Attachment 368740 Details for Bug 197485 – Patch

[patch] Patch

197485.patch (text/plain), 4.20 KB, created by Michael Saboff on 2019-05-01 17:54:32 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Saboff

Created: 2019-05-01 17:54:32 PDT

Size: 4.20 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 244861)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,15 @@
>+2019-05-01  Michael Saboff  <msaboff@apple.com>
>+
>+        ASSERTION FAILED: !m_needExceptionCheck with --validateExceptionChecks=1; ProxyObject.getOwnPropertySlotCommon/JSFunction.callerGetter
>+        https://bugs.webkit.org/show_bug.cgi?id=197485
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        New test.
>+
>+        * stress/proxy-getOwnPropertySlots-exceptionChecks.js: Added.
>+        (foo):
>+
> 2019-05-01  Ross Kirsling  <ross.kirsling@sony.com>
> 
>         Unreviewed correction to Test262 expectations following r244828.
>Index: JSTests/stress/proxy-getOwnPropertySlots-exceptionChecks.js
>===================================================================
>--- JSTests/stress/proxy-getOwnPropertySlots-exceptionChecks.js	(nonexistent)
>+++ JSTests/stress/proxy-getOwnPropertySlots-exceptionChecks.js	(working copy)
>@@ -0,0 +1,9 @@
>+//@ runWithoutBaseOption("default", "--validateExceptionChecks=1")
>+
>+// This test that we have appropriate exception check processing Proxy.getOwnPropertySlots
>+
>+function foo()
>+{
>+}
>+
>+let a = {...new Proxy(foo, {})}
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 244848)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,17 @@
>+2019-05-01  Michael Saboff  <msaboff@apple.com>
>+
>+        ASSERTION FAILED: !m_needExceptionCheck with --validateExceptionChecks=1; ProxyObject.getOwnPropertySlotCommon/JSFunction.callerGetter
>+        https://bugs.webkit.org/show_bug.cgi?id=197485
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Fix exceptions scopes that call into Proxy.getOwnPropertySlot() to properly check for exceptions.
>+
>+        * runtime/JSGlobalObjectFunctions.cpp:
>+        (JSC::globalFuncPropertyIsEnumerable):
>+        * runtime/JSObject.cpp:
>+        (JSC::JSObject::getOwnPropertyDescriptor):
>+
> 2019-05-01  Darin Adler  <darin@apple.com>
> 
>         WebKit has too much of its own UTF-8 code and should rely more on ICU's UTF-8 support
>Index: Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp	(revision 244848)
>+++ Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp	(working copy)
>@@ -835,9 +835,10 @@ EncodedJSValue JSC_HOST_CALL globalFuncP
>     auto propertyName = exec->uncheckedArgument(1).toPropertyKey(exec);
>     RETURN_IF_EXCEPTION(scope, encodedJSValue());
> 
>-    scope.release();
>     PropertyDescriptor descriptor;
>     bool enumerable = object->getOwnPropertyDescriptor(exec, propertyName, descriptor) && descriptor.enumerable();
>+
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>     return JSValue::encode(jsBoolean(enumerable));
> }
> 
>Index: Source/JavaScriptCore/runtime/JSObject.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSObject.cpp	(revision 244848)
>+++ Source/JavaScriptCore/runtime/JSObject.cpp	(working copy)
>@@ -3441,9 +3441,12 @@ static JSCustomGetterSetterFunction* get
> bool JSObject::getOwnPropertyDescriptor(ExecState* exec, PropertyName propertyName, PropertyDescriptor& descriptor)
> {
>     VM& vm = exec->vm();
>+    auto scope = DECLARE_THROW_SCOPE(vm);
>+
>     JSC::PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
>     if (!methodTable(vm)->getOwnPropertySlot(this, exec, propertyName, slot))
>         return false;
>+    RETURN_IF_EXCEPTION(scope, false);
> 
>     // DebuggerScope::getOwnPropertySlot() (and possibly others) may return attributes from the prototype chain
>     // but getOwnPropertyDescriptor() should only work for 'own' properties so we exit early if we detect that
>@@ -3490,6 +3493,8 @@ bool JSObject::getOwnPropertyDescriptor(
>             descriptor.setSetter(getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, getterSetter, JSCustomGetterSetterFunction::Type::Setter));
>     } else
>         descriptor.setDescriptor(slot.getValue(exec, propertyName), slot.attributes());
>+
>+    RETURN_IF_EXCEPTION(scope, false);
>     return true;
> }
>

Flags:

saam: review-

Actions: View | Formatted Diff | Diff

Attachments on bug 197485: 368740 | 368745 | 368747