Bug 169778 – import(arg) crashes when ToString(arg) throws

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Sathya Gunasekaran]

Test case:

let x = { get toString() { throw new Error('wat'); } };
import(x);

Expected result :
a new rejected promise is created

Actual result :
Safari crashes and reloads the page

[Yusuke Suzuki]

This is the same issue with https://bugs.webkit.org/show_bug.cgi?id=167585.
We should not reject promises with Exception.

[Yusuke Suzuki]

Created attachment 304893 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 304893 [details]
Patch

r=me

[Yusuke Suzuki]

(In reply to comment #3)
> Comment on attachment 304893 [details]
> Patch
> 
> r=me

oops, i've put incorrect words from my phone.

[WebKit Commit Bot]

Comment on attachment 304893 [details]
Patch

Clearing flags on attachment: 304893

Committed r214143: <http://trac.webkit.org/changeset/214143>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Saam Barati]

Is it always wrong to reject a promise with Excetion*?
If so, we've made this mistake twice. Can we add a variant like
reject(Exception*) = delete;
Or
Make reject(Exception*) do the right thing by grabbing the value

[Mark Lam]

(In reply to comment #7)
> Is it always wrong to reject a promise with Excetion*?
> If so, we've made this mistake twice. Can we add a variant like
> reject(Exception*) = delete;
> Or
> Make reject(Exception*) do the right thing by grabbing the value

Either that, or have reject(Exception*) do the unwrapping automatically.

[Yusuke Suzuki]

Opened. https://bugs.webkit.org/show_bug.cgi?id=169908
I think adding reject(ExecState*, Exception*) interface is better since we have similar interface in WebCore::DOMPromise.