Fix crash in d8 when external array ctor hits stack overflow

src/d8.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 278 matching lines @@
          element_size == 8);
   if (args.Length() != 1) {
     return ThrowException(
         String::New("Array constructor needs one parameter."));
   }
   static const int kMaxLength = 0x3fffffff;
 #ifndef V8_SHARED
   ASSERT(kMaxLength == i::ExternalArray::kMaxLength);
 #endif  // V8_SHARED
   size_t length = 0;
   if (args[0]->IsUint32()) {

[Rico, 2011/12/13 11:28:39]

Below: How about just having a local TryCatch? The functionality in isolate.cc
should throw to the TryCatch nearest to the top of the stack

[Jakob Kummerow, 2011/12/13 13:04:37]

Done.

     length = args[0]->Uint32Value();
   } else {
     Local<Number> number = args[0]->ToNumber();
     if (number.IsEmpty() || !number->IsNumber()) {
+      i::Isolate* isolate = i::Isolate::Current();
+      if (isolate->try_catch_handler()->HasCaught()) {
+        return isolate->try_catch_handler()->Exception();
+      }
       return ThrowException(String::New("Array length must be a number."));
     }
-    int32_t raw_length = number->ToInt32()->Int32Value();
+    Local<Int32> int32 = number->ToInt32();
+    if (int32.IsEmpty()) {
+      i::Isolate* isolate = i::Isolate::Current();
+      if (isolate->try_catch_handler()->HasCaught()) {
+        return isolate->try_catch_handler()->Exception();
+      }
+      return ThrowException(String::New("Array length must be a number."));

[Rico, 2011/12/13 11:28:39]

we already established that length is a number, so this exception seems wrong.
Can we ever end up here?

[Jakob Kummerow, 2011/12/13 13:04:37]

On second thought, no, we can't. Done.

+    }
+    int32_t raw_length = int32->Int32Value();
     if (raw_length < 0) {
+      i::Isolate* isolate = i::Isolate::Current();
+      if (isolate->try_catch_handler()->HasCaught()) {
+        return isolate->try_catch_handler()->Exception();
+      }
       return ThrowException(String::New("Array length must not be negative."));
     }
     if (raw_length > static_cast<int32_t>(kMaxLength)) {
       return ThrowException(
           String::New("Array length exceeds maximum length."));
     }
     length = static_cast<size_t>(raw_length);
   }
   if (length > static_cast<size_t>(kMaxLength)) {
     return ThrowException(String::New("Array length exceeds maximum length."));
@@ skipping 1063 matching lines @@
 }
 
 }  // namespace v8
 
 
 #ifndef GOOGLE3
 int main(int argc, char* argv[]) {
   return v8::Shell::Main(argc, argv);
 }
 #endif