Title: [249265] releases/WebKitGTK/webkit-2.26
- Revision
- 249265
- Author
- [email protected]
- Date
- 2019-08-29 06:11:06 -0700 (Thu, 29 Aug 2019)
Log Message
Merge r249225 - Placate exception check validation in DFG's operationHasGenericProperty().
https://bugs.webkit.org/show_bug.cgi?id=201245
<rdar://problem/54777512>
Reviewed by Robin Morisset.
JSTests:
* stress/missing-exception-check-in-operationHasGenericProperty.js: Added.
Source/_javascript_Core:
* dfg/DFGOperations.cpp:
Modified Paths
Added Paths
Diff
Modified: releases/WebKitGTK/webkit-2.26/JSTests/ChangeLog (249264 => 249265)
--- releases/WebKitGTK/webkit-2.26/JSTests/ChangeLog 2019-08-29 13:11:02 UTC (rev 249264)
+++ releases/WebKitGTK/webkit-2.26/JSTests/ChangeLog 2019-08-29 13:11:06 UTC (rev 249265)
@@ -1,3 +1,13 @@
+2019-08-28 Mark Lam <[email protected]>
+
+ Placate exception check validation in DFG's operationHasGenericProperty().
+ https://bugs.webkit.org/show_bug.cgi?id=201245
+ <rdar://problem/54777512>
+
+ Reviewed by Robin Morisset.
+
+ * stress/missing-exception-check-in-operationHasGenericProperty.js: Added.
+
2019-08-27 Mark Lam <[email protected]>
constructFunctionSkippingEvalEnabledCheck() should use tryMakeString() and check for OOM.
Added: releases/WebKitGTK/webkit-2.26/JSTests/stress/missing-exception-check-in-operationHasGenericProperty.js (0 => 249265)
--- releases/WebKitGTK/webkit-2.26/JSTests/stress/missing-exception-check-in-operationHasGenericProperty.js (rev 0)
+++ releases/WebKitGTK/webkit-2.26/JSTests/stress/missing-exception-check-in-operationHasGenericProperty.js 2019-08-29 13:11:06 UTC (rev 249265)
@@ -0,0 +1,10 @@
+const x = 0;
+
+function foo() {
+ for (const q in 0) { }
+}
+
+for (let i = 0; i < 5; i++) {
+ foo();
+ Number.prototype.valueOf = 0;
+}
Modified: releases/WebKitGTK/webkit-2.26/Source/_javascript_Core/ChangeLog (249264 => 249265)
--- releases/WebKitGTK/webkit-2.26/Source/_javascript_Core/ChangeLog 2019-08-29 13:11:02 UTC (rev 249264)
+++ releases/WebKitGTK/webkit-2.26/Source/_javascript_Core/ChangeLog 2019-08-29 13:11:06 UTC (rev 249265)
@@ -1,3 +1,13 @@
+2019-08-28 Mark Lam <[email protected]>
+
+ Placate exception check validation in DFG's operationHasGenericProperty().
+ https://bugs.webkit.org/show_bug.cgi?id=201245
+ <rdar://problem/54777512>
+
+ Reviewed by Robin Morisset.
+
+ * dfg/DFGOperations.cpp:
+
2019-08-28 Ross Kirsling <[email protected]>
Unreviewed. Restabilize non-unified build.
Modified: releases/WebKitGTK/webkit-2.26/Source/_javascript_Core/dfg/DFGOperations.cpp (249264 => 249265)
--- releases/WebKitGTK/webkit-2.26/Source/_javascript_Core/dfg/DFGOperations.cpp 2019-08-29 13:11:02 UTC (rev 249264)
+++ releases/WebKitGTK/webkit-2.26/Source/_javascript_Core/dfg/DFGOperations.cpp 2019-08-29 13:11:06 UTC (rev 249265)
@@ -2135,6 +2135,7 @@
return JSValue::encode(jsBoolean(false));
JSObject* base = baseValue.toObject(exec);
+ ASSERT(!scope.exception() || !base);
if (!base)
return JSValue::encode(JSValue());
auto propertyName = asString(property)->toIdentifier(exec);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
