[Promise] Avoid crash in stack exhausted circumstance.

Source/bindings/v8/custom/V8PromiseCustom.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 13 matching lines @@
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "bindings/v8/custom/V8PromiseCustom.h"
 
-#include <v8.h>
 #include "V8Promise.h"
 #include "bindings/v8/DOMRequestState.h"
 #include "bindings/v8/ScopedPersistent.h"
 #include "bindings/v8/ScriptFunctionCall.h"
 #include "bindings/v8/ScriptState.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8PerIsolateData.h"
 #include "bindings/v8/V8ScriptRunner.h"
 #include "bindings/v8/WrapperTypeInfo.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExecutionContextTask.h"
 #include "core/frame/DOMWindow.h"
 #include "core/frame/UseCounter.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/workers/WorkerGlobalScope.h"
 #include "platform/Task.h"
 #include "wtf/Deque.h"
 #include "wtf/Functional.h"
 #include "wtf/Noncopyable.h"
 #include "wtf/PassOwnPtr.h"
+#include <v8.h>
 
 namespace WebCore {
 
 namespace {
 
 v8::Local<v8::ObjectTemplate> cachedObjectTemplate(void* domTemplateKey, int internalFieldCount, v8::Isolate* isolate)
 {
     V8PerIsolateData* data = V8PerIsolateData::from(isolate);
     WrapperWorldType currentWorldType = worldType(isolate);
     v8::Handle<v8::FunctionTemplate> functionDescriptor = data->existingDOMTemplate(currentWorldType, domTemplateKey);
@@ skipping 69 matching lines @@
         V8PromiseCustom::resolve(promise, results, isolate);
         return;
     }
     countdownWrapper->SetInternalField(V8PromiseCustom::PrimitiveWrapperPrimitiveIndex, v8::Integer::New(isolate, countdown->Value() - 1));
 }
 
 v8::Local<v8::Object> promiseAllEnvironment(v8::Handle<v8::Object> promise, v8::Handle<v8::Object> countdownWrapper, int index, v8::Handle<v8::Array> results, v8::Isolate* isolate)
 {
     v8::Local<v8::ObjectTemplate> objectTemplate = promiseAllEnvironmentObjectTemplate(isolate);
     v8::Local<v8::Object> environment = objectTemplate->NewInstance();
+    if (environment.IsEmpty())
+        return v8::Local<v8::Object>();
 
     environment->SetInternalField(V8PromiseCustom::PromiseAllEnvironmentPromiseIndex, promise);
     environment->SetInternalField(V8PromiseCustom::PromiseAllEnvironmentCountdownIndex, countdownWrapper);
     environment->SetInternalField(V8PromiseCustom::PromiseAllEnvironmentIndexIndex, v8::Integer::New(isolate, index));
     environment->SetInternalField(V8PromiseCustom::PromiseAllEnvironmentResultsIndex, results);
     return environment;
 }
 
 // Clear |internal|'s derived array.
 void clearDerived(v8::Handle<v8::Object> internal, v8::Isolate* isolate)
@@ skipping 142 matching lines @@
     then = originatorValueObject->Get(v8AtomicString(isolate, "then"));
     if (then.IsEmpty()) {
         // If calling the [[Get]] internal method threw an exception, catch it and run updateDerivedFromReason.
         V8PromiseCustom::updateDerivedFromReason(m_promise.newLocal(isolate), m_onRejected.newLocal(isolate), trycatch.Exception(), isolate);
         return;
     }
 
     if (then->IsFunction()) {
         ASSERT(then->IsObject());
         v8::Local<v8::Object> coerced = V8PromiseCustom::coerceThenable(originatorValueObject, then.As<v8::Function>(), isolate);
+        // If the stack is exhausted coerced can be empty, but it is impossible
+        // because this function is executed on a fresh stack.
+        ASSERT(!coerced.IsEmpty());
         V8PromiseCustom::updateDerivedFromPromise(m_promise.newLocal(isolate), m_onFulfilled.newLocal(isolate), m_onRejected.newLocal(isolate), coerced, isolate);
         return;
     }
 
     V8PromiseCustom::updateDerivedFromValue(m_promise.newLocal(isolate), m_onFulfilled.newLocal(isolate), originatorValueObject, isolate);
 }
 
 // Since Promises state propagation routines are executed recursively, they cause
 // stack overflow.
 // (e.g. UpdateDerived -> UpdateDerivedFromValue -> SetValue ->
@@ skipping 168 matching lines @@
 {
     v8SetReturnValue(info, v8::Local<v8::Value>());
     v8::Isolate* isolate = info.GetIsolate();
     ExecutionContext* executionContext = callingExecutionContext(isolate);
     UseCounter::count(executionContext, UseCounter::PromiseConstructor);
     if (!info.Length() || !info[0]->IsFunction()) {
         throwTypeError("Promise constructor takes a function argument", isolate);
         return;
     }
     v8::Local<v8::Function> init = info[0].As<v8::Function>();
-    v8::Local<v8::Object> promise = V8PromiseCustom::createPromise(info.Holder(), isolate);
-    v8::Handle<v8::Value> argv[] = {
-        createClosure(promiseResolveCallback, promise, isolate),
-        createClosure(promiseRejectCallback, promise, isolate)
-    };
+    V8TRYCATCH_VOID(v8::Local<v8::Object>, promise, V8PromiseCustom::createPromise(info.Holder(), isolate));
+    V8TRYCATCH_VOID(v8::Handle<v8::Value>, resolve, createClosure(promiseResolveCallback, promise, isolate));
+    V8TRYCATCH_VOID(v8::Handle<v8::Value>, reject, createClosure(promiseRejectCallback, promise, isolate));
+    v8::Handle<v8::Value> argv[] = { resolve, reject };
     v8::TryCatch trycatch;
     if (V8ScriptRunner::callFunction(init, currentExecutionContext(isolate), v8::Undefined(isolate), WTF_ARRAY_LENGTH(argv), argv, isolate).IsEmpty()) {
         // An exception is thrown. Reject the promise if its resolved flag is unset.
         V8PromiseCustom::reject(promise, trycatch.Exception(), isolate);
     }
     v8SetReturnValue(info, promise);
     return;
 }
 
 void V8Promise::thenMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     v8::Isolate* isolate = info.GetIsolate();
     v8::Local<v8::Function> onFulfilled, onRejected;
     if (info.Length() > 0 && info[0]->IsFunction())
         onFulfilled = info[0].As<v8::Function>();
     if (info.Length() > 1 && info[1]->IsFunction())
         onRejected = info[1].As<v8::Function>();
-    v8SetReturnValue(info, V8PromiseCustom::then(info.Holder(), onFulfilled, onRejected, isolate));
+    V8TRYCATCH_VOID(v8::Local<v8::Value>, newPromise, V8PromiseCustom::then(info.Holder(), onFulfilled, onRejected, isolate));
+    v8SetReturnValue(info, newPromise);
 }
 
 void V8Promise::castMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     v8::Isolate* isolate = info.GetIsolate();
     ExecutionContext* executionContext = callingExecutionContext(isolate);
     UseCounter::count(executionContext, UseCounter::PromiseCast);
     v8::Local<v8::Value> result = v8::Undefined(isolate);
     if (info.Length() > 0)
         result = info[0];
 
-    v8SetReturnValue(info, V8PromiseCustom::toPromise(result, isolate));
+    V8TRYCATCH_VOID(v8::Local<v8::Value>, cast, V8PromiseCustom::toPromise(result, isolate));
+    v8SetReturnValue(info, cast);
 }
 
 void V8Promise::catchMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     v8::Isolate* isolate = info.GetIsolate();
     v8::Local<v8::Function> onFulfilled, onRejected;
 
     if (info.Length() > 0 && !info[0]->IsUndefined()) {
         if (!info[0]->IsFunction()) {
             v8SetReturnValue(info, throwTypeError("onRejected must be a function or undefined", isolate));
             return;
         }
         onRejected = info[0].As<v8::Function>();
     }
-    v8SetReturnValue(info, V8PromiseCustom::then(info.Holder(), onFulfilled, onRejected, isolate));
+    V8TRYCATCH_VOID(v8::Local<v8::Value>, newPromise, V8PromiseCustom::then(info.Holder(), onFulfilled, onRejected, isolate));
+    v8SetReturnValue(info, newPromise);
 }
 
 void V8Promise::resolveMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     v8::Isolate* isolate = info.GetIsolate();
     ExecutionContext* executionContext = callingExecutionContext(isolate);
     UseCounter::count(executionContext, UseCounter::PromiseResolve);
     v8::Local<v8::Value> result = v8::Undefined(isolate);
     if (info.Length() > 0)
         result = info[0];
 
-    v8::Local<v8::Object> promise = V8PromiseCustom::createPromise(info.Holder(), isolate);
+    V8TRYCATCH_VOID(v8::Local<v8::Object>, promise, V8PromiseCustom::createPromise(info.Holder(), isolate));
     V8PromiseCustom::resolve(promise, result, isolate);
     v8SetReturnValue(info, promise);
 }
 
 void V8Promise::rejectMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     v8::Isolate* isolate = info.GetIsolate();
     ExecutionContext* executionContext = callingExecutionContext(isolate);
     UseCounter::count(executionContext, UseCounter::PromiseReject);
     v8::Local<v8::Value> result = v8::Undefined(isolate);
     if (info.Length() > 0)
         result = info[0];
 
-    v8::Local<v8::Object> promise = V8PromiseCustom::createPromise(info.Holder(), isolate);
+    V8TRYCATCH_VOID(v8::Local<v8::Object>, promise, V8PromiseCustom::createPromise(info.Holder(), isolate));
     V8PromiseCustom::reject(promise, result, isolate);
     v8SetReturnValue(info, promise);
 }
 
 void V8Promise::raceMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     v8::Isolate* isolate = info.GetIsolate();
-    v8::Local<v8::Object> promise = V8PromiseCustom::createPromise(info.Holder(), isolate);
+    V8TRYCATCH_VOID(v8::Local<v8::Object>, promise, V8PromiseCustom::createPromise(info.Holder(), isolate));
 
     if (!info.Length() || !info[0]->IsArray()) {
         v8SetReturnValue(info, promise);
         return;
     }
 
     // FIXME: Now we limit the iterable type to the Array type.
     v8::Local<v8::Array> iterable = info[0].As<v8::Array>();
-    v8::Local<v8::Function> onFulfilled = createClosure(promiseResolveCallback, promise, isolate);
-    v8::Local<v8::Function> onRejected = createClosure(promiseRejectCallback, promise, isolate);
+    V8TRYCATCH_VOID(v8::Local<v8::Function>, onFulfilled, createClosure(promiseResolveCallback, promise, isolate));
+    V8TRYCATCH_VOID(v8::Local<v8::Function>, onRejected, createClosure(promiseRejectCallback, promise, isolate));
 
     for (unsigned i = 0, length = iterable->Length(); i < length; ++i) {
         // Array-holes should not be skipped by for-of iteration semantics.
         V8TRYCATCH_VOID(v8::Local<v8::Value>, nextValue, iterable->Get(i));
-        v8::Local<v8::Object> nextPromise = V8PromiseCustom::toPromise(nextValue, isolate);
-        V8PromiseCustom::then(nextPromise, onFulfilled, onRejected, isolate);
+        V8TRYCATCH_VOID(v8::Local<v8::Object>, nextPromise, V8PromiseCustom::toPromise(nextValue, isolate));
+        V8TRYCATCH_VOID(v8::Local<v8::Value>, unused, V8PromiseCustom::then(nextPromise, onFulfilled, onRejected, isolate));
     }
     v8SetReturnValue(info, promise);
 }
 
 void V8Promise::allMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     v8::Isolate* isolate = info.GetIsolate();
-    v8::Local<v8::Object> promise = V8PromiseCustom::createPromise(info.Holder(), isolate);
+    V8TRYCATCH_VOID(v8::Local<v8::Object>, promise, V8PromiseCustom::createPromise(info.Holder(), isolate));
     v8::Local<v8::Array> results = v8::Array::New(info.GetIsolate());
 
     if (!info.Length() || !info[0]->IsArray()) {
         V8PromiseCustom::resolve(promise, results, isolate);
         v8SetReturnValue(info, promise);
         return;
     }
 
     // FIXME: Now we limit the iterable type to the Array type.
     v8::Local<v8::Array> iterable = info[0].As<v8::Array>();
 
     if (!iterable->Length()) {
         V8PromiseCustom::resolve(promise, results, isolate);
         v8SetReturnValue(info, promise);
         return;
     }
 
     v8::Local<v8::ObjectTemplate> objectTemplate = primitiveWrapperObjectTemplate(isolate);
-    v8::Local<v8::Object> countdownWrapper = objectTemplate->NewInstance();
+    V8TRYCATCH_VOID(v8::Local<v8::Object>, countdownWrapper, objectTemplate->NewInstance());
     countdownWrapper->SetInternalField(V8PromiseCustom::PrimitiveWrapperPrimitiveIndex, v8::Integer::New(isolate, iterable->Length()));
 
-    v8::Local<v8::Function> onRejected = createClosure(promiseRejectCallback, promise, isolate);
+    V8TRYCATCH_VOID(v8::Local<v8::Function>, onRejected, createClosure(promiseRejectCallback, promise, isolate));
     for (unsigned i = 0, length = iterable->Length(); i < length; ++i) {
         // Array-holes should not be skipped by for-of iteration semantics.
-        v8::Local<v8::Object> environment = promiseAllEnvironment(promise, countdownWrapper, i, results, isolate);
-        v8::Local<v8::Function> onFulfilled = createClosure(promiseAllFulfillCallback, environment, isolate);
+        V8TRYCATCH_VOID(v8::Local<v8::Object>, environment, promiseAllEnvironment(promise, countdownWrapper, i, results, isolate));
+        V8TRYCATCH_VOID(v8::Local<v8::Function>, onFulfilled, createClosure(promiseAllFulfillCallback, environment, isolate));
         V8TRYCATCH_VOID(v8::Local<v8::Value>, nextValue, iterable->Get(i));
-        v8::Local<v8::Object> nextPromise = V8PromiseCustom::toPromise(nextValue, isolate);
-        V8PromiseCustom::then(nextPromise, onFulfilled, onRejected, isolate);
+        V8TRYCATCH_VOID(v8::Local<v8::Object>, nextPromise, V8PromiseCustom::toPromise(nextValue, isolate));
+        V8TRYCATCH_VOID(v8::Local<v8::Value>, unused, V8PromiseCustom::then(nextPromise, onFulfilled, onRejected, isolate));
     }
     v8SetReturnValue(info, promise);
 }
 
 //
 // -- V8PromiseCustom --
 v8::Local<v8::Object> V8PromiseCustom::createPromise(v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)
 {
     v8::Local<v8::ObjectTemplate> internalTemplate = internalObjectTemplate(isolate);
     v8::Local<v8::Object> internal = internalTemplate->NewInstance();
+    if (internal.IsEmpty())
+        return v8::Local<v8::Object>();
     v8::Local<v8::Object> promise = V8DOMWrapper::createWrapper(creationContext, &V8Promise::wrapperTypeInfo, 0, isolate);
 
     clearDerived(internal, isolate);
     setState(internal, Pending, v8::Undefined(isolate), isolate);
 
     promise->SetInternalField(v8DOMWrapperObjectIndex, internal);
     return promise;
 }
 
 v8::Local<v8::Object> V8PromiseCustom::getInternal(v8::Handle<v8::Object> promise)
@@ skipping 26 matching lines @@
 
 v8::Local<v8::Object> V8PromiseCustom::toPromise(v8::Handle<v8::Value> maybePromise, v8::Isolate* isolate)
 {
     // FIXME: Currently we don't check [[PromiseConstructor]] since we limit
     // the creation of the promise objects only from the Blink Promise
     // constructor.
     if (isPromise(maybePromise, isolate))
         return maybePromise.As<v8::Object>();
 
     v8::Local<v8::Object> promise = createPromise(v8::Handle<v8::Object>(), isolate);
+    if (promise.IsEmpty())
+        return v8::Local<v8::Object>();
     resolve(promise, maybePromise, isolate);
     return promise;
 }
 
 void V8PromiseCustom::resolve(v8::Handle<v8::Object> promise, v8::Handle<v8::Value> result, v8::Isolate* isolate)
 {
     ASSERT(!result.IsEmpty());
     v8::Local<v8::Object> internal = getInternal(promise);
     PromiseState state = getState(internal);
     if (state != Pending)
@@ skipping 37 matching lines @@
 {
     v8::Handle<v8::Object> internal = getInternal(promise);
     while (getState(internal) == Following) {
         promise = internal->GetInternalField(InternalResultIndex).As<v8::Object>();
         internal = getInternal(promise);
     }
     // FIXME: Currently we don't lookup "constructor" property since we limit
     // the creation of the promise objects only from the Blink Promise
     // constructor.
     v8::Local<v8::Object> derivedPromise = createPromise(v8::Handle<v8::Object>(), isolate);
+    if (derivedPromise.IsEmpty())
+        return v8::Local<v8::Object>();
     updateDerivedFromPromise(derivedPromise, onFulfilled, onRejected, promise, isolate);
     return derivedPromise;
 }
 
 void V8PromiseCustom::setValue(v8::Handle<v8::Object> promise, v8::Handle<v8::Value> value, v8::Isolate* isolate)
 {
     PromisePropagator propagator;
     propagator.setValue(promise, value, isolate);
     propagator.performPropagation(isolate);
 }
@@ skipping 38 matching lines @@
     PromisePropagator propagator;
     propagator.updateDerivedFromPromise(derivedPromise, onFulfilled, onRejected, promise, isolate);
     propagator.performPropagation(isolate);
 }
 
 v8::Local<v8::Object> V8PromiseCustom::coerceThenable(v8::Handle<v8::Object> thenable, v8::Handle<v8::Function> then, v8::Isolate* isolate)
 {
     ASSERT(!thenable.IsEmpty());
     ASSERT(!then.IsEmpty());
     v8::Local<v8::Object> promise = createPromise(v8::Handle<v8::Object>(), isolate);
-    v8::Handle<v8::Value> argv[] = {
-        createClosure(promiseResolveCallback, promise, isolate),
-        createClosure(promiseRejectCallback, promise, isolate)
-    };
+    if (promise.IsEmpty())
+        return v8::Local<v8::Object>();
+    v8::Handle<v8::Value> onFulfilled = createClosure(promiseResolveCallback, promise, isolate);
+    if (onFulfilled.IsEmpty())
+        return v8::Local<v8::Object>();
+    v8::Handle<v8::Value> onRejected = createClosure(promiseRejectCallback, promise, isolate);
+    if (onRejected.IsEmpty())
+        return v8::Local<v8::Object>();
+    v8::Handle<v8::Value> argv[] = { onFulfilled, onRejected };
+
     v8::TryCatch trycatch;
     if (V8ScriptRunner::callFunction(then, currentExecutionContext(isolate), thenable, WTF_ARRAY_LENGTH(argv), argv, isolate).IsEmpty()) {
         reject(promise, trycatch.Exception(), isolate);
     }
     setHiddenValue(isolate, thenable, "thenableHiddenPromise", promise);
     return promise;
 }
 
 void V8PromiseCustom::callHandler(v8::Handle<v8::Object> promise, v8::Handle<v8::Function> handler, v8::Handle<v8::Value> argument, PromiseState originatorState, v8::Isolate* isolate)
 {
     ASSERT(originatorState == Fulfilled || originatorState == Rejected);
     ExecutionContext* executionContext = currentExecutionContext(isolate);
     ASSERT(executionContext && executionContext->isContextThread());
     executionContext->postTask(adoptPtr(new CallHandlerTask(promise, handler, argument, originatorState, isolate, executionContext)));
 }
 
 } // namespace WebCore