REGRESSION (r258049): Unchecked JS exception in jsc::Stringifier::toJSON

[Ryan Haddad]

After https://trac.webkit.org/changeset/258049/webkit, the debug JSC bit has 44 test failures due to an unchecked JS exception:

microbenchmarks/json-stringify-many-objects-to-json.js.default: ERROR: Unchecked JS exception:
microbenchmarks/json-stringify-many-objects-to-json.js.default:     This scope can throw a JS exception: executeCall @ ./interpreter/Interpreter.cpp:858
microbenchmarks/json-stringify-many-objects-to-json.js.default:         (ExceptionScope::m_recursionDepth was 10)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     But the exception was unchecked as of this scope: toJSON @ ./runtime/JSONObject.cpp:301
microbenchmarks/json-stringify-many-objects-to-json.js.default:         (ExceptionScope::m_recursionDepth was 9)
microbenchmarks/json-stringify-many-objects-to-json.js.default: 
microbenchmarks/json-stringify-many-objects-to-json.js.default: Unchecked exception detected at:
microbenchmarks/json-stringify-many-objects-to-json.js.default:     1   0x10b9c30ae JSC::VM::verifyExceptionCheckNeedIsSatisfied(unsigned int, JSC::ExceptionEventLocation&)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     2   0x10b99beed JSC::ThrowScope::~ThrowScope()
microbenchmarks/json-stringify-many-objects-to-json.js.default:     3   0x10b99c0f5 JSC::ThrowScope::~ThrowScope()
microbenchmarks/json-stringify-many-objects-to-json.js.default:     4   0x10b80713c JSC::Stringifier::toJSON(JSC::JSValue, JSC::PropertyNameForFunctionCall const&)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     5   0x10b8063b9 JSC::Stringifier::appendStringifiedValue(WTF::StringBuilder&, JSC::JSValue, JSC::Stringifier::Holder const&, JSC::PropertyNameForFunctionCall const&)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     6   0x10b807efa JSC::Stringifier::Holder::appendNextProperty(JSC::Stringifier&, WTF::StringBuilder&)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     7   0x10b806cd5 JSC::Stringifier::appendStringifiedValue(WTF::StringBuilder&, JSC::JSValue, JSC::Stringifier::Holder const&, JSC::PropertyNameForFunctionCall const&)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     8   0x10b80608c JSC::Stringifier::stringify(JSC::JSValue)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     9   0x10b80b568 JSC::JSONProtoFuncStringify(JSC::JSGlobalObject*, JSC::CallFrame*)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     10  0x547503e01178
microbenchmarks/json-stringify-many-objects-to-json.js.default:     11  0x10a4faeb3 llint_entry
microbenchmarks/json-stringify-many-objects-to-json.js.default:     12  0x10a4dda93 vmEntryToJavaScript
microbenchmarks/json-stringify-many-objects-to-json.js.default:     13  0x10b2ecf57 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     14  0x10b2ec5ac JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     15  0x10b671edc JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     16  0x109eade4f runWithOptions(GlobalObject*, CommandLine&, bool&)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     17  0x109e7f19a jscmain(int, char**)::$_6::operator()(JSC::VM&, GlobalObject*, bool&) const
microbenchmarks/json-stringify-many-objects-to-json.js.default:     18  0x109e5997b int runJSC<jscmain(int, char**)::$_6>(CommandLine const&, bool, jscmain(int, char**)::$_6 const&)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     19  0x109e58408 jscmain(int, char**)
microbenchmarks/json-stringify-many-objects-to-json.js.default:     20  0x109e581de main
microbenchmarks/json-stringify-many-objects-to-json.js.default:     21  0x7fff719c87fd start

https://build.webkit.org/builders/Apple-Catalina-Debug-JSC-Tests/builds/453

[Alexey Shvayka]

Created attachment 392867 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 392867 [details]
Patch

r=me, nice fix!

[Ross Kirsling]

Thanks for addressing this so quickly, Alexey!

[Alexey Shvayka]

Thank you, folks.
I thought this kind of errors would have been caught by regular EWS.
Anyway, I will test future patches with JSC_validateExceptionChecks=true.

[WebKit Commit Bot]

Comment on attachment 392867 [details]
Patch

Clearing flags on attachment: 392867

Committed r258081: <https://trac.webkit.org/changeset/258081>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/60192817>