Title: [244069] trunk
- Revision
- 244069
- Author
- [email protected]
- Date
- 2019-04-09 00:54:18 -0700 (Tue, 09 Apr 2019)
Log Message
ASSERTION FAILED: !scope.exception() || !hasProperty in JSObject::get
https://bugs.webkit.org/show_bug.cgi?id=196708
<rdar://problem/49556803>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/proxy-getter-stack-overflow.js: Added.
(const.handler.get target):
(const.handler.has):
(try.with):
(catch):
Source/_javascript_Core:
`operationPutToScope` needs to return early if an exception is thrown while
checking if `hasProperty`.
* jit/JITOperations.cpp:
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (244068 => 244069)
--- trunk/JSTests/ChangeLog 2019-04-09 06:23:21 UTC (rev 244068)
+++ trunk/JSTests/ChangeLog 2019-04-09 07:54:18 UTC (rev 244069)
@@ -1,3 +1,17 @@
+2019-04-09 Tadeu Zagallo <[email protected]>
+
+ ASSERTION FAILED: !scope.exception() || !hasProperty in JSObject::get
+ https://bugs.webkit.org/show_bug.cgi?id=196708
+ <rdar://problem/49556803>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/proxy-getter-stack-overflow.js: Added.
+ (const.handler.get target):
+ (const.handler.has):
+ (try.with):
+ (catch):
+
2019-04-08 Yusuke Suzuki <[email protected]>
[JSC] DFG should respect node's strict flag
Added: trunk/JSTests/stress/proxy-getter-stack-overflow.js (0 => 244069)
--- trunk/JSTests/stress/proxy-getter-stack-overflow.js (rev 0)
+++ trunk/JSTests/stress/proxy-getter-stack-overflow.js 2019-04-09 07:54:18 UTC (rev 244069)
@@ -0,0 +1,24 @@
+//@ if $jitTests then runDefault("--useLLInt=0") else skip end
+
+const o = {};
+const handler = {
+ get(target, prop, receiver) {
+ o.__proto__ = receiver;
+ },
+ has(target, prop) {
+ o.__proto__ = undefined;
+ return 1;
+ }
+};
+
+const p = new Proxy({}, handler);
+handler.__proto__ = p;
+try {
+ with (p) {
+ a = 0
+ }
+ throw new Error("Should throw RangeError");
+} catch (error) {
+ if (error.message !== "Maximum call stack size exceeded.")
+ throw new Error("Expected stack overflow, but got: " + error);
+}
Modified: trunk/Source/_javascript_Core/ChangeLog (244068 => 244069)
--- trunk/Source/_javascript_Core/ChangeLog 2019-04-09 06:23:21 UTC (rev 244068)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-04-09 07:54:18 UTC (rev 244069)
@@ -1,3 +1,16 @@
+2019-04-09 Tadeu Zagallo <[email protected]>
+
+ ASSERTION FAILED: !scope.exception() || !hasProperty in JSObject::get
+ https://bugs.webkit.org/show_bug.cgi?id=196708
+ <rdar://problem/49556803>
+
+ Reviewed by Yusuke Suzuki.
+
+ `operationPutToScope` needs to return early if an exception is thrown while
+ checking if `hasProperty`.
+
+ * jit/JITOperations.cpp:
+
2019-04-08 Yusuke Suzuki <[email protected]>
[JSC] DFG should respect node's strict flag
Modified: trunk/Source/_javascript_Core/jit/JITOperations.cpp (244068 => 244069)
--- trunk/Source/_javascript_Core/jit/JITOperations.cpp 2019-04-09 06:23:21 UTC (rev 244068)
+++ trunk/Source/_javascript_Core/jit/JITOperations.cpp 2019-04-09 07:54:18 UTC (rev 244069)
@@ -2372,7 +2372,7 @@
}
bool hasProperty = scope->hasProperty(exec, ident);
- EXCEPTION_ASSERT(!throwScope.exception() || !hasProperty);
+ RETURN_IF_EXCEPTION(throwScope, void());
if (hasProperty
&& scope->isGlobalLexicalEnvironment()
&& !isInitialization(getPutInfo.initializationMode())) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
