<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[234539] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/234539">234539</a></dd>
<dt>Author</dt> <dd>rniwa@webkit.org</dd>
<dt>Date</dt> <dd>2018-08-03 01:16:48 -0700 (Fri, 03 Aug 2018)</dd>
</dl>

<h3>Log Message</h3>
<pre>Release assert when throwing exceptions in custom element reactions
https://bugs.webkit.org/show_bug.cgi?id=187805
<rdar://problem/42432714>

Reviewed by Saam Barati.

LayoutTests/imported/w3c:

Generated the expected result.

* web-platform-tests/custom-elements/reactions/with-exceptions-expected.txt: Added.

Source/WebCore:

The release assertion was hit because we were not catching & re-throwing the exception thrown by DOM API
before trying to execute custom elements reactions in ~CustomElementReactionStack as specified here:
https://html.spec.whatwg.org/multipage/custom-elements.html#cereactions
Fixed the bug by capturing the exception and re-throwing the exception as specified.

Tests: imported/w3c/web-platform-tests/custom-elements/reactions/with-exceptions.html

* bindings/js/JSMainThreadExecState.h:
(WebCore::JSMainThreadNullState::JSMainThreadNullState): Use the previous JS state.
* bindings/scripts/CodeGeneratorJS.pm:
(GeneratePut): Pass in the exec state to CustomElementReactionStack.
(GeneratePutByIndex): Ditto.
(GenerateDefineOwnProperty): Ditto.
(GenerateDeletePropertyCommon): Ditto.
(GenerateAttributeSetterBodyDefinition): Ditto.
(GenerateOperationBodyDefinition): Ditto.
* bindings/scripts/test/JS/JSTestCEReactions.cpp:
(WebCore::setJSTestCEReactionsAttributeWithCEReactionsSetter):
(WebCore::setJSTestCEReactionsReflectAttributeWithCEReactionsSetter):
(WebCore::jsTestCEReactionsPrototypeFunctionMethodWithCEReactionsBody):
* bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:
(WebCore::setJSTestCEReactionsStringifierValueSetter):
* dom/CustomElementReactionQueue.cpp:
(WebCore::CustomElementReactionQueue::ElementQueue::processQueue): Added. If there is a script running
in the stack (i.e. ExecState is not null), catch any exception before executing custom element reactions,
then re-throw the exception afterwards. ExecState is null when DOM API is invoked via Objective-C bindings
or when custom element reactions are executed in the backup queue (e.g. for editing operations).
(WebCore::CustomElementReactionStack::processQueue):
(WebCore::CustomElementReactionQueue::processBackupQueue):
* dom/CustomElementReactionQueue.h:
(WebCore::CustomElementReactionStack::CustomElementReactionStack):
(WebCore::CustomElementReactionStack::~CustomElementReactionStack):

LayoutTests:

Unskipped the previously crashing test.

* TestExpectations:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsTestExpectations">trunk/LayoutTests/TestExpectations</a></li>
<li><a href="#trunkLayoutTestsimportedw3cChangeLog">trunk/LayoutTests/imported/w3c/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSMainThreadExecStateh">trunk/Source/WebCore/bindings/js/JSMainThreadExecState.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionsStringifiercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp</a></li>
<li><a href="#trunkSourceWebCoredomCustomElementReactionQueuecpp">trunk/Source/WebCore/dom/CustomElementReactionQueue.cpp</a></li>
<li><a href="#trunkSourceWebCoredomCustomElementReactionQueueh">trunk/Source/WebCore/dom/CustomElementReactionQueue.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestscustomelementsreactionswithexceptionsexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/custom-elements/reactions/with-exceptions-expected.txt</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (234538 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog      2018-08-03 05:24:07 UTC (rev 234538)
+++ trunk/LayoutTests/ChangeLog 2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2018-08-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Release assert when throwing exceptions in custom element reactions
+        https://bugs.webkit.org/show_bug.cgi?id=187805
+        <rdar://problem/42432714>
+
+        Reviewed by Saam Barati.
+
+        Unskipped the previously crashing test.
+
+        * TestExpectations:
+
</ins><span class="cx"> 2018-08-02  Basuke Suzuki  <Basuke.Suzuki@sony.com>
</span><span class="cx"> 
</span><span class="cx">         [Curl] Test gardening
</span></span></pre></div>
<a id="trunkLayoutTestsTestExpectations"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/TestExpectations (234538 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/TestExpectations       2018-08-03 05:24:07 UTC (rev 234538)
+++ trunk/LayoutTests/TestExpectations  2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -571,7 +571,6 @@
</span><span class="cx"> # WPT tests for custom elements
</span><span class="cx"> webkit.org/b/187800 imported/w3c/web-platform-tests/custom-elements/Document-createElement-svg.svg [ Skip ]
</span><span class="cx"> webkit.org/b/187802 imported/w3c/web-platform-tests/custom-elements/parser/parser-uses-create-an-element-for-a-token-svg.svg [ Skip ]
</span><del>-webkit.org/b/187805 imported/w3c/web-platform-tests/custom-elements/reactions/with-exceptions.html [ Skip ]
</del><span class="cx"> 
</span><span class="cx"> # selectors
</span><span class="cx"> webkit.org/b/64861 imported/w3c/web-platform-tests/css/selectors/selectors-dir-selector-ltr-001.html [ ImageOnlyFailure ]
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/imported/w3c/ChangeLog (234538 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/ChangeLog 2018-08-03 05:24:07 UTC (rev 234538)
+++ trunk/LayoutTests/imported/w3c/ChangeLog    2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2018-08-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Release assert when throwing exceptions in custom element reactions
+        https://bugs.webkit.org/show_bug.cgi?id=187805
+        <rdar://problem/42432714>
+
+        Reviewed by Saam Barati.
+
+        Generated the expected result.
+
+        * web-platform-tests/custom-elements/reactions/with-exceptions-expected.txt: Added.
+
</ins><span class="cx"> 2018-08-01  Ryosuke Niwa  <rniwa@webkit.org>
</span><span class="cx"> 
</span><span class="cx">         Implement customElements.upgrade()
</span></span></pre></div>
<a id="trunkLayoutTestsimportedw3cwebplatformtestscustomelementsreactionswithexceptionsexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/imported/w3c/web-platform-tests/custom-elements/reactions/with-exceptions-expected.txt (0 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/imported/w3c/web-platform-tests/custom-elements/reactions/with-exceptions-expected.txt                         (rev 0)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/custom-elements/reactions/with-exceptions-expected.txt    2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -0,0 +1,3 @@
</span><ins>+
+PASS Reaction must run even after the exception is thrown 
+
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (234538 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog   2018-08-03 05:24:07 UTC (rev 234538)
+++ trunk/Source/WebCore/ChangeLog      2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -1,3 +1,44 @@
</span><ins>+2018-08-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Release assert when throwing exceptions in custom element reactions
+        https://bugs.webkit.org/show_bug.cgi?id=187805
+        <rdar://problem/42432714>
+
+        Reviewed by Saam Barati.
+
+        The release assertion was hit because we were not catching & re-throwing the exception thrown by DOM API
+        before trying to execute custom elements reactions in ~CustomElementReactionStack as specified here:
+        https://html.spec.whatwg.org/multipage/custom-elements.html#cereactions
+        Fixed the bug by capturing the exception and re-throwing the exception as specified.
+
+        Tests: imported/w3c/web-platform-tests/custom-elements/reactions/with-exceptions.html
+
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore::JSMainThreadNullState::JSMainThreadNullState): Use the previous JS state.
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GeneratePut): Pass in the exec state to CustomElementReactionStack.
+        (GeneratePutByIndex): Ditto.
+        (GenerateDefineOwnProperty): Ditto.
+        (GenerateDeletePropertyCommon): Ditto.
+        (GenerateAttributeSetterBodyDefinition): Ditto.
+        (GenerateOperationBodyDefinition): Ditto.
+        * bindings/scripts/test/JS/JSTestCEReactions.cpp:
+        (WebCore::setJSTestCEReactionsAttributeWithCEReactionsSetter):
+        (WebCore::setJSTestCEReactionsReflectAttributeWithCEReactionsSetter):
+        (WebCore::jsTestCEReactionsPrototypeFunctionMethodWithCEReactionsBody):
+        * bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:
+        (WebCore::setJSTestCEReactionsStringifierValueSetter):
+        * dom/CustomElementReactionQueue.cpp:
+        (WebCore::CustomElementReactionQueue::ElementQueue::processQueue): Added. If there is a script running
+        in the stack (i.e. ExecState is not null), catch any exception before executing custom element reactions,
+        then re-throw the exception afterwards. ExecState is null when DOM API is invoked via Objective-C bindings
+        or when custom element reactions are executed in the backup queue (e.g. for editing operations).
+        (WebCore::CustomElementReactionStack::processQueue):
+        (WebCore::CustomElementReactionQueue::processBackupQueue):
+        * dom/CustomElementReactionQueue.h:
+        (WebCore::CustomElementReactionStack::CustomElementReactionStack):
+        (WebCore::CustomElementReactionStack::~CustomElementReactionStack):
+
</ins><span class="cx"> 2018-08-02  Zalan Bujtas  <zalan@apple.com>
</span><span class="cx"> 
</span><span class="cx">         [LFC][BFC] Apply the "10.6.6 Complicated cases" when computing height and margin for the document renderer
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSMainThreadExecStateh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSMainThreadExecState.h (234538 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSMainThreadExecState.h 2018-08-03 05:24:07 UTC (rev 234538)
+++ trunk/Source/WebCore/bindings/js/JSMainThreadExecState.h    2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -161,6 +161,7 @@
</span><span class="cx"> public:
</span><span class="cx">     explicit JSMainThreadNullState()
</span><span class="cx">         : m_previousState(JSMainThreadExecState::s_mainThreadState)
</span><ins>+        , m_customElementReactionStack(m_previousState)
</ins><span class="cx">     {
</span><span class="cx">         ASSERT(isMainThread());
</span><span class="cx">         JSMainThreadExecState::s_mainThreadState = nullptr;
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (234538 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2018-08-03 05:24:07 UTC (rev 234538)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm    2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -932,7 +932,7 @@
</span><span class="cx">     push(@$outputArray, "    ASSERT_GC_OBJECT_INHERITS(thisObject, info());\n\n");
</span><span class="cx">     
</span><span class="cx">     if (($namedSetterOperation && $namedSetterOperation->extendedAttributes->{CEReactions}) || ($indexedSetterOperation && $indexedSetterOperation->extendedAttributes->{CEReactions})) {
</span><del>-        push(@$outputArray, "    CustomElementReactionStack customElementReactionStack;\n\n");
</del><ins>+        push(@$outputArray, "    CustomElementReactionStack customElementReactionStack(*state);\n\n");
</ins><span class="cx">         AddToImplIncludes("CustomElementReactionQueue.h");
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -1004,7 +1004,7 @@
</span><span class="cx">     push(@$outputArray, "    ASSERT_GC_OBJECT_INHERITS(thisObject, info());\n\n");
</span><span class="cx">     
</span><span class="cx">     if (($namedSetterOperation && $namedSetterOperation->extendedAttributes->{CEReactions}) || ($indexedSetterOperation && $indexedSetterOperation->extendedAttributes->{CEReactions})) {
</span><del>-        push(@$outputArray, "    CustomElementReactionStack customElementReactionStack;\n\n");
</del><ins>+        push(@$outputArray, "    CustomElementReactionStack customElementReactionStack(*state);\n\n");
</ins><span class="cx">         AddToImplIncludes("CustomElementReactionQueue.h");
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -1100,7 +1100,7 @@
</span><span class="cx">     push(@$outputArray, "    ASSERT_GC_OBJECT_INHERITS(thisObject, info());\n\n");
</span><span class="cx">     
</span><span class="cx">     if (($namedSetterOperation && $namedSetterOperation->extendedAttributes->{CEReactions}) || ($indexedSetterOperation && $indexedSetterOperation->extendedAttributes->{CEReactions})) {
</span><del>-        push(@$outputArray, "    CustomElementReactionStack customElementReactionStack;\n\n");
</del><ins>+        push(@$outputArray, "    CustomElementReactionStack customElementReactionStack(*state);\n\n");
</ins><span class="cx">         AddToImplIncludes("CustomElementReactionQueue.h");
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -1224,7 +1224,7 @@
</span><span class="cx">     push(@$outputArray, "    if (isVisibleNamedProperty<${overrideBuiltin}>(*state, thisObject, propertyName)) {\n");
</span><span class="cx"> 
</span><span class="cx">     if ($operation->extendedAttributes->{CEReactions}) {
</span><del>-        push(@$outputArray, "        CustomElementReactionStack customElementReactionStack;\n");
</del><ins>+        push(@$outputArray, "        CustomElementReactionStack customElementReactionStack(*state);\n");
</ins><span class="cx">         AddToImplIncludes("CustomElementReactionQueue.h", $conditional);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -4844,7 +4844,7 @@
</span><span class="cx">     push(@$outputArray, "    UNUSED_PARAM(throwScope);\n");
</span><span class="cx">     
</span><span class="cx">     if ($attribute->extendedAttributes->{CEReactions}) {
</span><del>-        push(@$outputArray, "    CustomElementReactionStack customElementReactionStack;\n");
</del><ins>+        push(@$outputArray, "    CustomElementReactionStack customElementReactionStack(state);\n");
</ins><span class="cx">         AddToImplIncludes("CustomElementReactionQueue.h", $conditional);
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -5070,7 +5070,7 @@
</span><span class="cx">     if (!$generatingOverloadDispatcher) {
</span><span class="cx">         if ($operation->extendedAttributes->{CEReactions}) {
</span><span class="cx">             AddToImplIncludes("CustomElementReactionQueue.h", $conditional);
</span><del>-            push(@$outputArray, "    CustomElementReactionStack customElementReactionStack;\n");
</del><ins>+            push(@$outputArray, "    CustomElementReactionStack customElementReactionStack(*state);\n");
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         if ($interface->extendedAttributes->{CheckSecurity} and !$operation->extendedAttributes->{DoNotCheckSecurity}) {
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp (234538 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp      2018-08-03 05:24:07 UTC (rev 234538)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp 2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -203,7 +203,7 @@
</span><span class="cx"> static inline bool setJSTestCEReactionsAttributeWithCEReactionsSetter(ExecState& state, JSTestCEReactions& thisObject, JSValue value, ThrowScope& throwScope)
</span><span class="cx"> {
</span><span class="cx">     UNUSED_PARAM(throwScope);
</span><del>-    CustomElementReactionStack customElementReactionStack;
</del><ins>+    CustomElementReactionStack customElementReactionStack(state);
</ins><span class="cx">     auto& impl = thisObject.wrapped();
</span><span class="cx">     auto nativeValue = convert<IDLDOMString>(state, value);
</span><span class="cx">     RETURN_IF_EXCEPTION(throwScope, false);
</span><span class="lines">@@ -235,7 +235,7 @@
</span><span class="cx"> static inline bool setJSTestCEReactionsReflectAttributeWithCEReactionsSetter(ExecState& state, JSTestCEReactions& thisObject, JSValue value, ThrowScope& throwScope)
</span><span class="cx"> {
</span><span class="cx">     UNUSED_PARAM(throwScope);
</span><del>-    CustomElementReactionStack customElementReactionStack;
</del><ins>+    CustomElementReactionStack customElementReactionStack(state);
</ins><span class="cx">     auto& impl = thisObject.wrapped();
</span><span class="cx">     auto nativeValue = convert<IDLDOMString>(state, value);
</span><span class="cx">     RETURN_IF_EXCEPTION(throwScope, false);
</span><span class="lines">@@ -290,7 +290,7 @@
</span><span class="cx"> {
</span><span class="cx">     UNUSED_PARAM(state);
</span><span class="cx">     UNUSED_PARAM(throwScope);
</span><del>-    CustomElementReactionStack customElementReactionStack;
</del><ins>+    CustomElementReactionStack customElementReactionStack(*state);
</ins><span class="cx">     auto& impl = castedThis->wrapped();
</span><span class="cx">     impl.methodWithCEReactions();
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCEReactionsStringifiercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp (234538 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp   2018-08-03 05:24:07 UTC (rev 234538)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp      2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -193,7 +193,7 @@
</span><span class="cx"> static inline bool setJSTestCEReactionsStringifierValueSetter(ExecState& state, JSTestCEReactionsStringifier& thisObject, JSValue value, ThrowScope& throwScope)
</span><span class="cx"> {
</span><span class="cx">     UNUSED_PARAM(throwScope);
</span><del>-    CustomElementReactionStack customElementReactionStack;
</del><ins>+    CustomElementReactionStack customElementReactionStack(state);
</ins><span class="cx">     auto& impl = thisObject.wrapped();
</span><span class="cx">     auto nativeValue = convert<IDLDOMString>(state, value);
</span><span class="cx">     RETURN_IF_EXCEPTION(throwScope, false);
</span></span></pre></div>
<a id="trunkSourceWebCoredomCustomElementReactionQueuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/CustomElementReactionQueue.cpp (234538 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/CustomElementReactionQueue.cpp  2018-08-03 05:24:07 UTC (rev 234538)
+++ trunk/Source/WebCore/dom/CustomElementReactionQueue.cpp     2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -34,6 +34,7 @@
</span><span class="cx"> #include "JSCustomElementInterface.h"
</span><span class="cx"> #include "JSDOMBinding.h"
</span><span class="cx"> #include "Microtasks.h"
</span><ins>+#include <JavaScriptCore/CatchScope.h>
</ins><span class="cx"> #include <JavaScriptCore/Heap.h>
</span><span class="cx"> #include <wtf/NeverDestroyed.h>
</span><span class="cx"> #include <wtf/Optional.h>
</span><span class="lines">@@ -231,6 +232,32 @@
</span><span class="cx">     RELEASE_ASSERT(m_elements.isEmpty());
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+inline void CustomElementReactionQueue::ElementQueue::processQueue(JSC::ExecState* state)
+{
+    if (!state) {
+        invokeAll();
+        return;
+    }
+
+    auto& vm = state->vm();
+    JSC::JSLockHolder lock(vm);
+
+    JSC::Exception* previousException = nullptr;
+    {
+        auto catchScope = DECLARE_CATCH_SCOPE(vm);
+        previousException = catchScope.exception();
+        if (previousException)
+            catchScope.clearException();
+    }
+
+    invokeAll();
+
+    if (previousException) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        throwException(state, throwScope, previousException);
+    }
+}
+
</ins><span class="cx"> CustomElementReactionQueue& CustomElementReactionQueue::ensureCurrentQueue(Element& element)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(element.reactionQueue());
</span><span class="lines">@@ -249,10 +276,10 @@
</span><span class="cx"> 
</span><span class="cx"> CustomElementReactionStack* CustomElementReactionStack::s_currentProcessingStack = nullptr;
</span><span class="cx"> 
</span><del>-void CustomElementReactionStack::processQueue()
</del><ins>+void CustomElementReactionStack::processQueue(JSC::ExecState* state)
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(m_queue);
</span><del>-    m_queue->invokeAll();
</del><ins>+    m_queue->processQueue(state);
</ins><span class="cx">     delete m_queue;
</span><span class="cx">     m_queue = nullptr;
</span><span class="cx"> }
</span><span class="lines">@@ -280,7 +307,7 @@
</span><span class="cx"> 
</span><span class="cx"> void CustomElementReactionQueue::processBackupQueue()
</span><span class="cx"> {
</span><del>-    backupElementQueue().invokeAll();
</del><ins>+    backupElementQueue().processQueue(nullptr);
</ins><span class="cx">     s_processingBackupElementQueue = false;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoredomCustomElementReactionQueueh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/dom/CustomElementReactionQueue.h (234538 => 234539)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/dom/CustomElementReactionQueue.h    2018-08-03 05:24:07 UTC (rev 234538)
+++ trunk/Source/WebCore/dom/CustomElementReactionQueue.h       2018-08-03 08:16:48 UTC (rev 234539)
</span><span class="lines">@@ -29,6 +29,12 @@
</span><span class="cx"> #include <wtf/Noncopyable.h>
</span><span class="cx"> #include <wtf/Vector.h>
</span><span class="cx"> 
</span><ins>+namespace JSC {
+
+class ExecState;
+
+}
+
</ins><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><span class="cx"> class CustomElementReactionQueueItem;
</span><span class="lines">@@ -60,9 +66,11 @@
</span><span class="cx">     class ElementQueue {
</span><span class="cx">     public:
</span><span class="cx">         void add(Element&);
</span><ins>+        void processQueue(JSC::ExecState*);
+
+    private:
</ins><span class="cx">         void invokeAll();
</span><del>-        
-    private:
</del><ins>+
</ins><span class="cx">         Vector<Ref<Element>> m_elements;
</span><span class="cx">         bool m_invoking { false };
</span><span class="cx">     };
</span><span class="lines">@@ -78,24 +86,30 @@
</span><span class="cx"> 
</span><span class="cx"> class CustomElementReactionStack {
</span><span class="cx"> public:
</span><del>-    CustomElementReactionStack()
</del><ins>+    ALWAYS_INLINE CustomElementReactionStack(JSC::ExecState* state)
</ins><span class="cx">         : m_previousProcessingStack(s_currentProcessingStack)
</span><ins>+        , m_state(state)
</ins><span class="cx">     {
</span><span class="cx">         s_currentProcessingStack = this;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    ~CustomElementReactionStack()
</del><ins>+    ALWAYS_INLINE CustomElementReactionStack(JSC::ExecState& state)
+        : CustomElementReactionStack(&state)
+    { }
+
+    ALWAYS_INLINE ~CustomElementReactionStack()
</ins><span class="cx">     {
</span><span class="cx">         if (UNLIKELY(m_queue))
</span><del>-            processQueue();
</del><ins>+            processQueue(m_state);
</ins><span class="cx">         s_currentProcessingStack = m_previousProcessingStack;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><del>-    WEBCORE_EXPORT void processQueue();
</del><ins>+    WEBCORE_EXPORT void processQueue(JSC::ExecState*);
</ins><span class="cx"> 
</span><span class="cx">     CustomElementReactionQueue::ElementQueue* m_queue { nullptr }; // Use raw pointer to avoid generating delete in the destructor.
</span><span class="cx">     CustomElementReactionStack* m_previousProcessingStack;
</span><ins>+    JSC::ExecState* m_state;
</ins><span class="cx"> 
</span><span class="cx">     WEBCORE_EXPORT static CustomElementReactionStack* s_currentProcessingStack;
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>