Check exceptions between static property builders, in the JSONL parse loop and in the JSONP fast path

[robobun]

Problem

• Three JSC paths run a second throwing operation, or return from a ThrowScope, while the previous throwing call has not been checked. A debug build aborts on each under validateExceptionChecks=1: ERROR: Unchecked JS exception from JSC::VM::verifyExceptionCheckNeedIsSatisfied.
• JSObject::reifyAllStaticProperties (JSObject.cpp:2978) and setUpStaticFunctionSlot (Lookup.cpp:73) read vm.exceptionForInspection() after a PropertyCallback builder. That read is not a check, so a builder with its own ThrowScope leaves the check pending and the next builder's scope constructor asserts. Bun's node:module and Bun.sql lazy properties are built this way (bun's test/no-validate-exceptions.txt lists 8 tests for this).
• LiteralParser::tryStreamingParse (LiteralParser.cpp:1985) calls parseRecursively per line with no scope and no check. Interpreter::executeProgram's JSONP doGet lambda (Interpreter.cpp:1135) calls PropertySlot::getValue after getPropertySlot with no check.

Fix

• The two reify sites use vm.exception(), which is the check the builder's scope needs. Behavior is unchanged: both already returned early on a pending exception.
• tryStreamingParse declares a ThrowScope and checks after each value. An out-of-memory or stack-overflow exception is no longer reported as Status::Error with the exception still pending; the caller (Bun.JSONL.parse in bun, which checks right after streamingJSONParse) reports it.
• doGet checks between getPropertySlot and getValue. Both call sites already check right after doGet.
• Verified: read against the validator's rules in ThrowScope.cpp / VM::verifyExceptionCheckNeedIsSatisfied. I could not build JSC in the environment this was written in; CI is the build check. The bun side reproduces the first case with BUN_JSC_validateExceptionChecks=1 bun -e 'Bun.sql' on a debug build.

Background

• BUN_JSC_validateExceptionChecks=1 makes every ThrowScope destructor set VM::m_needExceptionCheck. The next ThrowScope constructor or non-released destructor asserts if the bit is still set. Only VM::exception() (and clearException) clears it. exceptionForInspection() reads m_exception without touching the bit, for code that explicitly must not count as a check.
• A static hash table PropertyCallback builder has the signature JSValue(VM&, JSObject*), so it cannot propagate an exception to reifyStaticProperty. The bun fork already lets it return empty with an exception pending; the two callers check and stop. This change only makes that check visible to the validator.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{On-demand reviews are free for the next 27 days. After that, they cost $0.25 per reviewed file.}

Or wait 4 minutes for your next included review.

View limit details

Limit details: You’ve used all 5 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4e11869a-0e09-4e35-b8d0-2e1bfb12b626

📥 Commits

Reviewing files that changed from the base of the PR and between 94c452c and 98cb92f.

📒 Files selected for processing (4)

• Source/JavaScriptCore/interpreter/Interpreter.cpp
• Source/JavaScriptCore/runtime/JSObject.cpp
• Source/JavaScriptCore/runtime/LiteralParser.cpp
• Source/JavaScriptCore/runtime/Lookup.cpp

---

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

🔴 VM::exception() is private (VM.h:1235, inside the private: block at 1205–1289) and only reachable through the fixed friend list at VM.h:1396–1407 — neither setUpStaticFunctionSlot nor JSObject is on it, so this line and the matching call at Source/JavaScriptCore/runtime/JSObject.cpp:2981 will fail to compile with "'exception' is a private member of 'JSC::VM'". The intent (making the read count as a validator check) is right, but it needs to go through an ExceptionScope — e.g. declare a local DECLARE_CATCH_SCOPE and test scope.exception() — rather than calling the private member directly.

Extended reasoning...

What the bug is

The PR replaces vm.exceptionForInspection() with vm.exception() at two sites — setUpStaticFunctionSlot (Lookup.cpp:74) and JSObject::reifyAllStaticProperties (JSObject.cpp:2981) — to make the post-builder exception read count as a check for validateExceptionChecks=1. However, VM::exception() is a private member of class VM, so both call sites fail to compile.

Where it lives in the header

In Source/JavaScriptCore/runtime/VM.h:

• private: opens at line 1205.
• Exception* exception() const is declared at line 1235.
• The next public: is at line 1290.

So exception() sits squarely in a private section. By contrast, exceptionForInspection() (line 850) is in the public section that opens at line 473, which is why the pre-PR code compiled.

Access to VM::exception() is granted only via the friend list at VM.h:1396–1407: Heap, ExceptionScope, TopExceptionScope, ThrowScope, JSDollarVMHelper, LLIntOffsetsExtractor, TerminationDeadline, SuspendExceptionScope, FFI::CallbackEntryScope, and VMTraps. Neither the free function setUpStaticFunctionSlot nor the class JSObject appears there.

Why nothing else saves it

A repo-wide grep for bare vm.exception() shows every other real call site is inside one of those friends (e.g. Heap.cpp, ThrowScope.cpp, ExceptionScope.h, TopExceptionScope.h); the two lines this PR introduces are the only non-friend callers. There is no macro, using, or alternate declaration that would make exception() visible here. The PR description itself notes the author could not build JSC locally ("CI is the build check"), which is why this slipped through.

Step-by-step proof

1. Compiler processes Lookup.cpp → includes JSCInlines.h → transitively VM.h.
2. At Lookup.cpp:74, inside the free function bool JSC::setUpStaticFunctionSlot(...), the expression vm.exception() performs member access on a VM&.
3. Name lookup finds VM::exception() at VM.h:1235; access checking sees it is private and the enclosing context is not VM, not a derived class, and not a friend.
4. Compilation aborts with error: 'exception' is a private member of 'JSC::VM'.
5. The identical failure occurs independently at JSObject.cpp:2981 inside JSObject::reifyAllStaticProperties (JSObject is not a friend of VM).

Impact

Hard build break on every platform/configuration — the PR cannot merge green.

How to fix

The goal is to clear VM::m_needExceptionCheck, which VM::exception() does but exceptionForInspection() does not. The public route to that is an ExceptionScope: ExceptionScope::exception() calls m_vm.exception() via friendship. Concretely, declare a local scope and read through it, e.g.:

auto catchScope = DECLARE_CATCH_SCOPE(vm);
reifyStaticProperty(...);
if (catchScope.exception()) [[unlikely]]
    return ...;

A CatchScope is preferable to a ThrowScope at both sites — the existing comment in Lookup.cpp already explains why a ThrowScope is undesirable there (it would simulate a throw on every first static-table lookup), and reifyAllStaticProperties similarly notes "No ThrowScope here". Alternatively, thread an ExceptionScope& in from the caller if one is already in hand.