{

CallFrame* callerFrame = callFrame->callerFrame();

CallSiteIndex callerCallSiteIndex = callerFrame->callSiteIndex();

CodeBlock* callerCodeBlock = callerFrame->codeBlock();

CodeBlock* callerBaselineCodeBlock = callerCodeBlock;

BytecodeIndex bytecodeIndex = callerCallSiteIndex.bytecodeIndex();

#if ENABLE(DFG_JIT)

if (JSC::JITCode::isOptimizingJIT(callerCodeBlock->jitType())) {

CodeOrigin codeOrigin = callerCodeBlock->codeOrigin(callerCallSiteIndex);

callerBaselineCodeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(codeOrigin, callerCodeBlock->baselineAlternative());

bytecodeIndex = codeOrigin.bytecodeIndex();

}

#endif

UnlinkedCodeBlock* callerUnlinkedCodeBlock = callerBaselineCodeBlock->unlinkedCodeBlock();

JSGlobalObject* globalObject = callerBaselineCodeBlock->globalObject();

if (UNLIKELY(callFrame->guaranteedJSValueCallee() != globalObject->evalFunction()))

return { };

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

auto clobberizeValidator = makeScopeExit([&] {

vm.didEnterVM = true;

});

if (!callFrame->argumentCount())

return jsUndefined();

JSValue program = callFrame->argument(0);

if (!program.isString())

return program;

auto* programString = asString(program);

TopCallFrameSetter topCallFrame(vm, callFrame);

if (!globalObject->evalEnabled()) {

globalObject->globalObjectMethodTable()->reportViolationForUnsafeEval(globalObject, programString);

throwException(globalObject, scope, createEvalError(globalObject, globalObject->evalDisabledErrorMessage()));

return { };

}

auto programSource = programString->value(globalObject);

RETURN_IF_EXCEPTION(scope, JSValue());

bool isArrowFunctionContext = callerUnlinkedCodeBlock->isArrowFunction() || callerUnlinkedCodeBlock->isArrowFunctionContext();

DerivedContextType derivedContextType = callerUnlinkedCodeBlock->derivedContextType();

if (!isArrowFunctionContext && callerUnlinkedCodeBlock->isClassContext()) {

derivedContextType = callerUnlinkedCodeBlock->isConstructor()

? DerivedContextType::DerivedConstructorContext

: DerivedContextType::DerivedMethodContext;

}

EvalContextType evalContextType;

if (callerUnlinkedCodeBlock->parseMode() == SourceParseMode::ClassFieldInitializerMode)

evalContextType = EvalContextType::InstanceFieldEvalContext;

else if (isFunctionParseMode(callerUnlinkedCodeBlock->parseMode()))

evalContextType = EvalContextType::FunctionEvalContext;

else if (callerUnlinkedCodeBlock->codeType() == EvalCode)

evalContextType = callerUnlinkedCodeBlock->evalContextType();

else

evalContextType = EvalContextType::None;

DirectEvalExecutable* eval = callerBaselineCodeBlock->directEvalCodeCache().tryGet(programSource, bytecodeIndex);

if (!eval) {

if (!ecmaMode.isStrict()) {

if (programSource->is8Bit()) {

LiteralParser preparser(globalObject, programSource->span8(), SloppyJSON, callerBaselineCodeBlock);

if (JSValue parsedObject = preparser.tryLiteralParse())

RELEASE_AND_RETURN(scope, parsedObject);

} else {

LiteralParser preparser(globalObject, programSource->span16(), SloppyJSON, callerBaselineCodeBlock);

if (JSValue parsedObject = preparser.tryLiteralParse())

RELEASE_AND_RETURN(scope, parsedObject);

}

RETURN_IF_EXCEPTION(scope, JSValue());

}

TDZEnvironment variablesUnderTDZ;

PrivateNameEnvironment privateNameEnvironment;

JSScope::collectClosureVariablesUnderTDZ(callerScopeChain, variablesUnderTDZ, privateNameEnvironment);

SourceTaintedOrigin sourceTaintedOrigin = computeNewSourceTaintedOriginFromStack(vm, callFrame);

eval = DirectEvalExecutable::create(globalObject, makeSource(programSource, callerBaselineCodeBlock->source().provider()->sourceOrigin(), sourceTaintedOrigin), derivedContextType, callerUnlinkedCodeBlock->needsClassFieldInitializer(), callerUnlinkedCodeBlock->privateBrandRequirement(), isArrowFunctionContext, callerBaselineCodeBlock->ownerExecutable()->isInsideOrdinaryFunction(), evalContextType, &variablesUnderTDZ, &privateNameEnvironment, ecmaMode);

EXCEPTION_ASSERT(!!scope.exception() == !eval);

if (!eval)

return { };

// Skip the eval cache if tainted since another eval call could have a different taintedness.

if (sourceTaintedOrigin == SourceTaintedOrigin::Untainted)

callerBaselineCodeBlock->directEvalCodeCache().set(globalObject, callerBaselineCodeBlock, programSource, bytecodeIndex, eval);

}

RELEASE_AND_RETURN(scope, vm.interpreter.executeEval(eval, thisValue, callerScopeChain));

{

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

if (UNLIKELY(!arguments.isCell())) {

if (arguments.isUndefinedOrNull())

return 0;

throwException(globalObject, scope, createInvalidFunctionApplyParameterError(globalObject, arguments));

return 0;

}

JSCell* cell = arguments.asCell();

unsigned length;

switch (cell->type()) {

case DirectArgumentsType:

length = jsCast<DirectArguments*>(cell)->length(globalObject);

break;

case ScopedArgumentsType:

length = jsCast<ScopedArguments*>(cell)->length(globalObject);

break;

case ClonedArgumentsType:

length = jsCast<ClonedArguments*>(cell)->length(globalObject);

break;

case JSImmutableButterflyType:

length = jsCast<JSImmutableButterfly*>(cell)->length();

break;

case StringType:

case SymbolType:

case HeapBigIntType:

throwException(globalObject, scope, createInvalidFunctionApplyParameterError(globalObject, arguments));

return 0;

default:

RELEASE_ASSERT(arguments.isObject());

length = clampToUnsigned(toLength(globalObject, jsCast<JSObject*>(cell)));

break;

}

RETURN_IF_EXCEPTION(scope, 0);

if (length > maxArguments)

throwStackOverflowError(globalObject, scope);

if (length >= firstVarArgOffset)

length -= firstVarArgOffset;

else

length = 0;

return length;

{

auto scope = DECLARE_THROW_SCOPE(vm);

unsigned length = callFrame->argumentCount();

CallFrame* calleeFrame = calleeFrameForVarargs(callFrame, numUsedStackSlots, length + 1);

if (UNLIKELY(!vm.ensureStackCapacityFor(calleeFrame->registers())))

throwStackOverflowError(globalObject, scope);

return length;

{

auto scope = DECLARE_THROW_SCOPE(vm);

unsigned length = sizeOfVarargs(globalObject, arguments, firstVarArgOffset);

RETURN_IF_EXCEPTION(scope, 0);

CallFrame* calleeFrame = calleeFrameForVarargs(callFrame, numUsedStackSlots, length + 1);

if (UNLIKELY(length > maxArguments || !vm.ensureStackCapacityFor(calleeFrame->registers()))) {

throwStackOverflowError(globalObject, scope);

return 0;

}

return length;

{

if (UNLIKELY(!arguments.isCell()) || !length)

return;

VM& vm = globalObject->vm();

auto scope = DECLARE_THROW_SCOPE(vm);

JSCell* cell = arguments.asCell();

switch (cell->type()) {

case DirectArgumentsType:

scope.release();

jsCast<DirectArguments*>(cell)->copyToArguments(globalObject, firstElementDest, offset, length);

return;

case ScopedArgumentsType:

scope.release();

jsCast<ScopedArguments*>(cell)->copyToArguments(globalObject, firstElementDest, offset, length);

return;

case ClonedArgumentsType:

scope.release();

jsCast<ClonedArguments*>(cell)->copyToArguments(globalObject, firstElementDest, offset, length);

return;

case JSImmutableButterflyType:

scope.release();

jsCast<JSImmutableButterfly*>(cell)->copyToArguments(globalObject, firstElementDest, offset, length);

return;

default: {

ASSERT(arguments.isObject());

JSObject* object = jsCast<JSObject*>(cell);

if (isJSArray(object)) {

scope.release();

jsCast<JSArray*>(object)->copyToArguments(globalObject, firstElementDest, offset, length);

return;

}

unsigned i;

for (i = 0; i < length && object->canGetIndexQuickly(i + offset); ++i)

firstElementDest[i] = object->getIndexQuickly(i + offset);

for (; i < length; ++i) {

JSValue value = object->get(globalObject, i + offset);

RETURN_IF_EXCEPTION(scope, void());

firstElementDest[i] = value;

}

return;

}

}

{

VirtualRegister calleeFrameOffset(newCallFrame - callFrame);

loadVarargs(

globalObject,

bitwise_cast<JSValue*>(&callFrame->r(calleeFrameOffset + CallFrame::argumentOffset(0))),

arguments, offset, length);

newCallFrame->setArgumentCountIncludingThis(length + 1);

{

setupVarargsFrame(globalObject, callFrame, newCallFrame, arguments, firstVarArgOffset, length);

newCallFrame->setThisValue(thisValue);

{

ASSERT(length == execCaller->argumentCount());

unsigned offset = execCaller->argumentOffset(0) * sizeof(Register);

memcpy(reinterpret_cast<char*>(execCallee) + offset, reinterpret_cast<char*>(execCaller) + offset, length * sizeof(Register));

execCallee->setArgumentCountIncludingThis(length + 1);

{

setupForwardArgumentsFrame(globalObject, execCaller, execCallee, length);

execCallee->setThisValue(thisValue);

{

#if ENABLE(COMPUTED_GOTO_OPCODES)

return opcode != HashTraits<Opcode>::emptyValue()

&& !HashTraits<Opcode>::isDeletedValue(opcode)

&& opcodeIDTable().contains(opcode);

#else

return opcode >= 0 && opcode <= op_end;

#endif

GetStackTraceFunctor(VM& vm, JSCell* owner, Vector<StackFrame>& results, size_t framesToSkip, size_t frameCountInResults)

: m_vm(vm)

, m_owner(owner)

, m_results(results)

, m_framesToSkip(framesToSkip)

, m_frameCountInResults(frameCountInResults)

{

}

IterationStatus operator()(StackVisitor& visitor) const

{

if (m_framesToSkip > 0) {

m_framesToSkip--;

return IterationStatus::Continue;

}

if (visitor->isImplementationVisibilityPrivate())

return IterationStatus::Continue;

if (m_frameCountInResults < m_results.size()) {

if (visitor->isNativeCalleeFrame()) {

auto* nativeCallee = visitor->callee().asNativeCallee();

switch (nativeCallee->category()) {

case NativeCallee::Category::Wasm: {

m_results[m_frameCountInResults++] = StackFrame(visitor->wasmFunctionIndexOrName());

break;

}

case NativeCallee::Category::InlineCache: {

break;

}

}

} else if (!!visitor->codeBlock() && !visitor->codeBlock()->unlinkedCodeBlock()->isBuiltinFunction())

m_results[m_frameCountInResults++] = StackFrame(m_vm, m_owner, visitor->callee().asCell(), visitor->codeBlock(), visitor->bytecodeIndex());

else

m_results[m_frameCountInResults++] = StackFrame(m_vm, m_owner, visitor->callee().asCell());

return IterationStatus::Continue;

}

return IterationStatus::Done;

}

size_t frameCountInResults() const { return m_frameCountInResults; }

VM& m_vm;

JSCell* m_owner;

Vector<StackFrame>& m_results;

mutable size_t m_framesToSkip;

mutable size_t m_frameCountInResults;

{

DisallowGC disallowGC;

VM& vm = this->vm();

CallFrame* callFrame = vm.topCallFrame;

if (!callFrame || !maxStackSize)

return;

size_t skippedFrames = 0;

size_t visitedFrames = 0;

auto isImplementationVisibilityPrivate = [&](CodeBlock* codeBlock) {

if (auto* executable = codeBlock->ownerExecutable())

return executable->implementationVisibility() != ImplementationVisibility::Public;

return false;

};

// This is OK since we never cause GC inside it (see DisallowGC).

Vector<std::tuple<CodeBlock*, BytecodeIndex>, 16> reconstructedFrames;

auto countFrame = [&](CodeBlock* codeBlock, BytecodeIndex bytecodeIndex) {

if (skippedFrames < framesToSkip) {

skippedFrames++;

return IterationStatus::Continue;

}

if (isImplementationVisibilityPrivate(codeBlock))

return IterationStatus::Continue;

reconstructedFrames.append(std::tuple { codeBlock, bytecodeIndex });

if (++visitedFrames < maxStackSize)

return IterationStatus::Continue;

return IterationStatus::Done;

};

if (!caller && ownerOfCallLinkInfo && callLinkInfo && callLinkInfo->isTailCall()) {

// Reconstruct the top frame from CallLinkInfo*

CodeBlock* codeBlock = jsDynamicCast<CodeBlock*>(ownerOfCallLinkInfo);

if (codeBlock) {

CodeOrigin codeOrigin = callLinkInfo->codeOrigin();

if (codeOrigin.inlineCallFrame()) {

for (auto currentCodeOrigin = &codeOrigin; currentCodeOrigin && currentCodeOrigin->inlineCallFrame(); currentCodeOrigin = currentCodeOrigin->inlineCallFrame()->getCallerSkippingTailCalls()) {

if (countFrame(baselineCodeBlockForInlineCallFrame(currentCodeOrigin->inlineCallFrame()), currentCodeOrigin->bytecodeIndex()) == IterationStatus::Done)

break;

}

} else

countFrame(codeBlock, codeOrigin.bytecodeIndex());

}

}

size_t skippedFramesInReconstructedFrames = skippedFrames;

bool foundCaller = !caller;

StackVisitor::visit(callFrame, vm, [&] (StackVisitor& visitor) -> IterationStatus {

if (skippedFrames < framesToSkip) {

skippedFrames++;

return IterationStatus::Continue;

}

if (!foundCaller) {

if (!visitor->callee().isNativeCallee() && visitor->callee().asCell() == caller)

foundCaller = true;

skippedFrames++;

return IterationStatus::Continue;

}

if (visitor->isImplementationVisibilityPrivate())

return IterationStatus::Continue;

if (++visitedFrames < maxStackSize)

return IterationStatus::Continue;

return IterationStatus::Done;

});

if (!visitedFrames)

return;

results.grow(visitedFrames);

unsigned index = 0;

for (auto [codeBlock, bytecodeIndex] : reconstructedFrames)

results[index++] = StackFrame(vm, owner, codeBlock, bytecodeIndex);

GetStackTraceFunctor functor(vm, owner, results, skippedFrames - skippedFramesInReconstructedFrames, reconstructedFrames.size());

StackVisitor::visit(callFrame, vm, functor);

ASSERT(functor.frameCountInResults() == results.size());

{

// FIXME: JSStringJoiner could be more efficient than StringBuilder here.

StringBuilder builder;

for (unsigned i = 0; i < stackTrace.size(); i++) {

builder.append(String(stackTrace[i].toString(vm)));

if (i != stackTrace.size() - 1)

builder.append('\n');

}

return builder.toString();

GetCatchHandlerFunctor()

: m_handler(nullptr)

{

}

HandlerInfo* handler() { return m_handler; }

IterationStatus operator()(StackVisitor& visitor) const

{

visitor.unwindToMachineCodeBlockFrame();

CodeBlock* codeBlock = visitor->codeBlock();

if (!codeBlock)

return IterationStatus::Continue;

m_handler = findExceptionHandler(visitor, codeBlock, RequiredHandler::CatchHandler);

if (m_handler)

return IterationStatus::Done;

return IterationStatus::Continue;

}

mutable HandlerInfo* m_handler;

{

m_valid = !!handler;

if (m_valid) {

m_type = handler->type();

#if ENABLE(JIT)

m_nativeCode = handler->nativeCode;

#endif

// handler->target is meaningless for getting a code offset when catching

// the exception in a DFG/FTL frame. This bytecode target offset could be

// something that's in an inlined frame, which means an array access

// with this bytecode offset in the machine frame is utterly meaningless

// and can cause an overflow. OSR exit properly exits to handler->target

// in the proper frame.

if (!JSC::JITCode::isOptimizingJIT(codeBlock->jitType()))

m_catchPCForInterpreter = { codeBlock->instructions().at(handler->target).ptr() };

else

m_catchPCForInterpreter = { static_cast<JSInstruction*>(nullptr) };

}

{

m_valid = !!handler;

if (m_valid) {

m_type = HandlerType::Catch;

#if ENABLE(JIT)

m_nativeCode = handler->m_nativeCode;

m_nativeCodeForDispatchAndCatch = nullptr;

#endif

m_catchPCForInterpreter = { static_cast<WasmInstruction*>(nullptr) };

if (callee->compilationMode() == Wasm::CompilationMode::LLIntMode)

m_catchPCForInterpreter = { static_cast<const Wasm::LLIntCallee*>(callee)->instructions().at(handler->m_target).ptr() };

else if (callee->compilationMode() == Wasm::CompilationMode::IPIntMode) {

m_catchPCForInterpreter = handler->m_target;

m_catchMetadataPCForInterpreter = handler->m_targetMetadata;

m_tryDepthForThrow = handler->m_tryDepth;

} else {

#if ENABLE(JIT)

m_nativeCode = Wasm::Thunks::singleton().stub(Wasm::catchInWasmThunkGenerator).template retagged<ExceptionHandlerPtrTag>().code();

m_nativeCodeForDispatchAndCatch = handler->m_nativeCode;

#endif

}

}

UnwindFunctor(VM& vm, CallFrame*& callFrame, bool isTermination, JSValue thrownValue, CodeBlock*& codeBlock, CatchInfo& handler, JSRemoteFunction*& seenRemoteFunction)

: m_vm(vm)

, m_callFrame(callFrame)

, m_isTermination(isTermination)

, m_codeBlock(codeBlock)

, m_handler(handler)

, m_seenRemoteFunction(seenRemoteFunction)

{

#if ENABLE(WEBASSEMBLY)

if (!m_isTermination) {

if (JSWebAssemblyException* wasmException = jsDynamicCast<JSWebAssemblyException*>(thrownValue)) {

m_catchableFromWasm = true;

m_wasmTag = &wasmException->tag();

} else if (ErrorInstance* error = jsDynamicCast<ErrorInstance*>(thrownValue))

m_catchableFromWasm = error->isCatchableFromWasm();

}

#else

UNUSED_PARAM(thrownValue);

#endif

}

IterationStatus operator()(StackVisitor& visitor) const

{

visitor.unwindToMachineCodeBlockFrame();

m_callFrame = visitor->callFrame();

m_codeBlock = visitor->codeBlock();

m_handler.m_valid = false;

if (m_codeBlock) {

if (!m_isTermination) {

m_handler = { findExceptionHandler(visitor, m_codeBlock, RequiredHandler::AnyHandler), m_codeBlock };

if (m_handler.m_valid)

return IterationStatus::Done;

}

}

CalleeBits callee = visitor->callee();

if (callee.isNativeCallee()) {

NativeCallee* nativeCallee = callee.asNativeCallee();

switch (nativeCallee->category()) {

case NativeCallee::Category::Wasm: {

#if ENABLE(WEBASSEMBLY)

if (m_catchableFromWasm) {

auto* wasmCallee = static_cast<Wasm::Callee*>(nativeCallee);

if (wasmCallee->hasExceptionHandlers()) {

Wasm::Instance* instance = m_callFrame->wasmInstance();

unsigned exceptionHandlerIndex = m_callFrame->callSiteIndex().bits();

m_handler = { wasmCallee->handlerForIndex(*instance, exceptionHandlerIndex, m_wasmTag), wasmCallee };

if (m_handler.m_valid)

return IterationStatus::Done;

}

}

#endif

break;

}

case NativeCallee::Category::InlineCache: {

break;

}

}

}

if (!m_callFrame->isNativeCalleeFrame() && JSC::isRemoteFunction(m_callFrame->jsCallee()) && !m_isTermination) {

// Continue searching for a handler, but mark that a marshalling function was on the stack so that we can

// translate the exception before jumping to the handler.

m_seenRemoteFunction = jsCast<JSRemoteFunction*>(m_callFrame->jsCallee());

}

notifyDebuggerOfUnwinding(m_vm, m_callFrame);

copyCalleeSavesToEntryFrameCalleeSavesBuffer(visitor);

bool shouldStopUnwinding = visitor->callerIsEntryFrame();

if (shouldStopUnwinding)

return IterationStatus::Done;

return IterationStatus::Continue;

}

void copyCalleeSavesToEntryFrameCalleeSavesBuffer(StackVisitor& visitor) const

{

#if ENABLE(ASSEMBLER)

std::optional<RegisterAtOffsetList> currentCalleeSaves = visitor->calleeSaveRegistersForUnwinding();

if (!currentCalleeSaves)

return;

RegisterAtOffsetList* allCalleeSaves = RegisterSetBuilder::vmCalleeSaveRegisterOffsets();

auto dontCopyRegisters = RegisterSetBuilder::stackRegisters();

CPURegister* frame = reinterpret_cast<CPURegister*>(m_callFrame->registers());

unsigned registerCount = currentCalleeSaves->registerCount();

VMEntryRecord* record = vmEntryRecord(m_vm.topEntryFrame);

for (unsigned i = 0; i < registerCount; i++) {

RegisterAtOffset currentEntry = currentCalleeSaves->at(i);

if (dontCopyRegisters.contains(currentEntry.reg(), IgnoreVectors))

continue;

RegisterAtOffset* calleeSavesEntry = allCalleeSaves->find(currentEntry.reg());

if (!calleeSavesEntry) {

if constexpr (!isARM_THUMB2())

RELEASE_ASSERT_NOT_REACHED();

// This can happen on ARMv7, because there are more callee save

// registers in the system convention than in the VM convention,

// so frames generated by Air callees might restore any system

// callee-save registers and we don't know the correct offset to

// restore them to in the destination record if the register is

// not callee-save in the VM convention.

// Luckily, it is correct for us to drop these--since the

// Air-generated callee is only expected to preserve the VM

// callee registers (when called from the VM), it doesn't need

// to appear to preserve the non-VM-callee-saves if we unwind

// its frame.

continue;

}

record->calleeSaveRegistersBuffer[calleeSavesEntry->offsetAsIndex()] = *(frame + currentEntry.offsetAsIndex());

}

#else

UNUSED_PARAM(visitor);

#endif

}

ALWAYS_INLINE static void notifyDebuggerOfUnwinding(VM& vm, CallFrame* callFrame)

{

JSGlobalObject* globalObject = callFrame->lexicalGlobalObject(vm);

Debugger* debugger = globalObject->debugger();

if (LIKELY(!debugger))

return;

DeferTermination deferScope(vm);

auto catchScope = DECLARE_CATCH_SCOPE(vm);

SuspendExceptionScope scope(vm);

if (callFrame->isNativeCalleeFrame()

|| (callFrame->callee().isCell() && callFrame->callee().asCell()->inherits<JSFunction>()))

debugger->unwindEvent(callFrame);

else

debugger->didExecuteProgram(callFrame);

catchScope.assertNoException();

}

VM& m_vm;

CallFrame*& m_callFrame;

bool m_isTermination;

CodeBlock*& m_codeBlock;

CatchInfo& m_handler;

#if ENABLE(WEBASSEMBLY)

const Wasm::Tag* m_wasmTag { nullptr };

bool m_catchableFromWasm { false };

#endif

JSRemoteFunction*& m_seenRemoteFunction;

{

ASSERT(vm.traps().isDeferringTermination());

auto scope = DECLARE_THROW_SCOPE(vm);

ASSERT(exception);

ASSERT(!vm.isTerminationException(exception));

JSGlobalObject* globalObject = remoteFunction->globalObject();

JSValue exceptionValue = exception->value();

scope.clearException();

// Avoid user-observable ToString()

String exceptionString;

if (exceptionValue.isPrimitive())

exceptionString = exceptionValue.toWTFString(globalObject);

else if (exceptionValue.asCell()->inherits<ErrorInstance>())

exceptionString = static_cast<ErrorInstance*>(exceptionValue.asCell())->sanitizedMessageString(globalObject);

EXCEPTION_ASSERT(!scope.exception()); // We must not have entered JS at this point

if (exceptionString.length()) {

throwVMTypeError(globalObject, scope, exceptionString);

return;

}

throwVMTypeError(globalObject, scope);

{

// If we're unwinding the stack due to a regular exception (not a TerminationException), then

// we want to use a DeferTerminationForAWhile scope. This is because we want to avoid a

// TerminationException being raised (due to a concurrent termination request) in the middle

// of unwinding. The unwinding code only checks if we're handling a TerminationException before

// it starts unwinding and is not expecting this status to change in the middle. Without the

// DeferTerminationForAWhile scope, control flow may end up in an exception handler, and effectively

// "catch" the newly raised TerminationException, which should not be catchable.

//

// On the other hand, if we're unwinding the stack due to a TerminationException, we do not need

// nor want the DeferTerminationForAWhile scope. This is because on exit, DeferTerminationForAWhile

// will set the VMTraps NeedTermination bit if termination is in progress. The system expects the

// NeedTermination bit to be have been cleared by VMTraps::handleTraps() once the TerminationException

// has been raised. Some legacy client apps relies on this and expects to be able to re-enter the

// VM after it exits due to termination. If the NeedTermination bit is set, upon re-entry, the

// VM will behave as if a termination request is pending and terminate almost immediately, thereby

// breaking the legacy client apps.

//

// FIXME: Revisit this once we can deprecate this legacy behavior of being able to re-enter the VM

// after termination.

std::optional<DeferTerminationForAWhile> deferScope;

if (!vm.isTerminationException(exception))

deferScope.emplace(vm);

auto scope = DECLARE_CATCH_SCOPE(vm);

ASSERT(reinterpret_cast<void*>(callFrame) != vm.topEntryFrame);

CodeBlock* codeBlock = callFrame->isNativeCalleeFrame() ? nullptr : callFrame->codeBlock();

JSValue exceptionValue = exception->value();

ASSERT(!exceptionValue.isEmpty());

ASSERT(!exceptionValue.isCell() || exceptionValue.asCell());

// This shouldn't be possible (hence the assertions), but we're already in the slowest of

// slow cases, so let's harden against it anyway to be safe.

if (exceptionValue.isEmpty() || (exceptionValue.isCell() && !exceptionValue.asCell()))

exceptionValue = jsNull();

EXCEPTION_ASSERT_UNUSED(scope, scope.exception());

// Calculate an exception handler vPC, unwinding call frames as necessary.

CatchInfo catchInfo;

JSRemoteFunction* seenRemoteFunction = nullptr;

UnwindFunctor functor(vm, callFrame, vm.isTerminationException(exception), exceptionValue, codeBlock, catchInfo, seenRemoteFunction);

StackVisitor::visit<StackVisitor::TerminateIfTopEntryFrameIsEmpty>(callFrame, vm, functor);

if (seenRemoteFunction) {

ASSERT(!vm.isTerminationException(exception));

sanitizeRemoteFunctionException(vm, seenRemoteFunction, exception);

exception = scope.exception(); // clear m_needExceptionCheck

}

if (vm.hasCheckpointOSRSideState())

vm.popAllCheckpointOSRSideStateUntil(callFrame);

return catchInfo;

{

ASSERT(!vm.isTerminationException(exception));

Debugger* debugger = globalObject->debugger();

if (debugger && debugger->needsExceptionCallbacks() && !exception->didNotifyInspectorOfThrow()) {

// This code assumes that if the debugger is enabled then there is no inlining.

// If that assumption turns out to be false then we'll ignore the inlined call

// frames.

// https://bugs.webkit.org/show_bug.cgi?id=121754

GetCatchHandlerFunctor functor;

if (callFrame)

StackVisitor::visit(callFrame, vm, functor);

HandlerInfo* handler = functor.handler();

ASSERT(!handler || handler->isCatchHandler());

bool hasCatchHandler = !!handler;

debugger->exception(globalObject, callFrame, exception->value(), hasCatchHandler);

}

exception->setDidNotifyInspectorOfThrow();

{

if (Options::crashOnDisallowedVMEntry() || g_jscConfig.vmEntryDisallowed)

CRASH_WITH_EXTRA_SECURITY_IMPLICATION_AND_INFO(VMEntryDisallowed, "VM entry disallowed"_s);

return jsUndefined();

{

VM& vm = this->vm();

auto throwScope = DECLARE_THROW_SCOPE(vm);

JSScope* scope = thisObj->globalObject()->globalScope();

JSGlobalObject* globalObject = scope->globalObject();

JSCallee* globalCallee = globalObject->globalCallee();

VMEntryScope entryScope(vm, globalObject);

auto clobberizeValidator = makeScopeExit([&] {

vm.didEnterVM = true;

});

ProgramExecutable* program = ProgramExecutable::create(globalObject, source);

EXCEPTION_ASSERT(throwScope.exception() || program);

RETURN_IF_EXCEPTION(throwScope, { });

ASSERT(!vm.isCollectorBusyOnCurrentThread());

RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());

if (UNLIKELY(!vm.isSafeToRecurseSoft()))

return throwStackOverflowError(globalObject, throwScope);

if (UNLIKELY(vm.disallowVMEntryCount))

return checkVMEntryPermission();

// First check if the "program" is actually just a JSON object. If so,

// we'll handle the JSON object here. Else, we'll handle real JS code

// below at failedJSONP.

Vector<JSONPData> JSONPData;

bool parseResult;

StringView programSource = program->source().view();

// Skip JSONP if the program is tainted. We want there to be a tainted

// frame on the stack in case the program does an eval via a setter.

if (source.provider()->sourceTaintedOrigin() != SourceTaintedOrigin::Untainted)

goto failedJSONP;

if (programSource.isNull())

return jsUndefined();

if (programSource.is8Bit()) {

LiteralParser literalParser(globalObject, programSource.span8(), JSONP);

parseResult = literalParser.tryJSONPParse(JSONPData, globalObject->globalObjectMethodTable()->supportsRichSourceInfo(globalObject));

} else {

LiteralParser literalParser(globalObject, programSource.span16(), JSONP);

parseResult = literalParser.tryJSONPParse(JSONPData, globalObject->globalObjectMethodTable()->supportsRichSourceInfo(globalObject));

}

// FIXME: The patterns to trigger JSONP fast path should be more idiomatic.

// https://bugs.webkit.org/show_bug.cgi?id=243578

RETURN_IF_EXCEPTION(throwScope, { });

if (parseResult) {

JSValue result;

for (unsigned entry = 0; entry < JSONPData.size(); entry++) {

Vector<JSONPPathEntry> JSONPPath;

JSONPPath.swap(JSONPData[entry].m_path);

JSValue JSONPValue = JSONPData[entry].m_value.get();

if (JSONPPath.size() == 1 && JSONPPath[0].m_type == JSONPPathEntryTypeDeclareVar) {

if (UNLIKELY(!globalObject->isStructureExtensible()))

goto failedJSONP;

globalObject->createGlobalVarBinding<BindingCreationContext::Global>(JSONPPath[0].m_pathEntryName);

RETURN_IF_EXCEPTION(throwScope, { });

PutPropertySlot slot(globalObject);

globalObject->methodTable()->put(globalObject, globalObject, JSONPPath[0].m_pathEntryName, JSONPValue, slot);

RETURN_IF_EXCEPTION(throwScope, { });

result = jsUndefined();

continue;

}

JSValue baseObject(globalObject);

for (unsigned i = 0; i < JSONPPath.size() - 1; i++) {

ASSERT(JSONPPath[i].m_type != JSONPPathEntryTypeDeclareVar);

switch (JSONPPath[i].m_type) {

case JSONPPathEntryTypeDot: {

if (i == 0) {

RELEASE_ASSERT(baseObject == globalObject);

auto doGet = [&] (JSSegmentedVariableObject* scope) {