Bug 160154 – various math operations don't properly check for an exception after calling toNumber() on the lhs

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Saam Barati]

...

[Saam Barati]

Created attachment 285460 [details]
patch

[Mark Lam]

Comment on attachment 285460 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=285460&action=review

r=me.

> Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:441
>      RETURN_WITH_PROFILING(result, {

Is it acceptable to update the ArithProfile here based on a wrong result if right.toNumber() throws?

> Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:456
>      RETURN_WITH_PROFILING(result, {

Ditto.

[Saam Barati]

Comment on attachment 285460 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=285460&action=review

>> Source/JavaScriptCore/runtime/CommonSlowPaths.cpp:441
>>      RETURN_WITH_PROFILING(result, {
> 
> Is it acceptable to update the ArithProfile here based on a wrong result if right.toNumber() throws?

It is always OK to update it. However, this code isn't actually doing that.
RETURN_WITH_PROFILING always does CHECK_EXCEPTION before updating the profile.

[Saam Barati]

Comment on attachment 285460 [details]
patch

Thanks for the review

[WebKit Commit Bot]

Comment on attachment 285460 [details]
patch

Clearing flags on attachment: 285460

Committed r204206: <http://trac.webkit.org/changeset/204206>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.