Title: [223815] branches/safari-604-branch
- Revision
- 223815
- Author
- [email protected]
- Date
- 2017-10-21 12:19:44 -0700 (Sat, 21 Oct 2017)
Log Message
Cherry-pick r223645. rdar://problem/34820875
Modified Paths
Added Paths
Diff
Modified: branches/safari-604-branch/JSTests/ChangeLog (223814 => 223815)
--- branches/safari-604-branch/JSTests/ChangeLog 2017-10-21 19:19:41 UTC (rev 223814)
+++ branches/safari-604-branch/JSTests/ChangeLog 2017-10-21 19:19:44 UTC (rev 223815)
@@ -1,3 +1,17 @@
+2017-10-21 Jason Marcell <[email protected]>
+
+ Cherry-pick r223645. rdar://problem/34820875
+
+ 2017-10-18 Mark Lam <[email protected]>
+
+ RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
+ https://bugs.webkit.org/show_bug.cgi?id=177600
+ <rdar://problem/34710985>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-177600.js: Added.
+
2017-10-18 Jason Marcell <[email protected]>
Cherry-pick r221607. rdar://problem/35041474
Added: branches/safari-604-branch/JSTests/stress/regress-177600.js (0 => 223815)
--- branches/safari-604-branch/JSTests/stress/regress-177600.js (rev 0)
+++ branches/safari-604-branch/JSTests/stress/regress-177600.js 2017-10-21 19:19:44 UTC (rev 223815)
@@ -0,0 +1,5 @@
+// This test passes if it does not crash.
+
+var regexp5 = new RegExp(/\t%%/);
+Object.defineProperty(regexp5, "lastIndex" ,{value:"\w?\B", writable:false});
+Object.seal(regexp5);
Modified: branches/safari-604-branch/Source/_javascript_Core/ChangeLog (223814 => 223815)
--- branches/safari-604-branch/Source/_javascript_Core/ChangeLog 2017-10-21 19:19:41 UTC (rev 223814)
+++ branches/safari-604-branch/Source/_javascript_Core/ChangeLog 2017-10-21 19:19:44 UTC (rev 223815)
@@ -1,3 +1,22 @@
+2017-10-21 Jason Marcell <[email protected]>
+
+ Cherry-pick r223645. rdar://problem/34820875
+
+ 2017-10-18 Mark Lam <[email protected]>
+
+ RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
+ https://bugs.webkit.org/show_bug.cgi?id=177600
+ <rdar://problem/34710985>
+
+ Reviewed by Saam Barati.
+
+ According to http://www.ecma-international.org/ecma-262/8.0/#sec-validateandapplypropertydescriptor,
+ section 9.1.6.3-7.a.ii, we should only check if the value is the same if the
+ descriptor value is present.
+
+ * runtime/RegExpObject.cpp:
+ (JSC::RegExpObject::defineOwnProperty):
+
2017-10-18 Jason Marcell <[email protected]>
Cherry-pick r221607. rdar://problem/35041474
Modified: branches/safari-604-branch/Source/_javascript_Core/runtime/RegExpObject.cpp (223814 => 223815)
--- branches/safari-604-branch/Source/_javascript_Core/runtime/RegExpObject.cpp 2017-10-21 19:19:41 UTC (rev 223814)
+++ branches/safari-604-branch/Source/_javascript_Core/runtime/RegExpObject.cpp 2017-10-21 19:19:44 UTC (rev 223815)
@@ -115,7 +115,7 @@
if (!regExp->m_lastIndexIsWritable) {
if (descriptor.writablePresent() && descriptor.writable())
return typeError(exec, scope, shouldThrow, ASCIILiteral(UnconfigurablePropertyChangeWritabilityError));
- if (!sameValue(exec, regExp->getLastIndex(), descriptor.value()))
+ if (descriptor.value() && !sameValue(exec, regExp->getLastIndex(), descriptor.value()))
return typeError(exec, scope, shouldThrow, ASCIILiteral(ReadonlyPropertyChangeError));
return true;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
