Fix missing exception check in ProxyObject::performGetPrototype

[robobun]

Summary

When the Proxy's handler doesn't have a getPrototypeOf trap, we call target->getPrototype(globalObject) directly. This can throw an exception (e.g., stack overflow when the target is also a Proxy with a recursive chain), but the code was using RELEASE_AND_RETURN which releases the throw scope without checking for exceptions first.

This fix properly checks for exceptions after the getPrototype call before returning, which satisfies WebKit's exception check validation (enabled via validateExceptionChecks).

Changes

-    if (getPrototypeOfMethod.isUndefined()) 
-        RELEASE_AND_RETURN(scope, target->getPrototype(globalObject));
+    if (getPrototypeOfMethod.isUndefined()) {
+        JSValue result = target->getPrototype(globalObject);
+        RETURN_IF_EXCEPTION(scope, { });
+        return result;
+    }

Test case

This test in Bun reproduces the issue:

it("stack overflow exception checks", () => {
  function probe(value) {
    let originalPrototype, newPrototype;
    let handler = {
      set(target, key, value, receiver) {
        return Reflect.set(target, key, value, receiver);
      },
    };
    originalPrototype = Object.getPrototypeOf(value);
    newPrototype = new Proxy(originalPrototype, handler);
    Object.setPrototypeOf(value, newPrototype);
  }
  class Foo {
    get bar() {
      Bun.inspect(this);
    }
  }
  const foo = new Foo();
  probe(foo);
  expect(() => {
    foo.bar(Foo, foo);
  }).toThrow("Maximum call stack size exceeded");
});

When run with BUN_JSC_validateExceptionChecks=1, this triggers:

ASSERTION FAILED: exception check validation failed
performGetPrototype @ vendor/WebKit/Source/JavaScriptCore/runtime/ProxyObject.cpp:1230

🤖 Generated with Claude Code

[coderabbitai]

Walkthrough

Modified ProxyObject::performGetPrototype to adjust exception handling when getPrototypeOfMethod is undefined, replacing RELEASE_AND_RETURN with separate RETURN_IF_EXCEPTION check after obtaining the target prototype.

Changes

Cohort / File(s)	Summary
ProxyObject exception handling Source/JavaScriptCore/runtime/ProxyObject.cpp	Changed undefined trap code path in performGetPrototype from RELEASE_AND_RETURN pattern to computing prototype then using explicit RETURN_IF_EXCEPTION check

Pre-merge checks

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: adding a missing exception check in ProxyObject::performGetPrototype.
Description check	✅ Passed	The description provides context, explains the fix with code examples, and includes a test case demonstrating the issue, though it lacks the Bugzilla link and formal structure required by the WebKit template.

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between c3e10aa and c6f74a3.

📒 Files selected for processing (1)

• Source/JavaScriptCore/runtime/ProxyObject.cpp (1 hunks)

🧰 Additional context used

📓 Path-based instructions (3)

**/Source/JavaScriptCore/runtime/**/*.{h,cpp,mm}

📄 CodeRabbit inference engine (CLAUDE.md)

Add or modify runtime functions within the JavaScriptCore runtime/ directory

Files:

• Source/JavaScriptCore/runtime/ProxyObject.cpp

**/Source/JavaScriptCore/**/*.{cpp,mm}

📄 CodeRabbit inference engine (CLAUDE.md)

Use dataLog() for printf-style debugging in JavaScriptCore code

Files:

• Source/JavaScriptCore/runtime/ProxyObject.cpp

Source/JavaScriptCore/**/*.{cpp,h}

📄 CodeRabbit inference engine (Source/JavaScriptCore/CLAUDE.md)

Guard Bun-specific features with USE(BUN_JSC_ADDITIONS) and event-loop integration with USE(BUN_EVENT_LOOP)

Files:

• Source/JavaScriptCore/runtime/ProxyObject.cpp

🔇 Additional comments (1)

Source/JavaScriptCore/runtime/ProxyObject.cpp (1)

1248-1252: Exception handling fix in performGetPrototype looks correct and consistent

Switching from RELEASE_AND_RETURN(scope, target->getPrototype(globalObject)) to explicitly capturing the result, calling RETURN_IF_EXCEPTION(scope, { }), and then returning the value correctly ensures that any exception thrown by target->getPrototype(globalObject) is observed and propagated instead of being silently released. This aligns with the exception-handling patterns used elsewhere in this file (e.g., later getPrototype and isExtensible calls) and preserves the spec behavior for the “no getPrototypeOf trap” path when no exception occurs.

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}