Title: [278473] trunk
- Revision
- 278473
- Author
- mark....@apple.com
- Date
- 2021-06-04 10:46:09 -0700 (Fri, 04 Jun 2021)
Log Message
Placate exception checker validation in objectPrototypeHasOwnProperty.
https://bugs.webkit.org/show_bug.cgi?id=226651
rdar://78861296
Reviewed by Keith Miller.
JSTests:
* stress/placate-exception-checker-in-objectPrototypeHasOwnProperty.js: Added.
Source/_javascript_Core:
* runtime/ObjectPrototype.cpp:
(JSC::objectPrototypeHasOwnProperty):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (278472 => 278473)
--- trunk/JSTests/ChangeLog 2021-06-04 17:23:02 UTC (rev 278472)
+++ trunk/JSTests/ChangeLog 2021-06-04 17:46:09 UTC (rev 278473)
@@ -1,3 +1,13 @@
+2021-06-04 Mark Lam <mark....@apple.com>
+
+ Placate exception checker validation in objectPrototypeHasOwnProperty.
+ https://bugs.webkit.org/show_bug.cgi?id=226651
+ rdar://78861296
+
+ Reviewed by Keith Miller.
+
+ * stress/placate-exception-checker-in-objectPrototypeHasOwnProperty.js: Added.
+
2021-06-03 Filip Pizlo <fpi...@apple.com>
DFG should speculate on CompareStrictEq(@x, @x)
Added: trunk/JSTests/stress/placate-exception-checker-in-objectPrototypeHasOwnProperty.js (0 => 278473)
--- trunk/JSTests/stress/placate-exception-checker-in-objectPrototypeHasOwnProperty.js (rev 0)
+++ trunk/JSTests/stress/placate-exception-checker-in-objectPrototypeHasOwnProperty.js 2021-06-04 17:46:09 UTC (rev 278473)
@@ -0,0 +1,5 @@
+//@ runDefault
+
+function foo() {}
+foo.hasOwnProperty();
+foo.hasOwnProperty();
Modified: trunk/Source/_javascript_Core/ChangeLog (278472 => 278473)
--- trunk/Source/_javascript_Core/ChangeLog 2021-06-04 17:23:02 UTC (rev 278472)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-06-04 17:46:09 UTC (rev 278473)
@@ -1,3 +1,14 @@
+2021-06-04 Mark Lam <mark....@apple.com>
+
+ Placate exception checker validation in objectPrototypeHasOwnProperty.
+ https://bugs.webkit.org/show_bug.cgi?id=226651
+ rdar://78861296
+
+ Reviewed by Keith Miller.
+
+ * runtime/ObjectPrototype.cpp:
+ (JSC::objectPrototypeHasOwnProperty):
+
2021-06-03 Filip Pizlo <fpi...@apple.com>
DFG should speculate on CompareStrictEq(@x, @x)
Modified: trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp (278472 => 278473)
--- trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp 2021-06-04 17:23:02 UTC (rev 278472)
+++ trunk/Source/_javascript_Core/runtime/ObjectPrototype.cpp 2021-06-04 17:46:09 UTC (rev 278473)
@@ -102,8 +102,8 @@
Structure* structure = thisObject->structure(vm);
HasOwnPropertyCache* hasOwnPropertyCache = vm.ensureHasOwnPropertyCache();
if (std::optional<bool> result = hasOwnPropertyCache->get(structure, propertyName)) {
+ ASSERT(*result == thisObject->hasOwnProperty(globalObject, propertyName) || vm.hasPendingTerminationException());
scope.assertNoExceptionExceptTermination();
- ASSERT(*result == thisObject->hasOwnProperty(globalObject, propertyName) || vm.hasPendingTerminationException());
return *result;
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
