Title: [256202] trunk
- Revision
- 256202
- Author
- [email protected]
- Date
- 2020-02-10 12:40:00 -0800 (Mon, 10 Feb 2020)
Log Message
Placate exception check validator in GenericArguments<Type>::put().
https://bugs.webkit.org/show_bug.cgi?id=207485
<rdar://problem/59302535>
Reviewed by Robin Morisset.
JSTests:
* stress/placate-exception-check-validator-in-GenericArguments-put.js: Added.
Source/_javascript_Core:
* runtime/GenericArgumentsInlines.h:
(JSC::GenericArguments<Type>::put):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (256201 => 256202)
--- trunk/JSTests/ChangeLog 2020-02-10 20:26:04 UTC (rev 256201)
+++ trunk/JSTests/ChangeLog 2020-02-10 20:40:00 UTC (rev 256202)
@@ -1,3 +1,13 @@
+2020-02-10 Mark Lam <[email protected]>
+
+ Placate exception check validator in GenericArguments<Type>::put().
+ https://bugs.webkit.org/show_bug.cgi?id=207485
+ <rdar://problem/59302535>
+
+ Reviewed by Robin Morisset.
+
+ * stress/placate-exception-check-validator-in-GenericArguments-put.js: Added.
+
2020-02-10 Justin Michaud <[email protected]>
arm64_32: microbenchmarks/delete-property-keeps-cacheable-structure.js is timing out
Added: trunk/JSTests/stress/placate-exception-check-validator-in-GenericArguments-put.js (0 => 256202)
--- trunk/JSTests/stress/placate-exception-check-validator-in-GenericArguments-put.js (rev 0)
+++ trunk/JSTests/stress/placate-exception-check-validator-in-GenericArguments-put.js 2020-02-10 20:40:00 UTC (rev 256202)
@@ -0,0 +1,5 @@
+function foo() {
+ const o = new Proxy(arguments, {});
+ o.x = null;
+}
+foo();
Modified: trunk/Source/_javascript_Core/ChangeLog (256201 => 256202)
--- trunk/Source/_javascript_Core/ChangeLog 2020-02-10 20:26:04 UTC (rev 256201)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-02-10 20:40:00 UTC (rev 256202)
@@ -1,5 +1,16 @@
2020-02-10 Mark Lam <[email protected]>
+ Placate exception check validator in GenericArguments<Type>::put().
+ https://bugs.webkit.org/show_bug.cgi?id=207485
+ <rdar://problem/59302535>
+
+ Reviewed by Robin Morisset.
+
+ * runtime/GenericArgumentsInlines.h:
+ (JSC::GenericArguments<Type>::put):
+
+2020-02-10 Mark Lam <[email protected]>
+
Missing exception check in GenericArguments<Type>::deletePropertyByIndex().
https://bugs.webkit.org/show_bug.cgi?id=207483
<rdar://problem/59302616>
Modified: trunk/Source/_javascript_Core/runtime/GenericArgumentsInlines.h (256201 => 256202)
--- trunk/Source/_javascript_Core/runtime/GenericArgumentsInlines.h 2020-02-10 20:26:04 UTC (rev 256201)
+++ trunk/Source/_javascript_Core/runtime/GenericArgumentsInlines.h 2020-02-10 20:40:00 UTC (rev 256202)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
+ * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -132,7 +132,7 @@
// https://tc39.github.io/ecma262/#sec-arguments-exotic-objects-set-p-v-receiver
// Fall back to the OrdinarySet when the receiver is altered from the thisObject.
if (UNLIKELY(isThisValueAltered(slot, thisObject)))
- return ordinarySetSlow(globalObject, thisObject, ident, value, slot.thisValue(), slot.isStrictMode());
+ RELEASE_AND_RETURN(scope, ordinarySetSlow(globalObject, thisObject, ident, value, slot.thisValue(), slot.isStrictMode()));
Optional<uint32_t> index = parseIndex(ident);
if (index && thisObject->isMappedArgument(index.value())) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
