From 24565a7a34dcaf4efd960640369095587e786ad5 Mon Sep 17 00:00:00 2001 From: Fabrice Bellard Date: Wed, 13 Dec 2023 19:01:10 +0100 Subject: Fix AsyncGenerator.prototype.return error handling (bnoordhuis) --- lib/quickjs/quickjs.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) (limited to 'lib/quickjs/quickjs.c') diff --git a/lib/quickjs/quickjs.c b/lib/quickjs/quickjs.c index c68a8ab3..ccc8cf2f 100644 --- a/lib/quickjs/quickjs.c +++ b/lib/quickjs/quickjs.c @@ -19310,10 +19310,19 @@ static int js_async_generator_completed_return(JSContext *ctx, JSValue promise, resolving_funcs[2], resolving_funcs1[2]; int res; - promise = js_promise_resolve(ctx, ctx->promise_ctor, - 1, (JSValueConst *)&value, 0); - if (JS_IsException(promise)) - return -1; + // Can fail looking up JS_ATOM_constructor when is_reject==0. + promise = js_promise_resolve(ctx, ctx->promise_ctor, 1, &value, + /*is_reject*/0); + // A poisoned .constructor property is observable and the resulting + // exception should be delivered to the catch handler. + if (JS_IsException(promise)) { + JSValue err = JS_GetException(ctx); + promise = js_promise_resolve(ctx, ctx->promise_ctor, 1, &err, + /*is_reject*/1); + JS_FreeValue(ctx, err); + if (JS_IsException(promise)) + return -1; + } if (js_async_generator_resolve_function_create(ctx, JS_MKPTR(JS_TAG_OBJECT, s->generator), resolving_funcs1, -- cgit 1.4.1-2-gfad0