115087 2013-04-23 22:16:03 -0700 Web Inspector: WebCore::reportException should not evaluate JavaScript handling exceptions 2016-12-13 15:40:29 -0800 1 1 1 Unclassified WebKit Web Inspector 528+ (Nightly build) All All NEW InRadar P2 Normal --- 1 joepeck chris_curtis chris_curtis ggaren inspector-bugzilla-changes webkit-bug-importer oldest_to_newest 880324 0 joepeck 2013-04-23 22:16:03 -0700 Currently WebCore::reportException can evaluate JavaScript when handling exceptions. The JS evaluation can itself throw an exception if running code in the page. For example: function MyError() { this.name = "MyErrorName"; this.message = "MyErrorMessage"; } MyError.prototype.toString = function() { throw "oops"; } function produceError() { throw new MyError(); } produceError(); WebCore::reportException call's this toString, and can potentially get values with hooks in valueOf as well. We should avoid running JS that can trigger its own exceptions if possible. 909009 1 ggaren 2013-07-16 14:05:01 -0700 Chris is working on similar bugs in JSC, so reassigning to him. 966632 2 timothy 2014-01-10 15:37:13 -0800 Moving to the right component. 966646 3 webkit-bug-importer 2014-01-10 15:37:41 -0800 <rdar://problem/15796841> 982543 4 joepeck 2014-02-19 14:20:02 -0800 Oliver had a suggestion on IRC: - if the exception object is a builtin Exception/Error object => directly get "message" property - if the exception object is a primitive => toString - otherwise, send the exception object to the inspector frontend like a console.log (RemoteObject) I think that is a good idea. This would nicely handle these cases: - SyntaxError / ReferenceError - throw 1, throw "test", ... - throw {a:1,b:2}, throw [1,2,3], throw new MyError()