mirror of
https://github.com/fergalmoran/ladybird.git
synced 2025-12-28 04:08:08 +00:00
LibJS: Pass Interpreter& to Value::to_number() et al.
This patch is unfortunately rather large and might make some things feel
bloated, but it is necessary to fix a few flaws in LibJS, primarily
blindly coercing values to numbers without exception checks - i.e.
interpreter.argument(0).to_i32(); // can fail!!!
Some examples where the interpreter would actually crash:
var o = { toString: () => { throw Error() } };
+o;
o - 1;
"foo".charAt(o);
"bar".repeat(o);
To fix this, we now have the following...
to_double(Interpreter&)
to_i32()
to_i32(Interpreter&)
to_size_t()
to_size_t(Interpreter&)
...and a whole lot of exception checking.
There's intentionally no to_double(), use as_double() directly instead.
This way we still can use these convenient utility functions but don't
need to check for exceptions if we are sure the value already is a
number.
Fixes #2267.
This commit is contained in:
committed by
Andreas Kling
parent
1a1394f7a2
commit
476094922b
@@ -74,7 +74,9 @@ void Array::length_setter(Interpreter& interpreter, Value value)
|
||||
auto* array = array_from(interpreter);
|
||||
if (!array)
|
||||
return;
|
||||
auto length = value.to_number();
|
||||
auto length = value.to_number(interpreter);
|
||||
if (interpreter.exception())
|
||||
return;
|
||||
if (length.is_nan() || length.is_infinity() || length.as_double() < 0) {
|
||||
interpreter.throw_exception<RangeError>("Invalid array length");
|
||||
return;
|
||||
|
||||
Reference in New Issue
Block a user