[webkit-changes] [209027] trunk/Source/JavaScriptCore

Mon, 28 Nov 2016 15:09:09 -0800

Title: [209027] trunk/Source/_javascript_Core
Revision
209027
Author
mark....@apple.com
Date
2016-11-28 15:07:33 -0800 (Mon, 28 Nov 2016)

Log Message

Fix exception scope verification failures in JSTypedArrayViewPrototype.cpp.
https://bugs.webkit.org/show_bug.cgi?id=165049

Reviewed by Saam Barati.

* runtime/JSTypedArrayViewPrototype.cpp:
(JSC::typedArrayViewPrivateFuncSort):
(JSC::typedArrayViewProtoFuncSet):
(JSC::typedArrayViewProtoFuncCopyWithin):
(JSC::typedArrayViewProtoFuncIncludes):
(JSC::typedArrayViewProtoFuncLastIndexOf):
(JSC::typedArrayViewProtoFuncIndexOf):
(JSC::typedArrayViewProtoFuncJoin):
(JSC::typedArrayViewProtoGetterFuncBuffer):
(JSC::typedArrayViewProtoGetterFuncLength):
(JSC::typedArrayViewProtoGetterFuncByteLength):
(JSC::typedArrayViewProtoGetterFuncByteOffset):
(JSC::typedArrayViewProtoFuncReverse):
(JSC::typedArrayViewPrivateFuncSubarrayCreate):
(JSC::typedArrayViewProtoFuncSlice):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (209026 => 209027)


--- trunk/Source/_javascript_Core/ChangeLog	2016-11-28 23:00:38 UTC (rev 209026)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-11-28 23:07:33 UTC (rev 209027)
@@ -1,5 +1,28 @@
 2016-11-28  Mark Lam  <mark....@apple.com>
 
+        Fix exception scope verification failures in JSTypedArrayViewPrototype.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165049
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewPrivateFuncSort):
+        (JSC::typedArrayViewProtoFuncSet):
+        (JSC::typedArrayViewProtoFuncCopyWithin):
+        (JSC::typedArrayViewProtoFuncIncludes):
+        (JSC::typedArrayViewProtoFuncLastIndexOf):
+        (JSC::typedArrayViewProtoFuncIndexOf):
+        (JSC::typedArrayViewProtoFuncJoin):
+        (JSC::typedArrayViewProtoGetterFuncBuffer):
+        (JSC::typedArrayViewProtoGetterFuncLength):
+        (JSC::typedArrayViewProtoGetterFuncByteLength):
+        (JSC::typedArrayViewProtoGetterFuncByteOffset):
+        (JSC::typedArrayViewProtoFuncReverse):
+        (JSC::typedArrayViewPrivateFuncSubarrayCreate):
+        (JSC::typedArrayViewProtoFuncSlice):
+
+2016-11-28  Mark Lam  <mark....@apple.com>
+
         Fix exception scope verification failures in runtime/Map* files.
         https://bugs.webkit.org/show_bug.cgi?id=165050

Modified: trunk/Source/_javascript_Core/runtime/JSTypedArrayViewPrototype.cpp (209026 => 209027)


--- trunk/Source/_javascript_Core/runtime/JSTypedArrayViewPrototype.cpp	2016-11-28 23:00:38 UTC (rev 209026)
+++ trunk/Source/_javascript_Core/runtime/JSTypedArrayViewPrototype.cpp	2016-11-28 23:07:33 UTC (rev 209027)
@@ -100,6 +100,7 @@
     VM& vm = exec->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
     JSValue thisValue = exec->argument(0);
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewPrivateFuncSort);
 }
 
@@ -110,6 +111,7 @@
     JSValue thisValue = exec->thisValue();
     if (UNLIKELY(!thisValue.isObject()))
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncSet);
 }
 
@@ -120,6 +122,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncCopyWithin);
 }
 
@@ -130,6 +133,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMError(exec, scope, createTypeError(exec, "Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncIncludes);
 }
 
@@ -140,6 +144,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncLastIndexOf);
 }
 
@@ -150,6 +155,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncIndexOf);
 }
 
@@ -160,6 +166,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncJoin);
 }
 
@@ -170,6 +177,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncBuffer);
 }
 
@@ -180,6 +188,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncLength);
 }
 
@@ -190,6 +199,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncByteLength);
 }
 
@@ -200,6 +210,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncByteOffset);
 }
 
@@ -210,6 +221,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncReverse);
 }
 
@@ -220,6 +232,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewPrivateFuncSubarrayCreate);
 }
 
@@ -230,6 +243,7 @@
     JSValue thisValue = exec->thisValue();
     if (!thisValue.isObject())
         return throwVMTypeError(exec, scope, ASCIILiteral("Receiver should be a typed array view but was not an object"));
+    scope.release();
     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncSlice);
 }
 

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to