WebKit Bugzilla
New
Browse
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
RESOLVED FIXED
15878
JavaScriptCore calls toNumber w/o checking for an exception
https://bugs.webkit.org/show_bug.cgi?id=15878
Summary
JavaScriptCore calls toNumber w/o checking for an exception
Eric Seidel (no email)
Reported
2007-11-06 23:34:58 PST
JavaScriptCore calls toNumber w/o checking for an exception toNumber calls toPrimative, which calls .toString or .valueOf, both of which could be overriden to throw (or have other side effects. For example the following code should only show one alert, but I'm guessing (by code inspection) it shows 2 in webkit: var myObject = new Object; myObject.__proto__ = { valueOf: function() { alert("foo"); throw "foobar"; } } var bar = myObject + myObject; alert("Not reached."); (assuming I got my js right above...) I've not tested other browsers, so this is really a speculative bug.
Attachments
Add attachment
proposed patch, testcase, etc.
Eric Seidel (no email)
Comment 1
2007-11-07 00:11:02 PST
Ha! Funny, right after I filed this, I wrote up
bug 15879
which actually fixes this issue partially (at least for MultNode. :)
Eric Seidel (no email)
Comment 2
2007-11-08 00:22:58 PST
A bunch of this just got fixed when
bug 15879
landed as
r27589
. I'm certain there are still examples of this which can be seen using some js.
Oliver Hunt
Comment 3
2008-06-28 03:52:13 PDT
I am aware of no cases where we don't do the correctly (and i made some fairly large and chunky tests for these types of things for squirrelfish)
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug