Changeset 235554 in webkit

Timestamp:

Aug 31, 2018, 9:05:22 AM (8 years ago)

Author:

mark.lam@apple.com

Message:

Fix exception check accounting in JSDataView::defineOwnProperty().
​https://bugs.webkit.org/show_bug.cgi?id=189186
<rdar://problem/39786049>

Reviewed by Michael Saboff.

JSTests:

• stress/regress-189186.js: Added.

Source/JavaScriptCore:

• runtime/JSDataView.cpp:

(JSC::JSDataView::defineOwnProperty):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/regress-189186.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSDataView.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2018-08-31  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception check accounting in JSDataView::defineOwnProperty().
+        https://bugs.webkit.org/show_bug.cgi?id=189186
+        <rdar://problem/39786049>
+
+        Reviewed by Michael Saboff.
+
+        * stress/regress-189186.js: Added.
+
 2018-08-31  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-08-31  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception check accounting in JSDataView::defineOwnProperty().
+        https://bugs.webkit.org/show_bug.cgi?id=189186
+        <rdar://problem/39786049>
+
+        Reviewed by Michael Saboff.
+
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::defineOwnProperty):
+
 2018-08-31  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSDataView.cpp

@@ -152 +152 @@
         return typeError(exec, scope, shouldThrow, "Attempting to define read-only typed array property."_s);
 
+    scope.release();
     return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
 }