Title: [223645] trunk
- Revision
- 223645
- Author
- [email protected]
- Date
- 2017-10-18 18:12:56 -0700 (Wed, 18 Oct 2017)
Log Message
RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
https://bugs.webkit.org/show_bug.cgi?id=177600
<rdar://problem/34710985>
Reviewed by Saam Barati.
JSTests:
* stress/regress-177600.js: Added.
Source/_javascript_Core:
According to http://www.ecma-international.org/ecma-262/8.0/#sec-validateandapplypropertydescriptor,
section 9.1.6.3-7.a.ii, we should only check if the value is the same if the
descriptor value is present.
* runtime/RegExpObject.cpp:
(JSC::RegExpObject::defineOwnProperty):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (223644 => 223645)
--- trunk/JSTests/ChangeLog 2017-10-19 01:01:21 UTC (rev 223644)
+++ trunk/JSTests/ChangeLog 2017-10-19 01:12:56 UTC (rev 223645)
@@ -1,5 +1,15 @@
2017-10-18 Mark Lam <[email protected]>
+ RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
+ https://bugs.webkit.org/show_bug.cgi?id=177600
+ <rdar://problem/34710985>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-177600.js: Added.
+
+2017-10-18 Mark Lam <[email protected]>
+
The compiler should always register a structure when it adds its transitionWatchPointSet.
https://bugs.webkit.org/show_bug.cgi?id=178420
<rdar://problem/34814024>
Added: trunk/JSTests/stress/regress-177600.js (0 => 223645)
--- trunk/JSTests/stress/regress-177600.js (rev 0)
+++ trunk/JSTests/stress/regress-177600.js 2017-10-19 01:12:56 UTC (rev 223645)
@@ -0,0 +1,5 @@
+// This test passes if it does not crash.
+
+var regexp5 = new RegExp(/\t%%/);
+Object.defineProperty(regexp5, "lastIndex" ,{value:"\w?\B", writable:false});
+Object.seal(regexp5);
Modified: trunk/Source/_javascript_Core/ChangeLog (223644 => 223645)
--- trunk/Source/_javascript_Core/ChangeLog 2017-10-19 01:01:21 UTC (rev 223644)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-10-19 01:12:56 UTC (rev 223645)
@@ -1,3 +1,18 @@
+2017-10-18 Mark Lam <[email protected]>
+
+ RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
+ https://bugs.webkit.org/show_bug.cgi?id=177600
+ <rdar://problem/34710985>
+
+ Reviewed by Saam Barati.
+
+ According to http://www.ecma-international.org/ecma-262/8.0/#sec-validateandapplypropertydescriptor,
+ section 9.1.6.3-7.a.ii, we should only check if the value is the same if the
+ descriptor value is present.
+
+ * runtime/RegExpObject.cpp:
+ (JSC::RegExpObject::defineOwnProperty):
+
2017-10-18 Keith Miller <[email protected]>
Setup WebCore build to start using unified sources.
Modified: trunk/Source/_javascript_Core/runtime/RegExpObject.cpp (223644 => 223645)
--- trunk/Source/_javascript_Core/runtime/RegExpObject.cpp 2017-10-19 01:01:21 UTC (rev 223644)
+++ trunk/Source/_javascript_Core/runtime/RegExpObject.cpp 2017-10-19 01:12:56 UTC (rev 223645)
@@ -120,7 +120,7 @@
if (!regExp->m_lastIndexIsWritable) {
if (descriptor.writablePresent() && descriptor.writable())
return typeError(exec, scope, shouldThrow, ASCIILiteral(UnconfigurablePropertyChangeWritabilityError));
- if (!sameValue(exec, regExp->getLastIndex(), descriptor.value()))
+ if (descriptor.value() && !sameValue(exec, regExp->getLastIndex(), descriptor.value()))
return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyChangeError));
return true;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
