Changeset 249225 in webkit

Timestamp:

Aug 28, 2019, 4:11:17 PM (7 years ago)

Author:

mark.lam@apple.com

Message:

Placate exception check validation in DFG's operationHasGenericProperty().
​https://bugs.webkit.org/show_bug.cgi?id=201245
<rdar://problem/54777512>

Reviewed by Robin Morisset.

JSTests:

• stress/missing-exception-check-in-operationHasGenericProperty.js: Added.

Source/JavaScriptCore:

• dfg/DFGOperations.cpp:

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/missing-exception-check-in-operationHasGenericProperty.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-08-28  Mark Lam  <mark.lam@apple.com>
+
+        Placate exception check validation in DFG's operationHasGenericProperty().
+        https://bugs.webkit.org/show_bug.cgi?id=201245
+        <rdar://problem/54777512>
+
+        Reviewed by Robin Morisset.
+
+        * stress/missing-exception-check-in-operationHasGenericProperty.js: Added.
+
 2019-08-27  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-08-28  Mark Lam  <mark.lam@apple.com>
+
+        Placate exception check validation in DFG's operationHasGenericProperty().
+        https://bugs.webkit.org/show_bug.cgi?id=201245
+        <rdar://problem/54777512>
+
+        Reviewed by Robin Morisset.
+
+        * dfg/DFGOperations.cpp:
+
 2019-08-28  Ross Kirsling  <ross.kirsling@sony.com>
 

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -2136 +2136 @@
 
     JSObject* base = baseValue.toObject(exec);
+    ASSERT(!scope.exception() || !base);
     if (!base)
         return JSValue::encode(JSValue());