Title: [243391] trunk
- Revision
- 243391
- Author
- [email protected]
- Date
- 2019-03-22 10:59:07 -0700 (Fri, 22 Mar 2019)
Log Message
Placate exception check validation in genericTypedArrayViewProtoFuncLastIndexOf().
https://bugs.webkit.org/show_bug.cgi?id=196154
<rdar://problem/49145307>
Reviewed by Filip Pizlo.
JSTests:
Also added //@ runDefault constraint to web-assembly-link-error-exception-check.js.
There's no need to run this test on more than 1 test configuration.
* stress/typed-array-lastIndexOf-exception-check.js: Added.
* stress/web-assembly-link-error-exception-check.js:
Source/_javascript_Core:
* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewProtoFuncLastIndexOf):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (243390 => 243391)
--- trunk/JSTests/ChangeLog 2019-03-22 17:57:55 UTC (rev 243390)
+++ trunk/JSTests/ChangeLog 2019-03-22 17:59:07 UTC (rev 243391)
@@ -1,5 +1,19 @@
2019-03-22 Mark Lam <[email protected]>
+ Placate exception check validation in genericTypedArrayViewProtoFuncLastIndexOf().
+ https://bugs.webkit.org/show_bug.cgi?id=196154
+ <rdar://problem/49145307>
+
+ Reviewed by Filip Pizlo.
+
+ Also added //@ runDefault constraint to web-assembly-link-error-exception-check.js.
+ There's no need to run this test on more than 1 test configuration.
+
+ * stress/typed-array-lastIndexOf-exception-check.js: Added.
+ * stress/web-assembly-link-error-exception-check.js:
+
+2019-03-22 Mark Lam <[email protected]>
+
Placate exception check validation in constructJSWebAssemblyLinkError().
https://bugs.webkit.org/show_bug.cgi?id=196152
<rdar://problem/49145257>
Added: trunk/JSTests/stress/typed-array-lastIndexOf-exception-check.js (0 => 243391)
--- trunk/JSTests/stress/typed-array-lastIndexOf-exception-check.js (rev 0)
+++ trunk/JSTests/stress/typed-array-lastIndexOf-exception-check.js 2019-03-22 17:59:07 UTC (rev 243391)
@@ -0,0 +1,5 @@
+//@ runDefault
+
+new Uint8Array().lastIndexOf(0, {
+ valueOf: () => -1
+});
Modified: trunk/JSTests/stress/web-assembly-link-error-exception-check.js (243390 => 243391)
--- trunk/JSTests/stress/web-assembly-link-error-exception-check.js 2019-03-22 17:57:55 UTC (rev 243390)
+++ trunk/JSTests/stress/web-assembly-link-error-exception-check.js 2019-03-22 17:59:07 UTC (rev 243391)
@@ -1 +1,3 @@
+//@ runDefault
+
new WebAssembly.LinkError([]);
Modified: trunk/Source/_javascript_Core/ChangeLog (243390 => 243391)
--- trunk/Source/_javascript_Core/ChangeLog 2019-03-22 17:57:55 UTC (rev 243390)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-03-22 17:59:07 UTC (rev 243391)
@@ -1,5 +1,16 @@
2019-03-22 Mark Lam <[email protected]>
+ Placate exception check validation in genericTypedArrayViewProtoFuncLastIndexOf().
+ https://bugs.webkit.org/show_bug.cgi?id=196154
+ <rdar://problem/49145307>
+
+ Reviewed by Filip Pizlo.
+
+ * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+ (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+
+2019-03-22 Mark Lam <[email protected]>
+
Placate exception check validation in constructJSWebAssemblyLinkError().
https://bugs.webkit.org/show_bug.cgi?id=196152
<rdar://problem/49145257>
Modified: trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (243390 => 243391)
--- trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2019-03-22 17:57:55 UTC (rev 243390)
+++ trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewPrototypeFunctions.h 2019-03-22 17:59:07 UTC (rev 243391)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2015-2017 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -317,6 +317,7 @@
if (exec->argumentCount() >= 2) {
JSValue fromValue = exec->uncheckedArgument(1);
double fromDouble = fromValue.toInteger(exec);
+ RETURN_IF_EXCEPTION(scope, encodedJSValue());
if (fromDouble < 0) {
fromDouble += length;
if (fromDouble < 0)
@@ -326,8 +327,6 @@
index = static_cast<unsigned>(fromDouble);
}
- RETURN_IF_EXCEPTION(scope, encodedJSValue());
-
if (thisObject->isNeutered())
return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
