Attachment 340737 Details for Bug 185786 – proposed patch.

[patch] proposed patch.

bug-185786.patch (text/plain), 2.73 KB, created by Mark Lam on 2018-05-18 14:33:16 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Lam

Created: 2018-05-18 14:33:16 PDT

Size: 2.73 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 231982)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2018-05-18  Mark Lam  <mark.lam@apple.com>
>+
>+        Add missing exception check.
>+        https://bugs.webkit.org/show_bug.cgi?id=185786
>+        <rdar://problem/35686560>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/regress-185786.js: Added.
>+
> 2018-05-16  Filip Pizlo  <fpizlo@apple.com>
> 
>         JSC should have InstanceOf inline caching
>Index: JSTests/stress/regress-185786.js
>===================================================================
>--- JSTests/stress/regress-185786.js	(nonexistent)
>+++ JSTests/stress/regress-185786.js	(working copy)
>@@ -0,0 +1,22 @@
>+function foo() {
>+    return new Proxy({},
>+        new Proxy({}, {
>+            get: function () {
>+                throw "expected exception";
>+            }
>+        })
>+    ); 
>+}
>+
>+var a = foo();
>+var b = Object.create(a);
>+
>+var exception;
>+try {
>+    for (var v in b) { }
>+} catch (e) {
>+    exception = e;
>+}
>+
>+if (exception != "expected exception")
>+    throw "FAIL";
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 231980)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2018-05-18  Mark Lam  <mark.lam@apple.com>
>+
>+        Add missing exception check.
>+        https://bugs.webkit.org/show_bug.cgi?id=185786
>+        <rdar://problem/35686560>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * runtime/JSPropertyNameEnumerator.h:
>+        (JSC::propertyNameEnumerator):
>+
> 2018-05-18  Yusuke Suzuki  <utatane.tea@gmail.com>
> 
>         Unreviewed, fix exception checking, part 2
>Index: Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h
>===================================================================
>--- Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h	(revision 231980)
>+++ Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h	(working copy)
>@@ -122,14 +122,13 @@ inline JSPropertyNameEnumerator* propert
>         numberStructureProperties = propertyNames.size();
> 
>         base->methodTable(vm)->getGenericPropertyNames(base, exec, propertyNames, EnumerationMode());
>-        scope.assertNoException();
>     } else {
>         // Generic property names vector contains all indexed property names.
>         // So disable indexed property enumeration phase by setting |indexedLength| to 0.
>         indexedLength = 0;
>         base->methodTable(vm)->getPropertyNames(base, exec, propertyNames, EnumerationMode());
>-        RETURN_IF_EXCEPTION(scope, nullptr);
>     }
>+    RETURN_IF_EXCEPTION(scope, nullptr);
> 
>     ASSERT(propertyNames.size() < UINT32_MAX);
>

Flags:

msaboff: review+

Actions: View | Formatted Diff | Diff

Attachments on bug 185786: 340737