Attachment 369864 Details for Bug 197885 – Patch

[patch] Patch

bug-197885-20190514191240.patch (text/plain), 2.63 KB, created by Tadeu Zagallo on 2019-05-14 10:12:42 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Tadeu Zagallo

Created: 2019-05-14 10:12:42 PDT

Size: 2.63 KB

patch

obsolete

>Subversion Revision: 245285
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index c20f93b297301d070bcd59226ec0bcb8c89a6c11..da0912d3056566f8713ac2537f5ec46b52bce2cc 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,18 @@
>+2019-05-14  Tadeu Zagallo  <tzagallo@apple.com>
>+
>+        REGRESSION (r245249): ASSERTION FAILED: !m_needExceptionCheck seen with stress/proxy-delete.js and stress/proxy-property-descriptor.js
>+        https://bugs.webkit.org/show_bug.cgi?id=197885
>+        <rdar://problem/50770190>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        In r245249 we added a throw scope to JSObject::getOwnPropertyDescriptor and its
>+        callers now need to check for exceptions.
>+
>+        * runtime/ProxyObject.cpp:
>+        (JSC::performProxyGet):
>+        (JSC::ProxyObject::performDelete):
>+
> 2019-05-13  Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         [JSC] Compress JIT related data more by using Packed<>
>diff --git a/Source/JavaScriptCore/runtime/ProxyObject.cpp b/Source/JavaScriptCore/runtime/ProxyObject.cpp
>index e78066e4d8cbfc7da7e16ae87cc7c44f1ab5b7c5..c7bb2dc3e1518328f8db3708e483bd22d40bf6cc 100644
>--- a/Source/JavaScriptCore/runtime/ProxyObject.cpp
>+++ b/Source/JavaScriptCore/runtime/ProxyObject.cpp
>@@ -167,7 +167,9 @@ static JSValue performProxyGet(ExecState* exec, ProxyObject* proxyObject, JSValu
>     RETURN_IF_EXCEPTION(scope, { });
> 
>     PropertyDescriptor descriptor;
>-    if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
>+    bool result = target->getOwnPropertyDescriptor(exec, propertyName, descriptor);
>+    EXCEPTION_ASSERT(!scope.exception() || !result);
>+    if (result) {
>         if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) {
>             if (!sameValue(exec, descriptor.value(), trapResult))
>                 return throwTypeError(exec, scope, "Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property"_s);
>@@ -650,7 +652,9 @@ bool ProxyObject::performDelete(ExecState* exec, PropertyName propertyName, Defa
>         return false;
> 
>     PropertyDescriptor descriptor;
>-    if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
>+    bool result = target->getOwnPropertyDescriptor(exec, propertyName, descriptor);
>+    EXCEPTION_ASSERT(!scope.exception() || !result);
>+    if (result) {
>         if (!descriptor.configurable()) {
>             throwVMTypeError(exec, scope, "Proxy handler's 'deleteProperty' method should return false when the target's property is not configurable"_s);
>             return false;

Actions: View | Formatted Diff | Diff

Attachments on bug 197885: 369864