Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use correct lifetime for TryCatch::exception()/message() return value #380

Merged
merged 1 commit into from
May 24, 2020

Conversation

piscisaureus
Copy link
Member

According to v8.h, "the returned handle is valid until this TryCatch
block has been destroyed". This is incorrect, as can be demonstrated
with the test below. In practice the return value lives no longer and
no shorter than the active HandleScope at the time these methods are
called. An issue has been opened about this in the V8 bug tracker:
https://bugs.chromium.org/p/v8/issues/detail?id=10537.

fn try_catch_bad_lifetimes() {
  let _setup_guard = setup();
  let mut isolate = v8::Isolate::new(Default::default());
  let mut hs = v8::HandleScope::new(&mut isolate);
  let scope = hs.enter();
  let context = v8::Context::new(scope);
  let mut cs = v8::ContextScope::new(scope, context);
  let scope = cs.enter();
  let caught_msg_2 = {
    let mut try_catch = v8::TryCatch::new(scope);
    let try_catch = try_catch.enter();
    let caught_msg_1 = {
      let mut hs = v8::HandleScope::new(scope);
      let scope = hs.enter();

      // Throw exception #1.
      let msg_1 = v8::String::new(scope, "BOOM!").unwrap();
      let exc_1 = v8::Exception::type_error(scope, msg_1);
      scope.isolate().throw_exception(exc_1);
      // Catch exception #1.
      let caught_msg_1 = try_catch.message().unwrap();
      let caught_str_1 =
        caught_msg_1.get(scope).to_rust_string_lossy(scope);
      assert!(caught_str_1.contains("BOOM"));
      // Move `caught_msg_1` out of the HandleScope it was created in.
      // The borrow checker allows this because `caught_msg_1`'s
      // lifetime is contrained to not outlive the TryCatch, but it is
      // allowed to outlive the HandleScope that was active when the
      // exception was caught.
      caught_msg_1
    };
    // Next line crashes.
    let caught_str_1 =
      caught_msg_1.get(scope).to_rust_string_lossy(scope);
    assert!(caught_str_1.contains("BOOM"));

    // Throws exception #2.
    let msg_2 = v8::String::new(scope, "DANG!").unwrap();
    let exc_2 = v8::Exception::type_error(scope, msg_2);
    scope.isolate().throw_exception(exc_2);
    // Catch exception #2.
    let caught_msg_2 = try_catch.message().unwrap();
    let caught_str_2 =
      caught_msg_2.get(scope).to_rust_string_lossy(scope);
    assert!(caught_str_2.contains("DANG"));
    // Move `caught_msg_2` out of the extent of the TryCatch, but still
    // within the extent of its HandleScope. This is unnecessarily
    // rejected at compile time.
    caught_msg_2
  };
  let caught_str_2 =
    caught_msg_2.get(scope).to_rust_string_lossy(scope);
  assert!(caught_str_2.contains("DANG"));
}

piscisaureus added a commit to piscisaureus/safe_v8 that referenced this pull request May 24, 2020
…denoland#380)

According to v8.h, "the returned handle is valid until this TryCatch
block has been destroyed". This is incorrect, as can be demonstrated
with the test below. In practice the return value lives no longer and
no shorter than the active HandleScope at the time these methods are
called. An issue has been opened about this in the V8 bug tracker:
https://bugs.chromium.org/p/v8/issues/detail?id=10537.

```rust
fn try_catch_bad_lifetimes() {
  let _setup_guard = setup();
  let mut isolate = v8::Isolate::new(Default::default());
  let mut hs = v8::HandleScope::new(&mut isolate);
  let scope = hs.enter();
  let context = v8::Context::new(scope);
  let mut cs = v8::ContextScope::new(scope, context);
  let scope = cs.enter();
  let caught_msg_2 = {
    let mut try_catch = v8::TryCatch::new(scope);
    let try_catch = try_catch.enter();
    let caught_msg_1 = {
      let mut hs = v8::HandleScope::new(scope);
      let scope = hs.enter();

      // Throw exception #1.
      let msg_1 = v8::String::new(scope, "BOOM!").unwrap();
      let exc_1 = v8::Exception::type_error(scope, msg_1);
      scope.isolate().throw_exception(exc_1);
      // Catch exception #1.
      let caught_msg_1 = try_catch.message().unwrap();
      let caught_str_1 =
        caught_msg_1.get(scope).to_rust_string_lossy(scope);
      assert!(caught_str_1.contains("BOOM"));
      // Move `caught_msg_1` out of the HandleScope it was created in.
      // The borrow checker allows this because `caught_msg_1`'s
      // lifetime is contrained to not outlive the TryCatch, but it is
      // allowed to outlive the HandleScope that was active when the
      // exception was caught.
      caught_msg_1
    };
    // Next line crashes.
    let caught_str_1 =
      caught_msg_1.get(scope).to_rust_string_lossy(scope);
    assert!(caught_str_1.contains("BOOM"));

    // Throws exception denoland#2.
    let msg_2 = v8::String::new(scope, "DANG!").unwrap();
    let exc_2 = v8::Exception::type_error(scope, msg_2);
    scope.isolate().throw_exception(exc_2);
    // Catch exception denoland#2.
    let caught_msg_2 = try_catch.message().unwrap();
    let caught_str_2 =
      caught_msg_2.get(scope).to_rust_string_lossy(scope);
    assert!(caught_str_2.contains("DANG"));
    // Move `caught_msg_2` out of the extent of the TryCatch, but still
    // within the extent of its HandleScope. This is unnecessarily
    // rejected at compile time.
    caught_msg_2
  };
  let caught_str_2 =
    caught_msg_2.get(scope).to_rust_string_lossy(scope);
  assert!(caught_str_2.contains("DANG"));
}
```
…denoland#380)

According to v8.h, "the returned handle is valid until this TryCatch
block has been destroyed". This is incorrect, as can be demonstrated
with the test below. In practice the return value lives no longer and
no shorter than the active HandleScope at the time these methods are
called. An issue has been opened about this in the V8 bug tracker:
https://bugs.chromium.org/p/v8/issues/detail?id=10537.

```rust
fn try_catch_bad_lifetimes() {
  let _setup_guard = setup();
  let mut isolate = v8::Isolate::new(Default::default());
  let mut hs = v8::HandleScope::new(&mut isolate);
  let scope = hs.enter();
  let context = v8::Context::new(scope);
  let mut cs = v8::ContextScope::new(scope, context);
  let scope = cs.enter();
  let caught_msg_2 = {
    let mut try_catch = v8::TryCatch::new(scope);
    let try_catch = try_catch.enter();
    let caught_msg_1 = {
      let mut hs = v8::HandleScope::new(scope);
      let scope = hs.enter();

      // Throw exception #1.
      let msg_1 = v8::String::new(scope, "BOOM!").unwrap();
      let exc_1 = v8::Exception::type_error(scope, msg_1);
      scope.isolate().throw_exception(exc_1);
      // Catch exception #1.
      let caught_msg_1 = try_catch.message().unwrap();
      let caught_str_1 =
        caught_msg_1.get(scope).to_rust_string_lossy(scope);
      assert!(caught_str_1.contains("BOOM"));
      // Move `caught_msg_1` out of the HandleScope it was created in.
      // The borrow checker allows this because `caught_msg_1`'s
      // lifetime is contrained to not outlive the TryCatch, but it is
      // allowed to outlive the HandleScope that was active when the
      // exception was caught.
      caught_msg_1
    };
    // Next line crashes.
    let caught_str_1 =
      caught_msg_1.get(scope).to_rust_string_lossy(scope);
    assert!(caught_str_1.contains("BOOM"));

    // Throws exception denoland#2.
    let msg_2 = v8::String::new(scope, "DANG!").unwrap();
    let exc_2 = v8::Exception::type_error(scope, msg_2);
    scope.isolate().throw_exception(exc_2);
    // Catch exception denoland#2.
    let caught_msg_2 = try_catch.message().unwrap();
    let caught_str_2 =
      caught_msg_2.get(scope).to_rust_string_lossy(scope);
    assert!(caught_str_2.contains("DANG"));
    // Move `caught_msg_2` out of the extent of the TryCatch, but still
    // within the extent of its HandleScope. This is unnecessarily
    // rejected at compile time.
    caught_msg_2
  };
  let caught_str_2 =
    caught_msg_2.get(scope).to_rust_string_lossy(scope);
  assert!(caught_str_2.contains("DANG"));
}
```
@piscisaureus piscisaureus merged commit 56c3d9f into denoland:master May 24, 2020
@piscisaureus piscisaureus deleted the tcl branch May 24, 2020 23:06
@ry ry mentioned this pull request Jun 5, 2020
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant