Title: [245311] trunk/Source/_javascript_Core
- Revision
- 245311
- Author
- [email protected]
- Date
- 2019-05-14 14:38:12 -0700 (Tue, 14 May 2019)
Log Message
REGRESSION (r245249): ASSERTION FAILED: !m_needExceptionCheck seen with stress/proxy-delete.js and stress/proxy-property-descriptor.js
https://bugs.webkit.org/show_bug.cgi?id=197885
<rdar://problem/50770190>
Reviewed by Yusuke Suzuki.
In r245249 we added a throw scope to JSObject::getOwnPropertyDescriptor and its
callers now need to check for exceptions.
* runtime/ProxyObject.cpp:
(JSC::performProxyGet):
(JSC::ProxyObject::performDelete):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (245310 => 245311)
--- trunk/Source/_javascript_Core/ChangeLog 2019-05-14 21:08:02 UTC (rev 245310)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-05-14 21:38:12 UTC (rev 245311)
@@ -1,3 +1,18 @@
+2019-05-14 Tadeu Zagallo <[email protected]>
+
+ REGRESSION (r245249): ASSERTION FAILED: !m_needExceptionCheck seen with stress/proxy-delete.js and stress/proxy-property-descriptor.js
+ https://bugs.webkit.org/show_bug.cgi?id=197885
+ <rdar://problem/50770190>
+
+ Reviewed by Yusuke Suzuki.
+
+ In r245249 we added a throw scope to JSObject::getOwnPropertyDescriptor and its
+ callers now need to check for exceptions.
+
+ * runtime/ProxyObject.cpp:
+ (JSC::performProxyGet):
+ (JSC::ProxyObject::performDelete):
+
2019-05-14 Ross Kirsling <[email protected]>
Unreviewed restoration of non-unified build.
Modified: trunk/Source/_javascript_Core/runtime/ProxyObject.cpp (245310 => 245311)
--- trunk/Source/_javascript_Core/runtime/ProxyObject.cpp 2019-05-14 21:08:02 UTC (rev 245310)
+++ trunk/Source/_javascript_Core/runtime/ProxyObject.cpp 2019-05-14 21:38:12 UTC (rev 245311)
@@ -167,7 +167,9 @@
RETURN_IF_EXCEPTION(scope, { });
PropertyDescriptor descriptor;
- if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+ bool result = target->getOwnPropertyDescriptor(exec, propertyName, descriptor);
+ EXCEPTION_ASSERT(!scope.exception() || !result);
+ if (result) {
if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) {
if (!sameValue(exec, descriptor.value(), trapResult))
return throwTypeError(exec, scope, "Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property"_s);
@@ -650,7 +652,9 @@
return false;
PropertyDescriptor descriptor;
- if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
+ bool result = target->getOwnPropertyDescriptor(exec, propertyName, descriptor);
+ EXCEPTION_ASSERT(!scope.exception() || !result);
+ if (result) {
if (!descriptor.configurable()) {
throwVMTypeError(exec, scope, "Proxy handler's 'deleteProperty' method should return false when the target's property is not configurable"_s);
return false;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
