Title: [209869] trunk/Source/_javascript_Core
- Revision
- 209869
- Author
- [email protected]
- Date
- 2016-12-15 12:55:18 -0800 (Thu, 15 Dec 2016)
Log Message
Harden JSObject::getOwnPropertyDescriptor()
https://bugs.webkit.org/show_bug.cgi?id=165908
Reviewed by Geoffrey Garen.
* runtime/JSObject.cpp:
(JSC::JSObject::getOwnPropertyDescriptor):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (209868 => 209869)
--- trunk/Source/_javascript_Core/ChangeLog 2016-12-15 20:18:25 UTC (rev 209868)
+++ trunk/Source/_javascript_Core/ChangeLog 2016-12-15 20:55:18 UTC (rev 209869)
@@ -1,3 +1,13 @@
+2016-12-15 Chris Dumez <[email protected]>
+
+ Harden JSObject::getOwnPropertyDescriptor()
+ https://bugs.webkit.org/show_bug.cgi?id=165908
+
+ Reviewed by Geoffrey Garen.
+
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::getOwnPropertyDescriptor):
+
2016-12-15 Keith Miller <[email protected]>
Fix 64-bit shift family Wasm opcodes
Modified: trunk/Source/_javascript_Core/runtime/JSObject.cpp (209868 => 209869)
--- trunk/Source/_javascript_Core/runtime/JSObject.cpp 2016-12-15 20:18:25 UTC (rev 209868)
+++ trunk/Source/_javascript_Core/runtime/JSObject.cpp 2016-12-15 20:55:18 UTC (rev 209869)
@@ -3217,8 +3217,12 @@
}
ASSERT(maybeGetterSetter);
- getterSetter = jsCast<CustomGetterSetter*>(maybeGetterSetter);
+ getterSetter = jsDynamicCast<CustomGetterSetter*>(maybeGetterSetter);
}
+ ASSERT(getterSetter);
+ if (!getterSetter)
+ return false;
+
if (getterSetter->getter())
descriptor.setGetter(getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, getterSetter, JSCustomGetterSetterFunction::Type::Getter));
if (getterSetter->setter())
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
