AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[proxy] Properly handle exceptions from Object::ToName().

Browse Source 
... when storing to proxies.

Bug: chromium:772897
Change-Id: Ia91e69f35dc3b1f67b67038bd8206e508149e9a3
Reviewed-on: https://chromium-review.googlesource.com/744041
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49039}
This commit is contained in:
Igor Sheludko 2017-10-30 15:38:10 +01:00 committed by Commit Bot
parent 31611cb55d
commit ef45d789d2
2 changed files with 30 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/runtime/runtime-proxy.cc
View File

@ -51,11 +51,11 @@ RUNTIME_FUNCTION(Runtime_GetPropertyWithReceiver) {
DCHECK_EQ(3, args.length());
CONVERT_ARG_HANDLE_CHECKED(JSReceiver, holder, 0);
CONVERT_ARG_HANDLE_CHECKED(Object, name, 1);
CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 2);
bool success;
LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, name,
bool success = false;
LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, key,
&success, holder);
if (!success) {
DCHECK(isolate->has_pending_exception());
@ -69,15 +69,18 @@ RUNTIME_FUNCTION(Runtime_SetPropertyWithReceiver) {
DCHECK_EQ(5, args.length());
CONVERT_ARG_HANDLE_CHECKED(JSReceiver, holder, 0);
CONVERT_ARG_HANDLE_CHECKED(Object, name, 1);
CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 3);
CONVERT_LANGUAGE_MODE_ARG_CHECKED(language_mode, 4);
bool success;
LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, name,
bool success = false;
LookupIterator it = LookupIterator::PropertyOrElement(isolate, receiver, key,
&success, holder);
if (!success) {
DCHECK(isolate->has_pending_exception());
return isolate->heap()->exception();
}
Maybe<bool> result = Object::SetSuperProperty(
&it, value, language_mode, Object::MAY_BE_STORE_FROM_KEYED);
MAYBE_RETURN(result, isolate->heap()->exception());

20
test/mjsunit/regress/regress-crbug-772897.js Normal file
View File

@ -0,0 +1,20 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function store(obj, name) {
return obj[name] = 0;
}
function f(obj) {
var key = {
toString() { throw new Error("boom"); }
};
store(obj, key);
}
(function() {
var proxy = new Proxy({}, {});
store(proxy, 0)
assertThrows(() => f(proxy), Error);
})();