mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2025-11-04 15:20:58 +00:00
476094922b
This patch is unfortunately rather large and might make some things feel
bloated, but it is necessary to fix a few flaws in LibJS, primarily
blindly coercing values to numbers without exception checks - i.e.
interpreter.argument(0).to_i32(); // can fail!!!
Some examples where the interpreter would actually crash:
var o = { toString: () => { throw Error() } };
+o;
o - 1;
"foo".charAt(o);
"bar".repeat(o);
To fix this, we now have the following...
to_double(Interpreter&)
to_i32()
to_i32(Interpreter&)
to_size_t()
to_size_t(Interpreter&)
...and a whole lot of exception checking.
There's intentionally no to_double(), use as_double() directly instead.
This way we still can use these convenient utility functions but don't
need to check for exceptions if we are sure the value already is a
number.
Fixes #2267.
38 lines
640 B
JavaScript
38 lines
640 B
JavaScript
load("test-common.js");
|
|
|
|
try {
|
|
const message = "oops, Value::to_number() failed";
|
|
const o = { toString() { throw new Error(message); } };
|
|
|
|
assertThrowsError(() => {
|
|
+o;
|
|
}, {
|
|
error: Error,
|
|
message
|
|
});
|
|
|
|
assertThrowsError(() => {
|
|
o - 1;
|
|
}, {
|
|
error: Error,
|
|
message
|
|
});
|
|
|
|
assertThrowsError(() => {
|
|
"foo".charAt(o);
|
|
}, {
|
|
error: Error,
|
|
message
|
|
});
|
|
|
|
assertThrowsError(() => {
|
|
"bar".repeat(o);
|
|
}, {
|
|
error: Error,
|
|
message
|
|
});
|
|
|
|
console.log("PASS");
|
|
} catch (e) {
|
|
console.log("FAIL: " + e);
|
|
}
|