Title: [243294] trunk
- Revision
- 243294
- Author
- [email protected]
- Date
- 2019-03-21 09:36:20 -0700 (Thu, 21 Mar 2019)
Log Message
Placate exception check validation in operationArrayIndexOfString().
https://bugs.webkit.org/show_bug.cgi?id=196067
<rdar://problem/49056572>
Reviewed by Michael Saboff.
JSTests:
* stress/string-equal-exception-check.js: Added.
Source/_javascript_Core:
* dfg/DFGOperations.cpp:
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (243293 => 243294)
--- trunk/JSTests/ChangeLog 2019-03-21 16:29:32 UTC (rev 243293)
+++ trunk/JSTests/ChangeLog 2019-03-21 16:36:20 UTC (rev 243294)
@@ -1,5 +1,15 @@
2019-03-21 Mark Lam <[email protected]>
+ Placate exception check validation in operationArrayIndexOfString().
+ https://bugs.webkit.org/show_bug.cgi?id=196067
+ <rdar://problem/49056572>
+
+ Reviewed by Michael Saboff.
+
+ * stress/string-equal-exception-check.js: Added.
+
+2019-03-21 Mark Lam <[email protected]>
+
Cap length of an array with spread to MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.
https://bugs.webkit.org/show_bug.cgi?id=196055
<rdar://problem/49067448>
Added: trunk/JSTests/stress/string-equal-exception-check.js (0 => 243294)
--- trunk/JSTests/stress/string-equal-exception-check.js (rev 0)
+++ trunk/JSTests/stress/string-equal-exception-check.js 2019-03-21 16:36:20 UTC (rev 243294)
@@ -0,0 +1,9 @@
+//@ runDefault("--forceEagerCompilation=true")
+
+// This test should not crash.
+
+[0, 1].forEach(()=>{
+ [{}, 1, 2].forEach(x => {
+ ['xy'].indexOf('xy_'.substring(0, 2));
+ });
+});
Modified: trunk/Source/_javascript_Core/ChangeLog (243293 => 243294)
--- trunk/Source/_javascript_Core/ChangeLog 2019-03-21 16:29:32 UTC (rev 243293)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-03-21 16:36:20 UTC (rev 243294)
@@ -1,3 +1,13 @@
+2019-03-21 Mark Lam <[email protected]>
+
+ Placate exception check validation in operationArrayIndexOfString().
+ https://bugs.webkit.org/show_bug.cgi?id=196067
+ <rdar://problem/49056572>
+
+ Reviewed by Michael Saboff.
+
+ * dfg/DFGOperations.cpp:
+
2019-03-21 Xan Lopez <[email protected]>
[JSC][x86] Drop support for x87 floating point
Modified: trunk/Source/_javascript_Core/dfg/DFGOperations.cpp (243293 => 243294)
--- trunk/Source/_javascript_Core/dfg/DFGOperations.cpp 2019-03-21 16:29:32 UTC (rev 243293)
+++ trunk/Source/_javascript_Core/dfg/DFGOperations.cpp 2019-03-21 16:36:20 UTC (rev 243294)
@@ -2538,8 +2538,10 @@
auto* string = asString(value);
if (string == searchElement)
return index;
- if (string->equal(exec, searchElement))
+ if (string->equal(exec, searchElement)) {
+ scope.assertNoException();
return index;
+ }
RETURN_IF_EXCEPTION(scope, { });
}
return -1;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
