Title: [236122] releases/WebKitGTK/webkit-2.22
- Revision
- 236122
- Author
- [email protected]
- Date
- 2018-09-18 06:32:12 -0700 (Tue, 18 Sep 2018)
Log Message
Merge r235540 - Add missing exception check in arrayProtoFuncLastIndexOf().
https://bugs.webkit.org/show_bug.cgi?id=189184
<rdar://problem/39785959>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/regress-189184.js: Added.
Source/_javascript_Core:
* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncLastIndexOf):
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.22/JSTests/ChangeLog (236121 => 236122)
--- releases/WebKitGTK/webkit-2.22/JSTests/ChangeLog 2018-09-18 13:32:06 UTC (rev 236121)
+++ releases/WebKitGTK/webkit-2.22/JSTests/ChangeLog 2018-09-18 13:32:12 UTC (rev 236122)
@@ -1,3 +1,13 @@
+2018-08-31 Mark Lam <[email protected]>
+
+ Add missing exception check in arrayProtoFuncLastIndexOf().
+ https://bugs.webkit.org/show_bug.cgi?id=189184
+ <rdar://problem/39785959>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/regress-189184.js: Added.
+
2018-08-31 Saam barati <[email protected]>
convertToRegExpMatchFastGlobal must use KnownString as the child use kind
Added: releases/WebKitGTK/webkit-2.22/JSTests/stress/regress-189184.js (0 => 236122)
--- releases/WebKitGTK/webkit-2.22/JSTests/stress/regress-189184.js (rev 0)
+++ releases/WebKitGTK/webkit-2.22/JSTests/stress/regress-189184.js 2018-09-18 13:32:12 UTC (rev 236122)
@@ -0,0 +1,3 @@
+//@ runDefault
+// This test passes if it does not crash.
+['a'+0].lastIndexOf('a0');
Modified: releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog (236121 => 236122)
--- releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog 2018-09-18 13:32:06 UTC (rev 236121)
+++ releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/ChangeLog 2018-09-18 13:32:12 UTC (rev 236122)
@@ -1,3 +1,14 @@
+2018-08-31 Mark Lam <[email protected]>
+
+ Add missing exception check in arrayProtoFuncLastIndexOf().
+ https://bugs.webkit.org/show_bug.cgi?id=189184
+ <rdar://problem/39785959>
+
+ Reviewed by Yusuke Suzuki.
+
+ * runtime/ArrayPrototype.cpp:
+ (JSC::arrayProtoFuncLastIndexOf):
+
2018-08-31 Saam barati <[email protected]>
convertToRegExpMatchFastGlobal must use KnownString as the child use kind
Modified: releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/runtime/ArrayPrototype.cpp (236121 => 236122)
--- releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2018-09-18 13:32:06 UTC (rev 236121)
+++ releases/WebKitGTK/webkit-2.22/Source/_javascript_Core/runtime/ArrayPrototype.cpp 2018-09-18 13:32:12 UTC (rev 236122)
@@ -1215,9 +1215,10 @@
RETURN_IF_EXCEPTION(scope, encodedJSValue());
if (!e)
continue;
- if (JSValue::strictEqual(exec, searchElement, e))
+ bool isEqual = JSValue::strictEqual(exec, searchElement, e);
+ RETURN_IF_EXCEPTION(scope, encodedJSValue());
+ if (isEqual)
return JSValue::encode(jsNumber(index));
- RETURN_IF_EXCEPTION(scope, encodedJSValue());
} while (index--);
return JSValue::encode(jsNumber(-1));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
