ProxyObject should check for VMInquiry and return early before throwing a stack overf...
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 14 Nov 2018 04:58:17 +0000 (04:58 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 14 Nov 2018 04:58:17 +0000 (04:58 +0000)
https://bugs.webkit.org/show_bug.cgi?id=191601

Reviewed by Mark Lam.

This doesn't fix any bugs today, but it may reduce future bugs. It was
always weird that ProxyObject::getOwnPropertySlot with VMInquiry might
throw a stack overflow error instead of just returning false like it
normally does when VMInquiry is passed in.

* runtime/ProxyObject.cpp:
(JSC::ProxyObject::getOwnPropertySlotCommon):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@238163 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/ProxyObject.cpp

index 6c51b9b..3ec6df9 100644 (file)
@@ -1,5 +1,20 @@
 2018-11-13  Saam Barati  <sbarati@apple.com>
 
+        ProxyObject should check for VMInquiry and return early before throwing a stack overflow exception
+        https://bugs.webkit.org/show_bug.cgi?id=191601
+
+        Reviewed by Mark Lam.
+
+        This doesn't fix any bugs today, but it may reduce future bugs. It was
+        always weird that ProxyObject::getOwnPropertySlot with VMInquiry might
+        throw a stack overflow error instead of just returning false like it
+        normally does when VMInquiry is passed in.
+
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+
+2018-11-13  Saam Barati  <sbarati@apple.com>
+
         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
         https://bugs.webkit.org/show_bug.cgi?id=191600
 
index eba085b..bbebf3a 100644 (file)
@@ -366,14 +366,18 @@ bool ProxyObject::performHasProperty(ExecState* exec, PropertyName propertyName,
 
 bool ProxyObject::getOwnPropertySlotCommon(ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
+    slot.disableCaching();
+    slot.setIsTaintedByOpaqueObject();
+
+    if (slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry)
+        return false;
+
     VM& vm = exec->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
         throwStackOverflowError(exec, scope);
         return false;
     }
-    slot.disableCaching();
-    slot.setIsTaintedByOpaqueObject();
     switch (slot.internalMethodType()) {
     case PropertySlot::InternalMethodType::Get:
         RELEASE_AND_RETURN(scope, performGet(exec, propertyName, slot));