Attachment 343511 Details for Bug 187006 – proposed patch.

[patch] proposed patch.

bug-187006.patch (text/plain), 2.33 KB, created by Mark Lam on 2018-06-25 10:31:22 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Lam

Created: 2018-06-25 10:31:22 PDT

Size: 2.33 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 233151)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2018-06-25  Mark Lam  <mark.lam@apple.com>
>+
>+        Add missing exception check in RegExpObjectInlines.h's collectMatches.
>+        https://bugs.webkit.org/show_bug.cgi?id=187006
>+        <rdar://problem/41418412>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/regress-187006.js: Added.
>+
> 2018-06-22  Keith Miller  <keith_miller@apple.com>
> 
>         unshift should zero unused property storage
>Index: JSTests/stress/regress-187006.js
>===================================================================
>--- JSTests/stress/regress-187006.js	(nonexistent)
>+++ JSTests/stress/regress-187006.js	(working copy)
>@@ -0,0 +1,16 @@
>+Object.defineProperty(Array.prototype, '0', {
>+    get() { },
>+    set() { throw new Error(); }
>+});
>+
>+var __v_7772 = "GGCCGGGTAAAGTGGCTCACGCCTGTAATCCCAGCACTTTACCCCCCGAGGCGGGCGGA";
>+var exception;
>+
>+try {
>+    __v_7772.match(/[cgt]gggtaaa|tttaccc[acg]/ig);
>+} catch (e) {
>+    exception = e;
>+}
>+
>+if (exception != "Error")
>+    throw "FAILED";
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 233151)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2018-06-25  Mark Lam  <mark.lam@apple.com>
>+
>+        Add missing exception check in RegExpObjectInlines.h's collectMatches.
>+        https://bugs.webkit.org/show_bug.cgi?id=187006
>+        <rdar://problem/41418412>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * runtime/RegExpObjectInlines.h:
>+        (JSC::collectMatches):
>+
> 2018-06-25  Yusuke Suzuki  <utatane.tea@gmail.com>
> 
>         [JSC] Remove unnecessary PLATFORM guards
>Index: Source/JavaScriptCore/runtime/RegExpObjectInlines.h
>===================================================================
>--- Source/JavaScriptCore/runtime/RegExpObjectInlines.h	(revision 233151)
>+++ Source/JavaScriptCore/runtime/RegExpObjectInlines.h	(working copy)
>@@ -205,6 +205,9 @@ JSValue collectMatches(VM& vm, ExecState
>         }
>         
>         iterate();
>+        EXCEPTION_ASSERT(!!scope.exception() == hasException);
>+        if (UNLIKELY(hasException))
>+            return { };
>     } while (result);
>     
>     return array;

Actions: View | Formatted Diff | Diff

Attachments on bug 187006: 343511