARE_CATCH_SCOPE(vm);
 
@@ -1517,7 +1519,7 @@
             bool putResult = false;
             if (symbolTablePutTouchWatchpointSet(thisObject, globalObject, propertyName, descriptor.value(), shouldThrow, ignoreReadOnlyErrors, putResult))
                 ASSERT(putResult);
-            scope.assertNoException();
+            RETURN_IF_EXCEPTION(scope, false);
         }
         if (descriptor.writablePresent() && !descriptor.writable() && !entry.isReadOnly()) {
             entry.setReadOnly();
@@ -2188,6 +2190,7 @@
     RELEASE_ASSERT(!speciesWatchpoint);
 
     VM& vm = this->vm();
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     // First we need to make sure that the %prototype%.constructor property points to a %constructor%

Modified: trunk/Source/_javascript_Core/runtime/JSModuleLoader.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/JSModuleLoader.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/JSModuleLoader.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2019 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2015-2021 Apple Inc. All Rights Reserved.
  * Copyright (C) 2016 Yusuke Suzuki <[email protected]>.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -115,7 +115,7 @@
     auto scope = DECLARE_CATCH_SCOPE(vm);
     if (key.isString() || key.isSymbol()) {
         auto propertyName = key.toPropertyKey(globalObject);
-        scope.assertNoException(); // This is OK since this function is just for debugging purpose.
+        scope.assertNoExceptionExceptTermination(); // This is OK since this function is just for debugging purpose.
         return propertyName.impl();
     }
     return vm.propertyNames->emptyIdentifier.impl();

Modified: trunk/Source/_javascript_Core/runtime/JSModuleNamespaceObject.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/JSModuleNamespaceObject.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/JSModuleNamespaceObject.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -78,7 +78,7 @@
     // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-isextensible
     // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-preventextensions
     methodTable(vm)->preventExtensions(this, globalObject);
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
 }
 
 void JSModuleNamespaceObject::destroy(JSCell* cell)

Modified: trunk/Source/_javascript_Core/runtime/JSObject.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/JSObject.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/JSObject.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -2305,7 +2305,7 @@
             return value;
     }
 
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
 
     return throwTypeError(globalObject, scope, "No default value"_s);
 }
@@ -2538,7 +2538,7 @@
 
     getNonReifiedStaticPropertyNames(vm, propertyNames, mode);
     structure(vm)->getPropertyNamesFromStructure(vm, propertyNames, mode);
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
 }
 
 double JSObject::toNumber(JSGlobalObject* globalObject) const

Modified: trunk/Source/_javascript_Core/runtime/JSTemplateObjectDescriptor.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/JSTemplateObjectDescriptor.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/JSTemplateObjectDescriptor.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2015 Yusuke Suzuki <[email protected]>.
- * Copyright (C) 2016-2019 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2016-2021 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -78,12 +78,12 @@
     }
 
     objectConstructorFreeze(globalObject, rawObject);
-    scope.assertNoException();
+    RETURN_IF_EXCEPTION(scope, nullptr);
 
     templateObject->putDirect(vm, vm.propertyNames->raw, rawObject, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::DontDelete);
 
     objectConstructorFreeze(globalObject, templateObject);
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
 
     return templateObject;
 }

Modified: trunk/Source/_javascript_Core/runtime/JSTypedArrayViewPrototype.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/JSTypedArrayViewPrototype.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/JSTypedArrayViewPrototype.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,6 +32,7 @@
 #include "JSCInlines.h"
 #include "JSGenericTypedArrayViewPrototypeFunctions.h"
 #include "Operations.h"
+#include "VMTrapsInlines.h"
 
 namespace JSC {
 

Modified: trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten ([email protected])
- *  Copyright (C) 2008-2020 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008-2021 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -103,7 +103,7 @@
     HasOwnPropertyCache* hasOwnPropertyCache = vm.ensureHasOwnPropertyCache();
     if (Optional<bool> result = hasOwnPropertyCache->get(structure, propertyName)) {
         ASSERT(*result == thisObject->hasOwnProperty(globalObject, propertyName));
-        scope.assertNoException();
+        scope.assertNoExceptionExceptTermination();
         return *result;
     }
 
@@ -364,7 +364,7 @@
     if (thisValue.isNull())
         return vm.smallStrings.nullObjectString();
     JSObject* thisObject = thisValue.toObject(globalObject);
-    scope.assertNoException();
+    RETURN_IF_EXCEPTION(scope, nullptr);
 
     Integrity::auditStructureID(vm, thisObject->structureID());
     auto result = thisObject->structure(vm)->cachedSpecialProperty(CachedSpecialPropertyKey::ToStringTag);

Modified: trunk/Source/_javascript_Core/runtime/ProgramExecutable.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/ProgramExecutable.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/ProgramExecutable.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -28,6 +28,7 @@
 #include "BatchedTransitionOptimizer.h"
 #include "CodeCache.h"
 #include "Debugger.h"
+#include "VMTrapsInlines.h"
 
 namespace JSC {
 
@@ -65,6 +66,7 @@
 
 JSObject* ProgramExecutable::initializeGlobalProperties(VM& vm, JSGlobalObject* globalObject, JSScope* scope)
 {
+    DeferTermination deferScope(vm);
     auto throwScope = DECLARE_THROW_SCOPE(vm);
     RELEASE_ASSERT(scope);
     ASSERT(globalObject == scope->globalObject(vm));

Modified: trunk/Source/_javascript_Core/runtime/SamplingProfiler.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/runtime/SamplingProfiler.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/runtime/SamplingProfiler.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -40,6 +40,7 @@
 #include "MarkedBlockSet.h"
 #include "NativeExecutable.h"
 #include "VM.h"
+#include "VMTrapsInlines.h"
 #include "WasmCallee.h"
 #include "WasmCalleeRegistry.h"
 #include "WasmCapabilities.h"
@@ -729,6 +730,7 @@
     if (!callee)
         return String();
 
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_CATCH_SCOPE(vm);
     JSGlobalObject* globalObject = callee->globalObject(vm);
     auto getPropertyIfPureOperation = [&] (const Identifier& ident) -> String {

Modified: trunk/Source/_javascript_Core/tools/JSDollarVM.cpp (276718 => 276719)


--- trunk/Source/_javascript_Core/tools/JSDollarVM.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/_javascript_Core/tools/JSDollarVM.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -49,6 +49,7 @@
 #include "TypeProfiler.h"
 #include "TypeProfilerLog.h"
 #include "VMInspector.h"
+#include "VMTrapsInlines.h"
 #include "WasmCapabilities.h"
 #include <unicode/uversion.h>
 #include <wtf/Atomics.h>
@@ -3091,6 +3092,7 @@
 {
     DollarVMAssertScope assertScope;
     VM& vm = globalObject->vm();
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_THROW_SCOPE(vm);
     if (auto* shadowChicken = vm.shadowChicken()) {
         scope.release();

Modified: trunk/Source/WebCore/ChangeLog (276718 => 276719)


--- trunk/Source/WebCore/ChangeLog	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/ChangeLog	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,3 +1,83 @@
+2021-04-28  Mark Lam  <[email protected]>
+
+        Fix exception assertions in light of the TerminationException.
+        https://bugs.webkit.org/show_bug.cgi?id=225128
+        rdar://76694909
+
+        Reviewed by Robin Morisset.
+
+        A few changes plus rebasing bindings test results.
+
+        * Modules/plugins/QuickTimePluginReplacement.mm:
+        (WebCore::QuickTimePluginReplacement::installReplacement):
+        * bindings/js/JSDOMExceptionHandling.cpp:
+        (WebCore::propagateExceptionSlowPath):
+        (WebCore::throwNotSupportedError):
+        (WebCore::throwInvalidStateError):
+        (WebCore::throwSecurityError):
+        (WebCore::throwDOMSyntaxError):
+        (WebCore::throwDataCloneError):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSC_DEFINE_HOST_FUNCTION):
+        * bindings/js/JSDOMGlobalObjectTask.cpp:
+        * bindings/js/JSDOMMapLike.cpp:
+        (WebCore::getBackingMap):
+        * bindings/js/JSDOMSetLike.cpp:
+        (WebCore::getBackingSet):
+        * bindings/js/JSMicrotaskCallback.h:
+        (WebCore::JSMicrotaskCallback::call):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::readTerminal):
+        * bindings/js/WritableStream.cpp:
+        (WebCore::WritableStreamInternal::callFunction):
+        (WebCore::WritableStream::lock):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GeneratePut):
+        (GeneratePutByIndex):
+        (GenerateDefineOwnProperty):
+
+        * bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp:
+        (WebCore::JSTestNamedAndIndexedSetterNoIdentifier::put):
+        (WebCore::JSTestNamedAndIndexedSetterNoIdentifier::putByIndex):
+        (WebCore::JSTestNamedAndIndexedSetterNoIdentifier::defineOwnProperty):
+        * bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp:
+        (WebCore::JSTestNamedAndIndexedSetterThrowingException::put):
+        (WebCore::JSTestNamedAndIndexedSetterThrowingException::putByIndex):
+        (WebCore::JSTestNamedAndIndexedSetterThrowingException::defineOwnProperty):
+        * bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp:
+        (WebCore::JSTestNamedAndIndexedSetterWithIdentifier::put):
+        (WebCore::JSTestNamedAndIndexedSetterWithIdentifier::putByIndex):
+        (WebCore::JSTestNamedAndIndexedSetterWithIdentifier::defineOwnProperty):
+        * bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp:
+        (WebCore::JSTestNamedSetterNoIdentifier::put):
+        (WebCore::JSTestNamedSetterNoIdentifier::putByIndex):
+        (WebCore::JSTestNamedSetterNoIdentifier::defineOwnProperty):
+        * bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp:
+        (WebCore::JSTestNamedSetterThrowingException::put):
+        (WebCore::JSTestNamedSetterThrowingException::putByIndex):
+        (WebCore::JSTestNamedSetterThrowingException::defineOwnProperty):
+        * bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp:
+        (WebCore::JSTestNamedSetterWithIdentifier::put):
+        (WebCore::JSTestNamedSetterWithIdentifier::putByIndex):
+        (WebCore::JSTestNamedSetterWithIdentifier::defineOwnProperty):
+        * bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp:
+        (WebCore::JSTestNamedSetterWithIndexedGetter::put):
+        (WebCore::JSTestNamedSetterWithIndexedGetter::putByIndex):
+        (WebCore::JSTestNamedSetterWithIndexedGetter::defineOwnProperty):
+        * bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp:
+        (WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::put):
+        (WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::putByIndex):
+        (WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::defineOwnProperty):
+        * bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp:
+        (WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::put):
+        (WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::putByIndex):
+        (WebCore::JSTestNamedSetterWithLegacyUnforgeableProperties::defineOwnProperty):
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
+        (WebCore::HTMLMediaElement::updateMediaControlsAfterPresentationModeChange):
+        (WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):
+
 2021-04-28  Zalan Bujtas  <[email protected]>
 
         Remove redundant RenderObject::isInFlowRenderFragmentedFlow

Modified: trunk/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm (276718 => 276719)


--- trunk/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -176,12 +176,18 @@
     auto scope = DECLARE_CATCH_SCOPE(vm);
     JSC::JSGlobalObject* lexicalGlobalObject = globalObject;
 
+    auto clearExceptionAndReturnFalse = [&] () -> InstallResult {
+        scope.clearException();
+        return { false };
+    };
+
     // Lookup the "createPluginReplacement" function.
     JSC::JSValue replacementFunction = globalObject->get(lexicalGlobalObject, JSC::Identifier::fromString(vm, "createPluginReplacement"));
     if (replacementFunction.isUndefinedOrNull())
         return { false };
     JSC::JSObject* replacementObject = replacementFunction.toObject(lexicalGlobalObject);
-    scope.assertNoException();
+    RETURN_IF_EXCEPTION(scope, clearExceptionAndReturnFalse());
+
     auto callData = getCallData(vm, replacementObject);
     if (callData.type == JSC::CallData::Type::None)
         return { false };
@@ -194,10 +200,7 @@
     argList.append(toJS<IDLSequence<IDLNullable<IDLDOMString>>>(*lexicalGlobalObject, *globalObject, m_values));
     ASSERT(!argList.hasOverflowed());
     JSC::JSValue replacement = call(lexicalGlobalObject, replacementObject, callData, globalObject, argList);
-    if (UNLIKELY(scope.exception())) {
-        scope.clearException();
-        return { false };
-    }
+    RETURN_IF_EXCEPTION(scope, clearExceptionAndReturnFalse());
 
     // Get the <video> created to replace the plug-in.
     JSC::JSValue value = replacement.get(lexicalGlobalObject, JSC::Identifier::fromString(vm, "video"));

Modified: trunk/Source/WebCore/bindings/js/JSDOMExceptionHandling.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/js/JSDOMExceptionHandling.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/js/JSDOMExceptionHandling.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -189,7 +189,7 @@
 
 void propagateExceptionSlowPath(JSC::JSGlobalObject& lexicalGlobalObject, JSC::ThrowScope& throwScope, Exception&& exception)
 {
-    throwScope.assertNoException();
+    throwScope.assertNoExceptionExceptTermination();
     throwException(&lexicalGlobalObject, throwScope, createDOMException(lexicalGlobalObject, WTFMove(exception)));
 }
     
@@ -209,19 +209,19 @@
 
 void throwNotSupportedError(JSC::JSGlobalObject& lexicalGlobalObject, JSC::ThrowScope& scope, ASCIILiteral message)
 {
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
     throwException(&lexicalGlobalObject, scope, createDOMException(&lexicalGlobalObject, NotSupportedError, message));
 }
 
 void throwInvalidStateError(JSC::JSGlobalObject& lexicalGlobalObject, JSC::ThrowScope& scope, ASCIILiteral message)
 {
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
     throwException(&lexicalGlobalObject, scope, createDOMException(&lexicalGlobalObject, InvalidStateError, message));
 }
 
 void throwSecurityError(JSC::JSGlobalObject& lexicalGlobalObject, JSC::ThrowScope& scope, const String& message)
 {
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
     throwException(&lexicalGlobalObject, scope, createDOMException(&lexicalGlobalObject, SecurityError, message));
 }
 
@@ -298,13 +298,13 @@
 
 void throwDOMSyntaxError(JSC::JSGlobalObject& lexicalGlobalObject, JSC::ThrowScope& scope, ASCIILiteral message)
 {
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
     throwException(&lexicalGlobalObject, scope, createDOMException(&lexicalGlobalObject, SyntaxError, message));
 }
 
 void throwDataCloneError(JSC::JSGlobalObject& lexicalGlobalObject, JSC::ThrowScope& scope)
 {
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
     throwException(&lexicalGlobalObject, scope, createDOMException(&lexicalGlobalObject, DataCloneError));
 }
 

Modified: trunk/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -59,6 +59,7 @@
 #include <_javascript_Core/JSCustomSetterFunction.h>
 #include <_javascript_Core/JSInternalPromise.h>
 #include <_javascript_Core/StructureInlines.h>
+#include <_javascript_Core/VMTrapsInlines.h>
 #include <_javascript_Core/WasmStreamingCompiler.h>
 #include <_javascript_Core/WeakGCMapInlines.h>
 
@@ -96,6 +97,7 @@
     ASSERT(callFrame);
     ASSERT(callFrame->argumentCount() == 2);
     VM& vm = globalObject->vm();
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_CATCH_SCOPE(vm);
 
     auto interfaceName = callFrame->uncheckedArgument(0).getString(globalObject);
@@ -110,6 +112,7 @@
     ASSERT(callFrame);
     ASSERT(callFrame->argumentCount() == 2);
     VM& vm = globalObject->vm();
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_CATCH_SCOPE(vm);
 
     auto interfaceName = callFrame->uncheckedArgument(0).getString(globalObject);
@@ -128,6 +131,7 @@
     ASSERT(callFrame->argumentCount() == 2);
 
     auto& vm = globalObject->vm();
+    DeferTermination deferScope(vm);
     auto scope = DECLARE_CATCH_SCOPE(vm);
 
     auto codeValue = callFrame->uncheckedArgument(0).getString(globalObject);

Modified: trunk/Source/WebCore/bindings/js/JSDOMGlobalObjectTask.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/js/JSDOMGlobalObjectTask.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/js/JSDOMGlobalObjectTask.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -60,7 +60,7 @@
         if (!context)
             return;
         JSExecState::runTask(lexicalGlobalObject, m_task);
-        scope.assertNoException();
+        scope.assertNoExceptionExceptTermination();
     }
 
 private:

Modified: trunk/Source/WebCore/bindings/js/JSDOMMapLike.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/js/JSDOMMapLike.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/js/JSDOMMapLike.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2017-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,6 +29,7 @@
 #include "WebCoreJSClientData.h"
 #include <_javascript_Core/CatchScope.h>
 #include <_javascript_Core/JSMap.h>
+#include <_javascript_Core/VMTrapsInlines.h>
 
 namespace WebCore {
 
@@ -39,6 +40,7 @@
     if (!backingMap.isUndefined())
         return { false, *JSC::asObject(backingMap) };
 
+    JSC::DeferTermination deferScope(vm);
     auto scope = DECLARE_CATCH_SCOPE(vm);
 
     backingMap = JSC::JSMap::create(&lexicalGlobalObject, vm, lexicalGlobalObject.mapStructure());

Modified: trunk/Source/WebCore/bindings/js/JSDOMSetLike.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/js/JSDOMSetLike.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/js/JSDOMSetLike.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2019-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,7 @@
 #include <_javascript_Core/CatchScope.h>
 #include <_javascript_Core/JSSet.h>
 #include <_javascript_Core/JSSetInlines.h>
+#include <_javascript_Core/VMTrapsInlines.h>
 
 namespace WebCore {
 
@@ -44,6 +45,7 @@
     auto backingSet = setLike.get(&lexicalGlobalObject, static_cast<JSVMClientData*>(vm.clientData)->builtinNames().backingSetPrivateName());
     if (backingSet.isUndefined()) {
         auto& vm = lexicalGlobalObject.vm();
+        JSC::DeferTermination deferScope(vm);
         auto scope = DECLARE_CATCH_SCOPE(vm);
 
         backingSet = JSC::JSSet::create(&lexicalGlobalObject, vm, lexicalGlobalObject.setStructure());

Modified: trunk/Source/WebCore/bindings/js/JSMicrotaskCallback.h (276718 => 276719)


--- trunk/Source/WebCore/bindings/js/JSMicrotaskCallback.h	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/js/JSMicrotaskCallback.h	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2018 Yusuke Suzuki <[email protected]>.
+ * Copyright (C) 2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,7 +45,7 @@
         JSC::JSLockHolder lock(vm);
         auto scope = DECLARE_CATCH_SCOPE(vm);
         JSExecState::runTask(m_globalObject.get(), m_task);
-        scope.assertNoException();
+        scope.assertNoExceptionExceptTermination();
     }
 
 private:

Modified: trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2009-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -3474,7 +3474,7 @@
             JSValue result = JSC::JSWebAssemblyModule::createStub(m_lexicalGlobalObject->vm(), m_lexicalGlobalObject, m_globalObject->webAssemblyModuleStructure(), m_wasmModules->at(index));
             // Since we are cloning a JSWebAssemblyModule, it's impossible for that
             // module to not have been a valid module. Therefore, createStub should
-            // not trow.
+            // not throw.
             scope.releaseAssertNoException();
             m_gcBuffer.appendWithCrashOnOverflow(result);
             return result;
@@ -3496,7 +3496,7 @@
             JSWebAssemblyMemory* result = JSC::JSWebAssemblyMemory::tryCreate(m_lexicalGlobalObject, vm, m_globalObject->webAssemblyMemoryStructure());
             // Since we are cloning a JSWebAssemblyMemory, it's impossible for that
             // module to not have been a valid module. Therefore, createStub should
-            // not trow.
+            // not throw.
             scope.releaseAssertNoException();
             Ref<Wasm::Memory> memory = Wasm::Memory::create(handle.releaseNonNull(),
                 [&vm] (Wasm::Memory::NotifyPressure) { vm.heap.collectAsync(CollectionScope::Full); },

Modified: trunk/Source/WebCore/bindings/js/WritableStream.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/js/WritableStream.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/js/WritableStream.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020 Apple Inc. All rights reserved.
+ * Copyright (C) 2020-2021 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,7 +44,7 @@
     auto callData = JSC::getCallData(vm, jsFunction);
     ASSERT(callData.type != JSC::CallData::Type::None);
     auto result = call(&lexicalGlobalObject, jsFunction, callData, thisValue, arguments);
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
     return result;
 }
 }
@@ -102,7 +102,7 @@
     ASSERT(!args.hasOverflowed());
 
     JSC::construct(&lexicalGlobalObject, constructor, constructData, args);
-    scope.assertNoException();
+    scope.assertNoExceptionExceptTermination();
 }
 
 bool WritableStream::isLocked() const

Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (276718 => 276719)


--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	2021-04-28 17:13:40 UTC (rev 276719)
@@ -1208,7 +1208,7 @@
             push(@$outputArray, "        JSValue prototype = thisObject->getPrototypeDirect(JSC::getVM(lexicalGlobalObject));\n");
             push(@$outputArray, "        bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);\n");
             push(@$outputArray, "        slot.disallowVMEntry.reset();\n");
-            push(@$outputArray, "        throwScope.assertNoException();\n");
+            push(@$outputArray, "        RETURN_IF_EXCEPTION(throwScope, false);\n");
             push(@$outputArray, "        if (!found) {\n");
             $additionalIndent .= "    ";
         }
@@ -1286,7 +1286,7 @@
             push(@$outputArray, "    JSValue prototype = thisObject->getPrototypeDirect(vm);\n");
             push(@$outputArray, "    bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);\n");
             push(@$outputArray, "    slot.disallowVMEntry.reset();\n");
-            push(@$outputArray, "    throwScope.assertNoException();\n");
+            push(@$outputArray, "    RETURN_IF_EXCEPTION(throwScope, false);\n");
             push(@$outputArray, "    if (!found) {\n");
             $additionalIndent .= "    ";
         }
@@ -1424,7 +1424,7 @@
             push(@$outputArray, $additionalIndent. "        PropertySlot slot { thisObject, PropertySlot::InternalMethodType::VMInquiry, &lexicalGlobalObject->vm() };\n");
             push(@$outputArray, $additionalIndent. "        bool found = JSObject::getOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot);\n");
             push(@$outputArray, $additionalIndent. "        slot.disallowVMEntry.reset();\n");
-            push(@$outputArray, $additionalIndent. "        throwScope.assertNoException();\n");
+            push(@$outputArray, $additionalIndent. "        RETURN_IF_EXCEPTION(throwScope, false);\n");
             push(@$outputArray, $additionalIndent. "        if (!found) {\n");
             $additionalIndent .= "    ";
         }

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -241,7 +241,7 @@
         JSValue prototype = thisObject->getPrototypeDirect(JSC::getVM(lexicalGlobalObject));
         bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
             RETURN_IF_EXCEPTION(throwScope, true);
@@ -274,7 +274,7 @@
     JSValue prototype = thisObject->getPrototypeDirect(vm);
     bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
     slot.disallowVMEntry.reset();
-    throwScope.assertNoException();
+    RETURN_IF_EXCEPTION(throwScope, false);
     if (!found) {
         auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
         RETURN_IF_EXCEPTION(throwScope, true);
@@ -306,7 +306,7 @@
         PropertySlot slot { thisObject, PropertySlot::InternalMethodType::VMInquiry, &lexicalGlobalObject->vm() };
         bool found = JSObject::getOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             if (!propertyDescriptor.isDataDescriptor())
                 return false;

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -241,7 +241,7 @@
         JSValue prototype = thisObject->getPrototypeDirect(JSC::getVM(lexicalGlobalObject));
         bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
             RETURN_IF_EXCEPTION(throwScope, true);
@@ -274,7 +274,7 @@
     JSValue prototype = thisObject->getPrototypeDirect(vm);
     bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
     slot.disallowVMEntry.reset();
-    throwScope.assertNoException();
+    RETURN_IF_EXCEPTION(throwScope, false);
     if (!found) {
         auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
         RETURN_IF_EXCEPTION(throwScope, true);
@@ -306,7 +306,7 @@
         PropertySlot slot { thisObject, PropertySlot::InternalMethodType::VMInquiry, &lexicalGlobalObject->vm() };
         bool found = JSObject::getOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             if (!propertyDescriptor.isDataDescriptor())
                 return false;

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -252,7 +252,7 @@
         JSValue prototype = thisObject->getPrototypeDirect(JSC::getVM(lexicalGlobalObject));
         bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
             RETURN_IF_EXCEPTION(throwScope, true);
@@ -285,7 +285,7 @@
     JSValue prototype = thisObject->getPrototypeDirect(vm);
     bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
     slot.disallowVMEntry.reset();
-    throwScope.assertNoException();
+    RETURN_IF_EXCEPTION(throwScope, false);
     if (!found) {
         auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
         RETURN_IF_EXCEPTION(throwScope, true);
@@ -317,7 +317,7 @@
         PropertySlot slot { thisObject, PropertySlot::InternalMethodType::VMInquiry, &lexicalGlobalObject->vm() };
         bool found = JSObject::getOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             if (!propertyDescriptor.isDataDescriptor())
                 return false;

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -213,7 +213,7 @@
         JSValue prototype = thisObject->getPrototypeDirect(JSC::getVM(lexicalGlobalObject));
         bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
             RETURN_IF_EXCEPTION(throwScope, true);
@@ -239,7 +239,7 @@
     JSValue prototype = thisObject->getPrototypeDirect(vm);
     bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
     slot.disallowVMEntry.reset();
-    throwScope.assertNoException();
+    RETURN_IF_EXCEPTION(throwScope, false);
     if (!found) {
         auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
         RETURN_IF_EXCEPTION(throwScope, true);
@@ -262,7 +262,7 @@
         PropertySlot slot { thisObject, PropertySlot::InternalMethodType::VMInquiry, &lexicalGlobalObject->vm() };
         bool found = JSObject::getOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             if (!propertyDescriptor.isDataDescriptor())
                 return false;

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -213,7 +213,7 @@
         JSValue prototype = thisObject->getPrototypeDirect(JSC::getVM(lexicalGlobalObject));
         bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
             RETURN_IF_EXCEPTION(throwScope, true);
@@ -239,7 +239,7 @@
     JSValue prototype = thisObject->getPrototypeDirect(vm);
     bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
     slot.disallowVMEntry.reset();
-    throwScope.assertNoException();
+    RETURN_IF_EXCEPTION(throwScope, false);
     if (!found) {
         auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
         RETURN_IF_EXCEPTION(throwScope, true);
@@ -262,7 +262,7 @@
         PropertySlot slot { thisObject, PropertySlot::InternalMethodType::VMInquiry, &lexicalGlobalObject->vm() };
         bool found = JSObject::getOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             if (!propertyDescriptor.isDataDescriptor())
                 return false;

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -221,7 +221,7 @@
         JSValue prototype = thisObject->getPrototypeDirect(JSC::getVM(lexicalGlobalObject));
         bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
             RETURN_IF_EXCEPTION(throwScope, true);
@@ -247,7 +247,7 @@
     JSValue prototype = thisObject->getPrototypeDirect(vm);
     bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
     slot.disallowVMEntry.reset();
-    throwScope.assertNoException();
+    RETURN_IF_EXCEPTION(throwScope, false);
     if (!found) {
         auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
         RETURN_IF_EXCEPTION(throwScope, true);
@@ -270,7 +270,7 @@
         PropertySlot slot { thisObject, PropertySlot::InternalMethodType::VMInquiry, &lexicalGlobalObject->vm() };
         bool found = JSObject::getOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             if (!propertyDescriptor.isDataDescriptor())
                 return false;

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -245,7 +245,7 @@
         JSValue prototype = thisObject->getPrototypeDirect(JSC::getVM(lexicalGlobalObject));
         bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
             RETURN_IF_EXCEPTION(throwScope, true);
@@ -271,7 +271,7 @@
     JSValue prototype = thisObject->getPrototypeDirect(vm);
     bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
     slot.disallowVMEntry.reset();
-    throwScope.assertNoException();
+    RETURN_IF_EXCEPTION(throwScope, false);
     if (!found) {
         auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
         RETURN_IF_EXCEPTION(throwScope, true);
@@ -297,7 +297,7 @@
         PropertySlot slot { thisObject, PropertySlot::InternalMethodType::VMInquiry, &lexicalGlobalObject->vm() };
         bool found = JSObject::getOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             if (!propertyDescriptor.isDataDescriptor())
                 return false;

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -252,7 +252,7 @@
         JSValue prototype = thisObject->getPrototypeDirect(JSC::getVM(lexicalGlobalObject));
         bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
             RETURN_IF_EXCEPTION(throwScope, true);
@@ -285,7 +285,7 @@
     JSValue prototype = thisObject->getPrototypeDirect(vm);
     bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
     slot.disallowVMEntry.reset();
-    throwScope.assertNoException();
+    RETURN_IF_EXCEPTION(throwScope, false);
     if (!found) {
         auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
         RETURN_IF_EXCEPTION(throwScope, true);
@@ -317,7 +317,7 @@
         PropertySlot slot { thisObject, PropertySlot::InternalMethodType::VMInquiry, &lexicalGlobalObject->vm() };
         bool found = JSObject::getOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             if (!propertyDescriptor.isDataDescriptor())
                 return false;

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp (276718 => 276719)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithLegacyUnforgeableProperties.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -239,7 +239,7 @@
         JSValue prototype = thisObject->getPrototypeDirect(JSC::getVM(lexicalGlobalObject));
         bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
         slot.disallowVMEntry.reset();
-        throwScope.assertNoException();
+        RETURN_IF_EXCEPTION(throwScope, false);
         if (!found) {
             auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
             RETURN_IF_EXCEPTION(throwScope, true);
@@ -265,7 +265,7 @@
     JSValue prototype = thisObject->getPrototypeDirect(vm);
     bool found = prototype.isObject() && asObject(prototype)->getPropertySlot(lexicalGlobalObject, propertyName, slot);
     slot.disallowVMEntry.reset();
-    throwScope.assertNoException();
+    RETURN_IF_EXCEPTION(throwScope, false);
     if (!found) {
         auto nativeValue = convert<IDLDOMString>(*lexicalGlobalObject, value);
         RETURN_IF_EXCEPTION(throwScope, true);
@@ -294,7 +294,7 @@
             PropertySlot slot { thisObject, PropertySlot::InternalMethodType::VMInquiry, &lexicalGlobalObject->vm() };
             bool found = JSObject::getOwnPropertySlot(thisObject, lexicalGlobalObject, propertyName, slot);
             slot.disallowVMEntry.reset();
-            throwScope.assertNoException();
+            RETURN_IF_EXCEPTION(throwScope, false);
             if (!found) {
                 if (!propertyDescriptor.isDataDescriptor())
                     return false;

Modified: trunk/Source/WebCore/html/HTMLMediaElement.cpp (276718 => 276719)


--- trunk/Source/WebCore/html/HTMLMediaElement.cpp	2021-04-28 16:54:01 UTC (rev 276718)
+++ trunk/Source/WebCore/html/HTMLMediaElement.cpp	2021-04-28 17:13:40 UTC (rev 276719)
@@ -7331,12 +7331,6 @@
         argList.append(mediaControlsHostJSWrapper);
         ASSERT(!argList.hasOverflowed());
 
-        auto* function = functionValue.toObject(&lexicalGlobalObject);
-        scope.assertNoException();
-        auto callData = JSC::getCallData(vm, function);
-        if (callData.type == JSC::CallData::Type::None)
-            return false;
-
         auto reportExceptionAndReturnFalse = [&] () -> bool {
             auto* exception = scope.exception();
             scope.clearException();
@@ -7344,6 +7338,13 @@
             return false;
         };
 
+        auto* function = functionValue.toObject(&lexicalGlobalObject);
+        RETURN_IF_EXCEPTION(scope, reportExceptionAndReturnFalse());
+        auto callData = JSC::getCallData(vm, function);
+        if (callData.type == JSC::CallData::Type::None)
+            return false;
+
+
         auto controllerValue = JSC::call(&lexicalGlobalObject, function, callData, &globalObject, argList);
         RETURN_IF_EXCEPTION(scope, reportExceptionAndReturnFalse());
 
@@ -7353,7 +7354,7 @@
 
         // Connect the Media, MediaControllerHost, and Controller so the GC knows about their relationship
         auto* mediaJSWrapperObject = mediaJSWrapper.toObject(&lexicalGlobalObject);
-        scope.assertNoException();
+        RETURN_IF_EXCEPTION(scope, reportExceptionAndReturnFalse());
         auto controlsHost = JSC::Identifier::fromString(vm, "controlsHost");
 
         ASSERT(!mediaJSWrapperObject->hasProperty(&lexicalGlobalObject, controlsHost));
@@ -7415,7 +7416,7 @@
             return false;
 
         auto* function = functionValue.toObject(&lexicalGlobalObject);
-        scope.assertNoException();
+        RETURN_IF_EXCEPTION(scope, false);
         auto callData = JSC::getCallData(vm, function);
         if (callData.type == JSC::CallData::Type::None)
             return false;
@@ -7459,7 +7460,7 @@
             return false;
 
         auto* function = functionValue.toObject(&lexicalGlobalObject);
-        scope.assertNoException();
+        RETURN_IF_EXCEPTION(scope, false);
         auto callData = JSC::getCallData(vm, function);
         JSC::MarkedArgumentBuffer argList;
         ASSERT(!argList.hasOverflowed());
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to