Revision: 13351
Author: [email protected]
Date: Thu Jan 10 03:45:29 2013
Log: Fix missing exception check in typed array constructor (2).
This fixes another crash when the the typed array constructor accesses
an array that has a throwing accessor defined on one of it's elements.
[email protected]
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js
Review URL: https://codereview.chromium.org/11791052
http://code.google.com/p/v8/source/detail?r=13351
Modified:
/branches/bleeding_edge/src/d8.cc
/branches/bleeding_edge/test/mjsunit/regress/regress-crbug-168545.js
=======================================
--- /branches/bleeding_edge/src/d8.cc Tue Jan 8 07:24:17 2013
+++ /branches/bleeding_edge/src/d8.cc Thu Jan 10 03:45:29 2013
@@ -561,7 +561,11 @@
if (init_from_array) {
Handle<Object> init = args[0]->ToObject();
- for (int i = 0; i < length; ++i) array->Set(i, init->Get(i));
+ for (int i = 0; i < length; ++i) {
+ Local<Value> value = init->Get(i);
+ if (try_catch.HasCaught()) return try_catch.ReThrow();
+ array->Set(i, value);
+ }
}
return array;
=======================================
--- /branches/bleeding_edge/test/mjsunit/regress/regress-crbug-168545.js
Mon Jan 7 06:01:04 2013
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-crbug-168545.js
Thu Jan 10 03:45:29 2013
@@ -28,3 +28,7 @@
var o = {};
Object.defineProperty(o, "length", { get: function() { throw "bail"; }});
assertThrows("new Int16Array(o);");
+
+var a = [];
+Object.defineProperty(a, "0", { get: function() { throw "bail"; }});
+assertThrows("new Int16Array(a);");
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
