Skip to content

Commit 4ff6c77

Browse files
committed
deps: V8: cherry-pick e06ace6b5cdb
Original commit message: [api] Fix empty Maybe crash in GetRealNamedPropertyAttributes `Object::GetRealNamedPropertyAttributes()` can crash if an empty `Maybe` is returned by `JSReceiver::GetPropertyAttributes()` because it was not checking for that. Fix that. Refs: #34606 Change-Id: Ic83f904ba7134786bcd8f786eb2ce98adb4fea1e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335057 Commit-Queue: Leszek Swirski <[email protected]> Reviewed-by: Leszek Swirski <[email protected]> Cr-Commit-Position: refs/heads/master@{#69258} Refs: v8/v8@e06ace6 PR-URL: #34673 Fixes: #34606 Reviewed-By: Jiawen Geng <[email protected]> Reviewed-By: Rich Trott <[email protected]> Reviewed-By: James M Snell <[email protected]>
1 parent 63cd05b commit 4ff6c77

File tree

3 files changed

+50
-6
lines changed

3 files changed

+50
-6
lines changed

common.gypi

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434

3535
# Reset this number to 0 on major V8 upgrades.
3636
# Increment by one for each non-official patch applied to deps/v8.
37-
'v8_embedder_string': '-node.43',
37+
'v8_embedder_string': '-node.44',
3838

3939
##### V8 defaults for Node.js #####
4040

deps/v8/src/api/api.cc

+7-5
Original file line numberDiff line numberDiff line change
@@ -4701,9 +4701,9 @@ Maybe<PropertyAttribute>
47014701
v8::Object::GetRealNamedPropertyAttributesInPrototypeChain(
47024702
Local<Context> context, Local<Name> key) {
47034703
auto isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
4704-
ENTER_V8_NO_SCRIPT(isolate, context, Object,
4705-
GetRealNamedPropertyAttributesInPrototypeChain,
4706-
Nothing<PropertyAttribute>(), i::HandleScope);
4704+
ENTER_V8(isolate, context, Object,
4705+
GetRealNamedPropertyAttributesInPrototypeChain,
4706+
Nothing<PropertyAttribute>(), i::HandleScope);
47074707
i::Handle<i::JSReceiver> self = Utils::OpenHandle(this);
47084708
if (!self->IsJSObject()) return Nothing<PropertyAttribute>();
47094709
i::Handle<i::Name> key_obj = Utils::OpenHandle(*key);
@@ -4716,6 +4716,7 @@ v8::Object::GetRealNamedPropertyAttributesInPrototypeChain(
47164716
i::LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
47174717
Maybe<i::PropertyAttributes> result =
47184718
i::JSReceiver::GetPropertyAttributes(&it);
4719+
has_pending_exception = result.IsNothing();
47194720
RETURN_ON_FAILED_EXECUTION_PRIMITIVE(PropertyAttribute);
47204721
if (!it.IsFound()) return Nothing<PropertyAttribute>();
47214722
if (result.FromJust() == i::ABSENT) return Just(None);
@@ -4740,14 +4741,15 @@ MaybeLocal<Value> v8::Object::GetRealNamedProperty(Local<Context> context,
47404741
Maybe<PropertyAttribute> v8::Object::GetRealNamedPropertyAttributes(
47414742
Local<Context> context, Local<Name> key) {
47424743
auto isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
4743-
ENTER_V8_NO_SCRIPT(isolate, context, Object, GetRealNamedPropertyAttributes,
4744-
Nothing<PropertyAttribute>(), i::HandleScope);
4744+
ENTER_V8(isolate, context, Object, GetRealNamedPropertyAttributes,
4745+
Nothing<PropertyAttribute>(), i::HandleScope);
47454746
auto self = Utils::OpenHandle(this);
47464747
auto key_obj = Utils::OpenHandle(*key);
47474748
i::LookupIterator it = i::LookupIterator::PropertyOrElement(
47484749
isolate, self, key_obj, self,
47494750
i::LookupIterator::PROTOTYPE_CHAIN_SKIP_INTERCEPTOR);
47504751
auto result = i::JSReceiver::GetPropertyAttributes(&it);
4752+
has_pending_exception = result.IsNothing();
47514753
RETURN_ON_FAILED_EXECUTION_PRIMITIVE(PropertyAttribute);
47524754
if (!it.IsFound()) return Nothing<PropertyAttribute>();
47534755
if (result.FromJust() == i::ABSENT) {

deps/v8/test/cctest/test-api.cc

+42
Original file line numberDiff line numberDiff line change
@@ -12011,6 +12011,48 @@ THREADED_TEST(VariousGetPropertiesAndThrowingCallbacks) {
1201112011
CHECK(result.IsEmpty());
1201212012
}
1201312013

12014+
THREADED_TEST(GetRealNamedPropertyAttributes_With_Proxy) {
12015+
LocalContext context;
12016+
HandleScope scope(context->GetIsolate());
12017+
12018+
{
12019+
Local<Object> proxy =
12020+
CompileRun(
12021+
"new Proxy({ p: 1 }, { getOwnPropertyDescriptor: _ => { "
12022+
" throw new Error('xyz'); } });")
12023+
.As<Object>();
12024+
TryCatch try_catch(context->GetIsolate());
12025+
v8::Maybe<v8::PropertyAttribute> result =
12026+
proxy->GetRealNamedPropertyAttributes(context.local(), v8_str("p"));
12027+
CHECK(result.IsNothing());
12028+
CHECK(try_catch.HasCaught());
12029+
CHECK(try_catch.Exception()
12030+
.As<Object>()
12031+
->Get(context.local(), v8_str("message"))
12032+
.ToLocalChecked()
12033+
->StrictEquals(v8_str("xyz")));
12034+
}
12035+
12036+
{
12037+
Local<Object> proxy =
12038+
CompileRun(
12039+
"Object.create("
12040+
" new Proxy({ p: 1 }, { getOwnPropertyDescriptor: _ => { "
12041+
" throw new Error('abc'); } }))")
12042+
.As<Object>();
12043+
TryCatch try_catch(context->GetIsolate());
12044+
v8::Maybe<v8::PropertyAttribute> result =
12045+
proxy->GetRealNamedPropertyAttributesInPrototypeChain(context.local(),
12046+
v8_str("p"));
12047+
CHECK(result.IsNothing());
12048+
CHECK(try_catch.HasCaught());
12049+
CHECK(try_catch.Exception()
12050+
.As<Object>()
12051+
->Get(context.local(), v8_str("message"))
12052+
.ToLocalChecked()
12053+
->StrictEquals(v8_str("abc")));
12054+
}
12055+
}
1201412056

1201512057
static void ThrowingCallbackWithTryCatch(
1201612058
const v8::FunctionCallbackInfo<v8::Value>& args) {

0 commit comments

Comments
 (0)