Title: [236114] releases/WebKitGTK/webkit-2.22
- Revision
- 236114
- Author
- [email protected]
- Date
- 2018-09-18 06:30:36 -0700 (Tue, 18 Sep 2018)
Log Message
Merge r235491 - Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
https://bugs.webkit.org/show_bug.cgi?id=189132
<rdar://problem/42513068>
Reviewed by Saam Barati.
JSTests:
* stress/regress-189132.js: Added.
Source/_javascript_Core:
* runtime/JSCJSValueInlines.h:
(JSC::JSValue::toPropertyKey const):
* runtime/JSString.cpp:
(JSC::JSRopeString::resolveRopeToAtomicString const):
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.22/JSTests/ChangeLog (236113 => 236114)
--- releases/WebKitGTK/webkit-2.22/JSTests/ChangeLog 2018-09-18 09:47:55 UTC (rev 236113)
+++ releases/WebKitGTK/webkit-2.22/JSTests/ChangeLog 2018-09-18 13:30:36 UTC (rev 236114)
@@ -1,3 +1,13 @@
+2018-08-29 Mark Lam <[email protected]>
+
+ Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
+ https://bugs.webkit.org/show_bug.cgi?id=189132
+ <rdar://problem/42513068>
+
+ Reviewed by Saam Barati.
+
+ * stress/regress-189132.js: Added.
+
2018-08-24 Yusuke Suzuki <[email protected]>
[JSC] Array.prototype.reverse modifies JSImmutableButterfly
Added: releases/WebKitGTK/webkit-2.22/JSTests/stress/regress-189132.js (0 => 236114)
--- releases/WebKitGTK/webkit-2.22/JSTests/stress/regress-189132.js (rev 0)
+++ releases/WebKitGTK/webkit-2.22/JSTests/stress/regress-189132.js 2018-09-18 13:30:36 UTC (rev 236114)
@@ -0,0 +1,12 @@
+try {
+ var a0 = '\ud801';
+ var a1 = [];
+ a2 = a0.padEnd(2147483644,'x');
+ a1[a2];
+} catch (e) {
+ exception = e;
+}
+
+if (exception != "Error: Out of memory")
+ throw "FAILED";
+
Modified: releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog (236113 => 236114)
--- releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog 2018-09-18 09:47:55 UTC (rev 236113)
+++ releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog 2018-09-18 13:30:36 UTC (rev 236114)
@@ -1,3 +1,16 @@
+2018-08-29 Mark Lam <[email protected]>
+
+ Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
+ https://bugs.webkit.org/show_bug.cgi?id=189132
+ <rdar://problem/42513068>
+
+ Reviewed by Saam Barati.
+
+ * runtime/JSCJSValueInlines.h:
+ (JSC::JSValue::toPropertyKey const):
+ * runtime/JSString.cpp:
+ (JSC::JSRopeString::resolveRopeToAtomicString const):
+
2018-08-24 Yusuke Suzuki <[email protected]>
[JSC] Array.prototype.reverse modifies JSImmutableButterfly
Modified: releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/runtime/JSCJSValueInlines.h (236113 => 236114)
--- releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/runtime/JSCJSValueInlines.h 2018-09-18 09:47:55 UTC (rev 236113)
+++ releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/runtime/JSCJSValueInlines.h 2018-09-18 13:30:36 UTC (rev 236114)
@@ -649,13 +649,17 @@
VM& vm = exec->vm();
auto scope = DECLARE_THROW_SCOPE(vm);
- if (isString())
+ if (isString()) {
+ scope.release();
return asString(*this)->toIdentifier(exec);
+ }
JSValue primitive = toPrimitive(exec, PreferString);
RETURN_IF_EXCEPTION(scope, vm.propertyNames->emptyIdentifier);
- if (primitive.isSymbol())
+ if (primitive.isSymbol()) {
+ scope.release();
return Identifier::fromUid(asSymbol(primitive)->privateName());
+ }
scope.release();
return primitive.toString(exec)->toIdentifier(exec);
}
Modified: releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/runtime/JSString.cpp (236113 => 236114)
--- releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/runtime/JSString.cpp 2018-09-18 09:47:55 UTC (rev 236113)
+++ releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/runtime/JSString.cpp 2018-09-18 13:30:36 UTC (rev 236114)
@@ -178,8 +178,12 @@
void JSRopeString::resolveRopeToAtomicString(ExecState* exec) const
{
+ VM& vm = exec->vm();
+ auto scope = DECLARE_THROW_SCOPE(vm);
+
if (length() > maxLengthForOnStackResolve) {
resolveRope(exec);
+ RETURN_IF_EXCEPTION(scope, void());
m_value = AtomicString(m_value);
setIs8Bit(m_value.impl()->is8Bit());
return;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
