Use ExceptionState to throw exceptions when converting arrays

Source/bindings/core/v8/V8Binding.h

 /*
 * Copyright (C) 2009 Google Inc. All rights reserved.
 * Copyright (C) 2012 Ericsson AB. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 *     * Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
@@ skipping 16 matching lines @@
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 
 #ifndef V8Binding_h
 #define V8Binding_h
 
 #include "bindings/core/v8/DOMWrapperWorld.h"
 #include "bindings/core/v8/ExceptionMessages.h"
+#include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptValue.h"
 #include "bindings/core/v8/ScriptWrappable.h"
 #include "bindings/core/v8/V8BindingMacros.h"
 #include "bindings/core/v8/V8PerIsolateData.h"
 #include "bindings/core/v8/V8StringResource.h"
 #include "bindings/core/v8/V8ThrowException.h"
 #include "bindings/core/v8/V8ValueCache.h"
 #include "platform/heap/Heap.h"
 #include "wtf/GetPtr.h"
 #include "wtf/MathExtras.h"
@@ skipping 518 matching lines @@
 }
 
 // FIXME: Remove the special casing for NodeFilter and XPathNSResolver.
 PassRefPtrWillBeRawPtr<NodeFilter> toNodeFilter(v8::Handle<v8::Value>, v8::Handle<v8::Object>, ScriptState*);
 PassRefPtrWillBeRawPtr<XPathNSResolver> toXPathNSResolver(v8::Handle<v8::Value>, v8::Isolate*);
 
 template<class T> struct NativeValueTraits;
 
 template<>
 struct NativeValueTraits<String> {
-    static inline String nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
+    static inline String nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate, ExceptionState& exceptionState)
     {
-        TOSTRING_DEFAULT(V8StringResource<>, stringValue, value, String());
+        V8StringResource<> stringValue(value);
+        if (!stringValue.prepare(exceptionState))
+            return String();
         return stringValue;
     }
 };
 
 template<>
 struct NativeValueTraits<unsigned> {
-    static inline unsigned nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
+    static inline unsigned nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate, ExceptionState& exceptionState)
     {
-        return toUInt32(value);
+        return toUInt32(value, exceptionState);
     }
 };
 
 template<>
 struct NativeValueTraits<float> {
-    static inline float nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
+    static inline float nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate, ExceptionState& exceptionState)
     {
-        return static_cast<float>(value->NumberValue());
+        return toFloat(value, exceptionState);
     }
 };
 
 template<>
 struct NativeValueTraits<double> {
-    static inline double nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
+    static inline double nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate, ExceptionState& exceptionState)
     {
-        return static_cast<double>(value->NumberValue());
+        return toDouble(value, exceptionState);
     }
 };
 
 template<>
 struct NativeValueTraits<v8::Handle<v8::Value> > {
-    static inline v8::Handle<v8::Value> nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
+    static inline v8::Handle<v8::Value> nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate, ExceptionState&)
     {
         return value;
     }
 };
 
 template<>
 struct NativeValueTraits<ScriptValue> {
-    static inline ScriptValue nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate)
+    static inline ScriptValue nativeValue(const v8::Handle<v8::Value>& value, v8::Isolate* isolate, ExceptionState&)
     {
         return ScriptValue(ScriptState::current(isolate), value);
     }
 };
 
 v8::Handle<v8::Value> toV8Sequence(v8::Handle<v8::Value>, uint32_t& length, v8::Isolate*);
 
 // Converts a JavaScript value to an array as per the Web IDL specification:
 // http://www.w3.org/TR/2012/CR-WebIDL-20120419/#es-array
 template <class T, class V8T>
-Vector<RefPtr<T> > toRefPtrNativeArrayUnchecked(v8::Local<v8::Value> v8Value, uint32_t length, v8::Isolate* isolate, bool* success = 0)
+Vector<RefPtr<T> > toRefPtrNativeArrayUnchecked(v8::Local<v8::Value> v8Value, uint32_t length, v8::Isolate* isolate, ExceptionState& exceptionState)
 {
     Vector<RefPtr<T> > result;
     result.reserveInitialCapacity(length);
     v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(v8Value);
+    v8::TryCatch block;
     for (uint32_t i = 0; i < length; ++i) {
         v8::Handle<v8::Value> element = object->Get(i);
+        if (block.HasCaught()) {
+            exceptionState.rethrowV8Exception(block.Exception());
+            return Vector<RefPtr<T> >();
+        }
         if (V8T::hasInstance(element, isolate)) {
             v8::Handle<v8::Object> elementObject = v8::Handle<v8::Object>::Cast(element);
             result.uncheckedAppend(V8T::toImpl(elementObject));
         } else {
-            if (success)
-                *success = false;
-            V8ThrowException::throwTypeError("Invalid Array element type", isolate);
+            exceptionState.throwTypeError("Invalid Array element type");
             return Vector<RefPtr<T> >();
         }
     }
     return result;
 }
 
 template <class T, class V8T>
-Vector<RefPtr<T> > toRefPtrNativeArray(v8::Handle<v8::Value> value, int argumentIndex, v8::Isolate* isolate, bool* success = 0)
+Vector<RefPtr<T> > toRefPtrNativeArray(v8::Handle<v8::Value> value, int argumentIndex, v8::Isolate* isolate, ExceptionState& exceptionState)
 {
-    if (success)
-        *success = true;
-
     v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(isolate, value));
     uint32_t length = 0;
     if (value->IsArray()) {
         length = v8::Local<v8::Array>::Cast(v8Value)->Length();
     } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
-        V8ThrowException::throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex), isolate);
+        exceptionState.throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex));
         return Vector<RefPtr<T> >();
     }
-    return toRefPtrNativeArrayUnchecked<T, V8T>(v8Value, length, isolate, success);
+    return toRefPtrNativeArrayUnchecked<T, V8T>(v8Value, length, isolate, exceptionState);
 }
 
 template <class T, class V8T>
-Vector<RefPtr<T> > toRefPtrNativeArray(v8::Handle<v8::Value> value, const String& propertyName, v8::Isolate* isolate, bool* success = 0)
+Vector<RefPtr<T> > toRefPtrNativeArray(v8::Handle<v8::Value> value, const String& propertyName, v8::Isolate* isolate, ExceptionState& exceptionState)
 {
-    if (success)
-        *success = true;
-
     v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(isolate, value));
     uint32_t length = 0;
     if (value->IsArray()) {
         length = v8::Local<v8::Array>::Cast(v8Value)->Length();
     } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
-        V8ThrowException::throwTypeError(ExceptionMessages::notASequenceTypeProperty(propertyName), isolate);
+        exceptionState.throwTypeError(ExceptionMessages::notASequenceTypeProperty(propertyName));
         return Vector<RefPtr<T> >();
     }
-    return toRefPtrNativeArrayUnchecked<T, V8T>(v8Value, length, isolate, success);
+    return toRefPtrNativeArrayUnchecked<T, V8T>(v8Value, length, isolate, exceptionState);
 }
 
 template <class T, class V8T>
-WillBeHeapVector<RefPtrWillBeMember<T> > toRefPtrWillBeMemberNativeArray(v8::Handle<v8::Value> value, int argumentIndex, v8::Isolate* isolate, bool* success = 0)
+WillBeHeapVector<RefPtrWillBeMember<T> > toRefPtrWillBeMemberNativeArray(v8::Handle<v8::Value> value, int argumentIndex, v8::Isolate* isolate, ExceptionState& exceptionState)
 {
-    if (success)
-        *success = true;
-
     v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(isolate, value));
     uint32_t length = 0;
     if (value->IsArray()) {
         length = v8::Local<v8::Array>::Cast(v8Value)->Length();
     } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
-        V8ThrowException::throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex), isolate);
+        exceptionState.throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex));
         return WillBeHeapVector<RefPtrWillBeMember<T> >();
     }
 
     WillBeHeapVector<RefPtrWillBeMember<T> > result;
     result.reserveInitialCapacity(length);
     v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(v8Value);
+    v8::TryCatch block;
     for (uint32_t i = 0; i < length; ++i) {
         v8::Handle<v8::Value> element = object->Get(i);
+        if (block.HasCaught()) {
+            exceptionState.rethrowV8Exception(block.Exception());
+            return WillBeHeapVector<RefPtrWillBeMember<T> >();
+        }
         if (V8T::hasInstance(element, isolate)) {
             v8::Handle<v8::Object> elementObject = v8::Handle<v8::Object>::Cast(element);
             result.uncheckedAppend(V8T::toImpl(elementObject));
         } else {
-            if (success)
-                *success = false;
-            V8ThrowException::throwTypeError("Invalid Array element type", isolate);
+            exceptionState.throwTypeError("Invalid Array element type");
             return WillBeHeapVector<RefPtrWillBeMember<T> >();
         }
     }
     return result;
 }
 
 template <class T, class V8T>
-WillBeHeapVector<RefPtrWillBeMember<T> > toRefPtrWillBeMemberNativeArray(v8::Handle<v8::Value> value, const String& propertyName, v8::Isolate* isolate, bool* success = 0)
+WillBeHeapVector<RefPtrWillBeMember<T> > toRefPtrWillBeMemberNativeArray(v8::Handle<v8::Value> value, const String& propertyName, v8::Isolate* isolate, ExceptionState& exceptionState)
 {
-    if (success)
-        *success = true;
-
     v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(isolate, value));
     uint32_t length = 0;
     if (value->IsArray()) {
         length = v8::Local<v8::Array>::Cast(v8Value)->Length();
     } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
-        V8ThrowException::throwTypeError(ExceptionMessages::notASequenceTypeProperty(propertyName), isolate);
+        exceptionState.throwTypeError(ExceptionMessages::notASequenceTypeProperty(propertyName));
         return WillBeHeapVector<RefPtrWillBeMember<T> >();
     }
 
     WillBeHeapVector<RefPtrWillBeMember<T> > result;
     result.reserveInitialCapacity(length);
     v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(v8Value);
+    v8::TryCatch block;
     for (uint32_t i = 0; i < length; ++i) {
         v8::Handle<v8::Value> element = object->Get(i);
+        if (block.HasCaught()) {
+            exceptionState.rethrowV8Exception(block.Exception());
+            return Vector<RefPtr<T> >();
+        }
         if (V8T::hasInstance(element, isolate)) {
             v8::Handle<v8::Object> elementObject = v8::Handle<v8::Object>::Cast(element);
             result.uncheckedAppend(V8T::toImpl(elementObject));
         } else {
-            if (success)
-                *success = false;
-            V8ThrowException::throwTypeError("Invalid Array element type", isolate);
+            exceptionState.throwTypeError("Invalid Array element type");
             return WillBeHeapVector<RefPtrWillBeMember<T> >();
         }
     }
     return result;
 }
 
 template <class T, class V8T>
-HeapVector<Member<T> > toMemberNativeArray(v8::Handle<v8::Value> value, int argumentIndex, v8::Isolate* isolate, bool* success = 0)
+HeapVector<Member<T> > toMemberNativeArray(v8::Handle<v8::Value> value, int argumentIndex, v8::Isolate* isolate, ExceptionState& exceptionState)
 {
-    if (success)
-        *success = true;
-
     v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(isolate, value));
     uint32_t length = 0;
     if (value->IsArray()) {
         length = v8::Local<v8::Array>::Cast(v8Value)->Length();
     } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
-        V8ThrowException::throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex), isolate);
+        exceptionState.throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex));
         return HeapVector<Member<T> >();
     }
 
     HeapVector<Member<T> > result;
     result.reserveInitialCapacity(length);
     v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(v8Value);
+    v8::TryCatch block;
     for (uint32_t i = 0; i < length; ++i) {
         v8::Handle<v8::Value> element = object->Get(i);
+        if (UNLIKELY(block.HasCaught())) {
+            exceptionState.rethrowV8Exception(block.Exception());
+            return HeapVector<Member<T> >();
+        }
         if (V8T::hasInstance(element, isolate)) {
             v8::Handle<v8::Object> elementObject = v8::Handle<v8::Object>::Cast(element);
             result.uncheckedAppend(V8T::toImpl(elementObject));
         } else {
-            if (success)
-                *success = false;
-            V8ThrowException::throwTypeError("Invalid Array element type", isolate);
+            exceptionState.throwTypeError("Invalid Array element type");
             return HeapVector<Member<T> >();
         }
     }
     return result;
 }
 
 // Converts a JavaScript value to an array as per the Web IDL specification:
 // http://www.w3.org/TR/2012/CR-WebIDL-20120419/#es-array
 template <class T>
-Vector<T> toImplArray(v8::Handle<v8::Value> value, int argumentIndex, v8::Isolate* isolate)
+Vector<T> toImplArray(v8::Handle<v8::Value> value, int argumentIndex, v8::Isolate* isolate, ExceptionState& exceptionState)
 {
     v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(isolate, value));
     uint32_t length = 0;
     if (value->IsArray()) {
         length = v8::Local<v8::Array>::Cast(v8Value)->Length();
     } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
-        V8ThrowException::throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex), isolate);
+        exceptionState.throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex));
         return Vector<T>();
     }
 
     Vector<T> result;
     result.reserveInitialCapacity(length);
     typedef NativeValueTraits<T> TraitsType;
     v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(v8Value);
-    for (uint32_t i = 0; i < length; ++i)
-        result.uncheckedAppend(TraitsType::nativeValue(object->Get(i), isolate));

[Jens Widell, 2014/09/11 13:22:31]

The change here (and in the other functions) to add a TryCatch and check it
after object->Get(i), fixes a crash (that could also have been fixed by checking
element.IsEmpty()):

var a=[];Object.defineProperty(a,0,{get:function(){throw
TypeError}});navigator.vibrate(a)

+    v8::TryCatch block;
+    for (uint32_t i = 0; i < length; ++i) {
+        v8::Handle<v8::Value> element = object->Get(i);
+        if (UNLIKELY(block.HasCaught())) {
+            exceptionState.rethrowV8Exception(block.Exception());
+            return Vector<T>();
+        }
+        result.uncheckedAppend(TraitsType::nativeValue(element, isolate, exceptionState));
+        if (exceptionState.hadException())
+            return Vector<T>();
+    }
     return result;
 }
 
 template <class T>
-Vector<T> toImplArguments(const v8::FunctionCallbackInfo<v8::Value>& info, int startIndex)
+Vector<T> toImplArguments(const v8::FunctionCallbackInfo<v8::Value>& info, int startIndex, ExceptionState& exceptionState)
 {
     ASSERT(startIndex <= info.Length());
     Vector<T> result;
     typedef NativeValueTraits<T> TraitsType;
     int length = info.Length();
     result.reserveInitialCapacity(length);
-    for (int i = startIndex; i < length; ++i)
-        result.uncheckedAppend(TraitsType::nativeValue(info[i], info.GetIsolate()));
+    for (int i = startIndex; i < length; ++i) {
+        result.uncheckedAppend(TraitsType::nativeValue(info[i], info.GetIsolate(), exceptionState));
+        if (exceptionState.hadException())
+            return Vector<T>();
+    }
     return result;
 }
 
 // Validates that the passed object is a sequence type per WebIDL spec
 // http://www.w3.org/TR/2012/CR-WebIDL-20120419/#es-sequence
 inline v8::Handle<v8::Value> toV8Sequence(v8::Handle<v8::Value> value, uint32_t& length, v8::Isolate* isolate)
 {
     // Attempt converting to a sequence if the value is not already an array but is
     // any kind of object except for a native Date object or a native RegExp object.
     ASSERT(!value->IsArray());
@@ skipping 151 matching lines @@
 v8::Local<v8::Value> v8IteratorResult(v8::Isolate*, v8::Handle<v8::Value>);
 template <typename T>
 v8::Local<v8::Value> v8IteratorResult(ScriptState* scriptState, const T& value)
 {
     return v8IteratorResult(scriptState->isolate(), V8ValueTraits<T>::toV8Value(value, scriptState->context()->Global(), scriptState->isolate()));
 }
 
 } // namespace blink
 
 #endif // V8Binding_h