[Webkit-unassigned] [Bug 215357] New: ScriptExecutable::newCodeBlockFor() neglected to set the exception pointer result in one case.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=215357

            Bug ID: 215357
           Summary: ScriptExecutable::newCodeBlockFor() neglected to set
                    the exception pointer result in one case.
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.lam at apple.com

At the bottom of ScriptExecutable::newCodeBlockFor(), it calls:
    RELEASE_AND_RETURN(throwScope, FunctionCodeBlock::create(vm, executable, unlinkedCodeBlock, scope));

However, ScriptExecutable::newCodeBlockFor() has 2 return values: a CodeBlock*, and a passed in Exception*& that needs to be set if there's an exception.  FunctionCodeBlock::create() is capable of returning a null CodeBlock* because CodeBlock::finishCreation() can throw exceptions.  As a result, we have a scenario here where ScriptExecutable::newCodeBlockFor() can return a null CodeBlock* without setting the Exception*& result.

Consequently, Interpreter::executeCall() is relying on this and can end up crashing while dereferencing a null CodeBlock* because the exception result was not set.

We can fix this in 1 of 2 ways:
1. Fix ScriptExecutable::newCodeBlockFor() to set the exception result.
2. Get rid of having to set the exception result, and use throwScope.exception() as the canonical method of checking for exceptions.

I'm going to try to apply solution 2 if it doesn't introduce an unreasonable amount of code change.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200811/8a51bd93/attachment.htm>