Bug 214854 - JSPromise::reject might throw more than an unterminated exception
Summary: JSPromise::reject might throw more than an unterminated exception
Alias: None
Product: WebKit
Classification: Unclassified
Component: Bindings (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
Keywords: InRadar
Depends on:
Reported: 2020-07-27 15:51 PDT by Saam Barati
Modified: 2020-07-29 11:50 PDT (History)
3 users (show)

See Also:

patch (5.12 KB, patch)
2020-07-27 17:22 PDT, Saam Barati
ysuzuki: review+
Details | Formatted Diff | Diff
patch for landing (5.55 KB, patch)
2020-07-28 09:27 PDT, Saam Barati
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2020-07-27 15:51:18 PDT
It calls a builtin, which, can stack overflow. Theoretically, can OOM too
Comment 1 Saam Barati 2020-07-27 17:15:27 PDT
Comment 2 Saam Barati 2020-07-27 17:22:51 PDT
Created attachment 405332 [details]
Comment 3 Yusuke Suzuki 2020-07-27 17:25:14 PDT
Comment on attachment 405332 [details]

r=me if EWS gets green.
Comment 4 Saam Barati 2020-07-28 09:27:20 PDT
Created attachment 405364 [details]
patch for landing
Comment 5 EWS 2020-07-28 09:52:50 PDT
Committed r264992: <https://trac.webkit.org/changeset/264992>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 405364 [details].