WebKit Bugzilla
Attachment 369864 Details for
Bug 197885
: REGRESSION (r245249): ASSERTION FAILED: !m_needExceptionCheck seen with stress/proxy-delete.js and stress/proxy-property-descriptor.js
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
Patch
bug-197885-20190514191240.patch (text/plain), 2.63 KB, created by
Tadeu Zagallo
on 2019-05-14 10:12:42 PDT
(
hide
)
Description:
Patch
Filename:
MIME Type:
Creator:
Tadeu Zagallo
Created:
2019-05-14 10:12:42 PDT
Size:
2.63 KB
patch
obsolete
>Subversion Revision: 245285 >diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog >index c20f93b297301d070bcd59226ec0bcb8c89a6c11..da0912d3056566f8713ac2537f5ec46b52bce2cc 100644 >--- a/Source/JavaScriptCore/ChangeLog >+++ b/Source/JavaScriptCore/ChangeLog >@@ -1,3 +1,18 @@ >+2019-05-14 Tadeu Zagallo <tzagallo@apple.com> >+ >+ REGRESSION (r245249): ASSERTION FAILED: !m_needExceptionCheck seen with stress/proxy-delete.js and stress/proxy-property-descriptor.js >+ https://bugs.webkit.org/show_bug.cgi?id=197885 >+ <rdar://problem/50770190> >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ In r245249 we added a throw scope to JSObject::getOwnPropertyDescriptor and its >+ callers now need to check for exceptions. >+ >+ * runtime/ProxyObject.cpp: >+ (JSC::performProxyGet): >+ (JSC::ProxyObject::performDelete): >+ > 2019-05-13 Yusuke Suzuki <ysuzuki@apple.com> > > [JSC] Compress JIT related data more by using Packed<> >diff --git a/Source/JavaScriptCore/runtime/ProxyObject.cpp b/Source/JavaScriptCore/runtime/ProxyObject.cpp >index e78066e4d8cbfc7da7e16ae87cc7c44f1ab5b7c5..c7bb2dc3e1518328f8db3708e483bd22d40bf6cc 100644 >--- a/Source/JavaScriptCore/runtime/ProxyObject.cpp >+++ b/Source/JavaScriptCore/runtime/ProxyObject.cpp >@@ -167,7 +167,9 @@ static JSValue performProxyGet(ExecState* exec, ProxyObject* proxyObject, JSValu > RETURN_IF_EXCEPTION(scope, { }); > > PropertyDescriptor descriptor; >- if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) { >+ bool result = target->getOwnPropertyDescriptor(exec, propertyName, descriptor); >+ EXCEPTION_ASSERT(!scope.exception() || !result); >+ if (result) { > if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) { > if (!sameValue(exec, descriptor.value(), trapResult)) > return throwTypeError(exec, scope, "Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property"_s); >@@ -650,7 +652,9 @@ bool ProxyObject::performDelete(ExecState* exec, PropertyName propertyName, Defa > return false; > > PropertyDescriptor descriptor; >- if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) { >+ bool result = target->getOwnPropertyDescriptor(exec, propertyName, descriptor); >+ EXCEPTION_ASSERT(!scope.exception() || !result); >+ if (result) { > if (!descriptor.configurable()) { > throwVMTypeError(exec, scope, "Proxy handler's 'deleteProperty' method should return false when the target's property is not configurable"_s); > return false;
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 197885
: 369864