Bug 182631 – [Payment Request] Crash in PaymentRequest::canMakePayment() when Apple Pay payment method data is missing required fields

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Andy Estes]

[Payment Request] Crash in PaymentRequest::canMakePayment() when Apple Pay payment method data is missing required fields

[Andy Estes]

Created attachment 333435 [details]
Patch

[Mark Lam]

Comment on attachment 333435 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=333435&action=review

r=me with suggestions.

> Source/WebCore/ChangeLog:16
> +        release assertion is raised about there being an unexpected exception in the VM.

I suggest /being/seeing/.

> Source/WebCore/Modules/paymentrequest/PaymentRequest.cpp:493
> +        auto scope = DECLARE_CATCH_SCOPE(document.execState()->vm());

Is there a reason to put the CatchScope in here instead of at the top of the function?  As a convention, the only time we should declare it in this local scope is if there are parts of this function outside of this scope that can throw exceptions.  Is that true?  If not, I suggest moving this declaration to the top of the function.

[Andy Estes]

(In reply to Mark Lam from comment #2)
> Comment on attachment 333435 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=333435&action=review
> 
> Is there a reason to put the CatchScope in here instead of at the top of the
> function?  As a convention, the only time we should declare it in this local
> scope is if there are parts of this function outside of this scope that can
> throw exceptions.  Is that true?  If not, I suggest moving this declaration
> to the top of the function.

I was just being conservative. I wasn't sure if it was ok to call clearException() more than once on the same CatchScope. Now that I look more closely, I see that clearException() just calls through to the VM, so this must be ok. I'll move the scope outside the loop.

Thanks for reviewing!

[Andy Estes]

(And no, nothing outside the loop throws)

[Andy Estes]

Created attachment 333497 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 333497 [details]
Patch

Clearing flags on attachment: 333497

Committed r228331: <https://trac.webkit.org/changeset/228331>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/37398029>