Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d3fcf235bf5d29ac3ad7c97c8c5fdc67e7105e1b
https://github.com/WebKit/WebKit/commit/d3fcf235bf5d29ac3ad7c97c8c5fdc67e7105e1b
Author: Youenn Fablet <[email protected]>
Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths:
A LayoutTests/streams/handle-exceptions-expected.txt
A LayoutTests/streams/handle-exceptions.html
M Source/WebCore/Modules/streams/ReadableStream.cpp
M Source/WebCore/Modules/streams/StreamPipeToUtilities.cpp
M Source/WebCore/bindings/js/InternalReadableStream.cpp
M Source/WebCore/bindings/js/InternalReadableStream.h
M Source/WebCore/bindings/js/InternalWritableStream.cpp
M Source/WebCore/bindings/js/InternalWritableStream.h
Log Message:
-----------
InternalReadableStream/InternalWritableStream methods should catch JS
exceptions for non JS code paths
rdar://181481071
https://bugs.webkit.org/show_bug.cgi?id=318940
Reviewed by Ryosuke Niwa.
Several methods on InternalReadableStream and InternalWritableStream invoke JS
builtins and can leave a pending exception on the VM.
When these methods are reached from a non-JS entry (e.g. an AbortSignal.timeout
callback, WebTransport, fetch),
the pending exception survives back to the runloop and is observed by the next
microtask reaction as scope.assertNoException(), crashing the process.
We fix this by auditing every InternalReadableStream / InternalWritableStream
method and clearing pending exceptions at the C++/JS boundary when the caller
cannot own an exception scope.
We make InternalReadableStream::cancel return an ExceptionOr<JSC::JSValue> so
that callers need to explictly handle an existing exception, typically by
wrapping the exception as a rejected promise. We do the same for
InternalWritableStream::abort.
This allows to be more spec compliant by forwarding the JS error to the web
page instead of dropping it.
We use more top scopes in internal stream functions to better isolate C++ code
from potential JS exceptions.
* LayoutTests/streams/handle-exceptions-expected.txt: Added.
* LayoutTests/streams/handle-exceptions.html: Added.
* Source/WebCore/Modules/streams/ReadableStream.cpp:
(WebCore::ReadableStream::cancel):
* Source/WebCore/Modules/streams/StreamPipeToUtilities.cpp:
(WebCore::cancelReadableStream):
(WebCore::StreamPipeToState::handleSignal):
(WebCore::StreamPipeToState::errorsMustBePropagatedForward):
(WebCore::StreamPipeToState::errorsMustBePropagatedBackward):
(WebCore::StreamPipeToState::closingMustBePropagatedBackward):
* Source/WebCore/bindings/js/InternalReadableStream.cpp:
(WebCore::InternalReadableStream::state const):
(WebCore::InternalReadableStream::storedError const):
(WebCore::InternalReadableStream::cancel):
* Source/WebCore/bindings/js/InternalReadableStream.h:
* Source/WebCore/bindings/js/InternalWritableStream.cpp:
(WebCore::InternalWritableStream::abort):
(WebCore::InternalWritableStream::errorIfPossible):
(WebCore::InternalWritableStream::state const):
(WebCore::InternalWritableStream::storedError const):
(WebCore::InternalWritableStream::closeQueuedOrInFlight):
* Source/WebCore/bindings/js/InternalWritableStream.h:
Canonical link: https://commits.webkit.org/317079@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
