Bug 20093 – JSC shell does not clear exceptions after it executes toString on an expression

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Oliver Hunt]

The JSC shell doesn't check for toString on the result of an expression throwing, so it will eventually result in incorrect behaviour in some cases.

Trivial reproduction:
1. Start jsc
2. enter eval({toString:function(){throw{};}});
3. goto 2

[Alexey Proskuryakov]

*** Bug 20094 has been marked as a duplicate of this bug. ***

[Cameron Zwarich (cpst)]

I can fix this by checking the completion type, but for your example the completion type is Normal, not Throw, even though there is an exception on the global object's ExecState. This would appear to be a separate bug, so I'll file it.

[Cameron Zwarich (cpst)]

Created attachment 22967 [details]
Fix that exposes problem with exceptions and eval

Here is my proposed fix. The assertions about exceptions on the global ExecState currently fail on Oliver's example.

[Cameron Zwarich (cpst)]

The problem isn't with eval, it is that an exception is thrown while printing the value. A similar issue occurs with the inspector. We should decide what to do in both cases.

[Cameron Zwarich (cpst)]

Created attachment 22970 [details]
Proposed patch

Here's a fix. It doesn't make the user aware of any exceptions that occurred while printing the final value, but we should deal with that problem later, together with the solution for the inspector.

[Cameron Zwarich (cpst)]

Created attachment 22971 [details]
Proposed patch (with better ChangeLog)

I forgot to mention something in the ChangeLog.

[Cameron Zwarich (cpst)]

Committed r35911.