Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6ea1f0a2bf517e6e086f8b9e28a6f52e003c07d0
https://github.com/WebKit/WebKit/commit/6ea1f0a2bf517e6e086f8b9e28a6f52e003c07d0
Author: Chris Dumez <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A
LayoutTests/navigation-api/navigation-navigate-throwing-argument-conversion-expected.txt
A
LayoutTests/navigation-api/navigation-navigate-throwing-argument-conversion.html
M Source/WebCore/bindings/js/JSDOMOperationReturningPromise.h
M Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp
M Source/WebCore/bindings/js/JSDOMPromiseDeferred.h
M Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
M Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
Log Message:
-----------
[WebCore][bindings] Empty JSValue returned to script from
callPromisePairFunction when argument conversion throws
https://bugs.webkit.org/show_bug.cgi?id=313618
rdar://175673155
Reviewed by Ryosuke Niwa.
callPromisePairFunction stored the functor's EncodedJSValue and returned it
after passing the catch scope through rejectPromiseWithExceptionIfAny. When the
generated operation body threw during IDL argument conversion, it returned
encodedJSValue() (the empty JSValue sentinel) with a pending exception. The
first rejectPromiseWithExceptionIfAny call cleared that exception to reject the
first promise, so the second call was a no-op — leaving the second promise
unrejected — and RETURN_IF_EXCEPTION did not fire. The empty sentinel was then
returned to JavaScript as a script-visible value.
Fix by:
- Introducing rejectPromisesWithExceptionIfAny, which saves the error value
before clearing the exception and rejects both promises. Shared
takeNonTerminationException helper factors out the check-save-clear logic
from rejectPromiseWithExceptionIfAny.
- Adding a DictionaryType template parameter to callPromisePairFunction. When
the functor returns an empty JSValue (the error-path sentinel),
callPromisePairFunction reconstructs a valid result dictionary from the
rejected promises via convertDictionaryToJS.
- Threading the concrete dictionary type (e.g. Navigation::Result) from the
code generator through callReturningPromisePair to callPromisePairFunction.
Test: navigation-api/navigation-navigate-throwing-argument-conversion.html
*
LayoutTests/navigation-api/navigation-navigate-throwing-argument-conversion-expected.txt:
Added.
*
LayoutTests/navigation-api/navigation-navigate-throwing-argument-conversion.html:
Added.
* Source/WebCore/bindings/js/JSDOMOperationReturningPromise.h:
(WebCore::IDLOperationReturningPromise::callReturningPromisePair):
* Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp:
(WebCore::takeNonTerminationException):
(WebCore::rejectPromiseWithExceptionIfAny):
(WebCore::rejectPromisesWithExceptionIfAny):
* Source/WebCore/bindings/js/JSDOMPromiseDeferred.h:
(WebCore::callPromisePairFunction):
* Source/WebCore/bindings/scripts/CodeGeneratorJS.pm:
(GenerateOperationTrampolineDefinition):
* Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::JSC_DEFINE_HOST_FUNCTION):
Originally-landed-as: 305413.776@safari-7624-branch (332eff8c4870).
rdar://180436895
Canonical link: https://commits.webkit.org/316150@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
