Skip to content

[JSC][Temporal] Fix double-throw crash in Temporal constructors; clean up stress tests#66884

Open
hyjorc1 wants to merge 1 commit into
WebKit:mainfrom
hyjorc1:eng/JSC-Temporal-Fix-double-throw-crash-in-Temporal-constructors-clean-up-stress-tests
Open

[JSC][Temporal] Fix double-throw crash in Temporal constructors; clean up stress tests#66884
hyjorc1 wants to merge 1 commit into
WebKit:mainfrom
hyjorc1:eng/JSC-Temporal-Fix-double-throw-crash-in-Temporal-constructors-clean-up-stress-tests

Conversation

@hyjorc1

@hyjorc1 hyjorc1 commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

0594615

[JSC][Temporal] Fix double-throw crash in Temporal constructors; clean up stress tests
https://bugs.webkit.org/show_bug.cgi?id=316793
rdar://179110003

Reviewed by NOBODY (OOPS!).

toIntegerWithTruncation() can throw (e.g. when an argument's valueOf
triggers JS execution) and return NaN. PlainDate, PlainYearMonth, and
PlainMonthDay constructors placed RETURN_IF_EXCEPTION after the
!isfinite() guard, so when toIntegerWithTruncation() threw and returned
NaN, the isfinite check triggered throwVMRangeError on top of a pending
exception, crashing via verifyExceptionCheckNeedIsSatisfied. Fix by
moving RETURN_IF_EXCEPTION immediately after each
toIntegerWithTruncation() call.

Also remove stale //@ skip from temporal-calendar.js,
temporal-duration.js, and temporal-timezone.js now that Temporal is
complete, and enable the previously-FIXMEd ZonedDateTime.timeZoneId
and offset tests in temporal-timezone.js.

Test: JSTests/stress/temporal-plainyearmonth-constructor-exception-check.js

0594615

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows Apple Internal
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ⏳ 🛠 win ✅ 🛠 ios-apple
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ⏳ 🧪 win-tests ✅ 🛠 mac-apple
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe ✅ 🛠 vision-apple
⏳ 🧪 ios-wk2-wpt ⏳ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
loading 🛠 🧪 jsc-x86-64 ✅ 🧪 api-ios ✅ 🧪 mac-wk1 ✅ 🛠 gtk
⏳ 🛠 🧪 jsc-debug-arm64 loading 🛠 ios-safer-cpp ✅ 🧪 mac-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision loading-orange 🧪 mac-AS-debug-wk2 ✅ 🧪 api-gtk
✅ 🛠 vision-sim ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🧪 mac-intel-wk2 ✅ 🛠 jsc-armv7
✅ 🛠 tv loading 🛠 mac-safer-cpp ✅ 🧪 jsc-armv7-tests
✅ 🛠 tv-sim ✅ 🧪 mac-site-isolation
✅ 🛠 watch
✅ 🛠 watch-sim

…n up stress tests

https://bugs.webkit.org/show_bug.cgi?id=316793
rdar://179110003

Reviewed by NOBODY (OOPS!).

toIntegerWithTruncation() can throw (e.g. when an argument's valueOf
triggers JS execution) and return NaN. PlainDate, PlainYearMonth, and
PlainMonthDay constructors placed RETURN_IF_EXCEPTION after the
!isfinite() guard, so when toIntegerWithTruncation() threw and returned
NaN, the isfinite check triggered throwVMRangeError on top of a pending
exception, crashing via verifyExceptionCheckNeedIsSatisfied. Fix by
moving RETURN_IF_EXCEPTION immediately after each
toIntegerWithTruncation() call.

Also remove stale //@ skip from temporal-calendar.js,
temporal-duration.js, and temporal-timezone.js now that Temporal is
complete, and enable the previously-FIXMEd ZonedDateTime.timeZoneId
and offset tests in temporal-timezone.js.

Test: JSTests/stress/temporal-plainyearmonth-constructor-exception-check.js
@hyjorc1 hyjorc1 requested a review from a team as a code owner June 10, 2026 16:49
@hyjorc1 hyjorc1 self-assigned this Jun 10, 2026
@hyjorc1 hyjorc1 added the New Bugs Unclassified bugs are placed in this component until the correct component can be determined. label Jun 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

New Bugs Unclassified bugs are placed in this component until the correct component can be determined.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants