Bug 53596 – [v8] Properly process exceptions thrown while converting objects to string in HTMLDocument.write{,ln} methods

• Status: RESOLVED
• Resolution: INVALID
• Component: WebCore Misc.

[anton muhin]

[v8] Properly process exceptions thrown while converting objects to string in HTMLDocument.write{,ln} methods

[anton muhin]

This is a fix for 1st crash in http://code.google.com/p/chromium/issues/detail?id=71544

I am going to eventually nuke all unsafe uses of v8ValueToWebCoreString, but it require several patches )I think).

I am going to make PSA asking v8 bindings hacking people do not use v8ValueToWebCoreString and friends.

[anton muhin]

Created attachment 80920 [details]
Patch

[anton muhin]

Comment on attachment 80920 [details]
Patch

Pending on https://bugs.webkit.org/show_bug.cgi?id=53601

[David Levin]

(In reply to comment #1)
> This is a fix for 1st crash in http://code.google.com/p/chromium/issues/detail?id=71544
> 
> I am going to eventually nuke all unsafe uses of v8ValueToWebCoreString, but it require several patches )I think).
> 
> I am going to make PSA asking v8 bindings hacking people do not use v8ValueToWebCoreString and friends.

fwiw, you could write a check in the style checker to catch this automatically (source at Tools/Scripts/webkitpy/style/checkers/cpp.py).

[anton muhin]

(In reply to comment #4)
> (In reply to comment #1)
> > This is a fix for 1st crash in http://code.google.com/p/chromium/issues/detail?id=71544
> > 
> > I am going to eventually nuke all unsafe uses of v8ValueToWebCoreString, but it require several patches )I think).
> > 
> > I am going to make PSA asking v8 bindings hacking people do not use v8ValueToWebCoreString and friends.
> 
> fwiw, you could write a check in the style checker to catch this automatically (source at Tools/Scripts/webkitpy/style/checkers/cpp.py).

Very nice idea, David, thanks a lot.  I'll do it if we decide to deprecate this behaviour.

[Alexey Proskuryakov]

Is this problem unique to v8, or does it also affect JSC?

[Adam Barth]

(In reply to comment #6)
> Is this problem unique to v8, or does it also affect JSC?

Presumably if the tests pass in JSC, it's not a problem in JSC.

[anton muhin]

This patch solves the issue with HTMLDocument::write and writeln not exiting quickly when first argument throwing an exception is met.  So it's a solution for Chromium for https://bugs.webkit.org/show_bug.cgi?id=53601.

And no, tests do not pass under Safari, again, see https://bugs.webkit.org/show_bug.cgi?id=53601

(In reply to comment #6)
> Is this problem unique to v8, or does it also affect JSC?

[Alexey Proskuryakov]

I believe that we normally want bug to bug compatibility for such things, when possible.

[anton muhin]

(In reply to comment #9)
> I believe that we normally want bug to bug compatibility for such things, when possible.

That's precisely why I removed r? and marked this bug as blocked by https://bugs.webkit.org/show_bug.cgi?id=53601 :)

[Anders Carlsson]

V8 is gone.