Changeset 209026 in webkit

Timestamp:

Nov 28, 2016 3:00:38 PM (7 years ago)

Author:

mark.lam@apple.com

Message:

Fix exception scope verification failures in runtime/Map* files.
​https://bugs.webkit.org/show_bug.cgi?id=165050

Reviewed by Saam Barati.

• runtime/MapConstructor.cpp:

(JSC::constructMap):

• runtime/MapIteratorPrototype.cpp:

(JSC::MapIteratorPrototypeFuncNext):

• runtime/MapPrototype.cpp:

(JSC::privateFuncMapIteratorNext):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/MapConstructor.cpp (modified) (2 diffs)
• runtime/MapIteratorPrototype.cpp (modified) (1 diff)
• runtime/MapPrototype.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in runtime/Map* files.
+        https://bugs.webkit.org/show_bug.cgi?id=165050
+
+        Reviewed by Saam Barati.
+
+        * runtime/MapConstructor.cpp:
+        (JSC::constructMap):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/MapPrototype.cpp:
+        (JSC::privateFuncMapIteratorNext):
+
 2016-11-28  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp

@@ -77 +77 @@
         return JSValue::encode(throwTypeError(exec, scope));
 
+    scope.release();
     forEachInIterable(exec, iterable, [&](VM& vm, ExecState* exec, JSValue nextItem) {
         auto scope = DECLARE_THROW_SCOPE(vm);
@@ -93 +94 @@
         arguments.append(key);
         arguments.append(value);
+        scope.release();
         call(exec, adderFunction, adderFunctionCallType, adderFunctionCallData, map, arguments);
     });

trunk/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp

@@ -57 +57 @@
 
     JSValue result;
-    if (iterator->next(callFrame, result))
+    if (iterator->next(callFrame, result)) {
+        scope.release();
         return JSValue::encode(createIteratorResultObject(callFrame, result, false));
+    }
+    scope.release();
     return JSValue::encode(createIteratorResultObject(callFrame, jsUndefined(), true));
 }

trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp

@@ -193 +193 @@
 EncodedJSValue JSC_HOST_CALL privateFuncMapIteratorNext(ExecState* exec)
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     ASSERT(jsDynamicCast<JSMapIterator*>(exec->thisValue()));
     JSMapIterator* iterator = jsCast<JSMapIterator*>(exec->thisValue());
@@ -199 +201 @@
         JSArray* resultArray = jsCast<JSArray*>(exec->uncheckedArgument(0));
         resultArray->putDirectIndex(exec, 0, key);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+        scope.release();
         resultArray->putDirectIndex(exec, 1, value);
         return JSValue::encode(jsBoolean(false));