Mishandled JS exceptions?

[mateon1]

Emilio told me on IRC to report these.

15:11:37 - emilio: Mateon1: I've seen that happening when you mishandle an exception from the JS vm

This behavior, aka JS halting happens even with --debug-mozjs and --with-debug-assertions.

To demonstrate this:

<script>
console.log("before");
try {
  localStorage[0] = ""; // place other snippets here
} catch (e) {
  console.log("caught error " + e);
}
console.log("after");
</script>

Note that only "before" is printed. The execution stops, not even an exception was thrown.

In place of the commented line you can also try any of:

atob.call("", localStorage);
removeEventListener.call("", "");
alert.call("");
moveTo.call(128);
Date.now.call(1024);

[emilio]

Let me try to track this down this real quick...

[emilio]

Err, got distracted, and I can't run rr from servo from where I am apparently... will investigate though

[emilio]

So, in the first case, the generated code for Storage::defineProperty looks like:

unsafe extern fn defineProperty(cx: *mut JSContext, proxy: HandleObject, id: HandleId, desc: Handle<PropertyDescriptor>, opresult: *mut ObjectOpResult) -> bool {
    return wrap_panic(panic::AssertUnwindSafe(|| {
        if RUST_JSID_IS_STRING(id) {
            // ...
        } else {
            return false;
        }
    }), false);
}

Return false is used to signal when an exception has been thrown, otherwise aborts the execution of the script. So we need to throw something there or otherwise the execution stops. I suspect there are similar errors in the other examples, if not the same. Looking for those

[emilio]

#18539