Changeset 209034 in webkit

Timestamp:

Nov 28, 2016, 3:40:53 PM (8 years ago)

Author:

mark.lam@apple.com

Message:

Fix exception scope verification failures in JSDataView.cpp.
​https://bugs.webkit.org/show_bug.cgi?id=165020

Reviewed by Saam Barati.

• runtime/JSDataView.cpp:

(JSC::JSDataView::put):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSDataView.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-11-28  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in JSDataView.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=165020
+
+        Reviewed by Saam Barati.
+
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::put):
+
 2016-11-28  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSDataView.cpp

@@ -127 +127 @@
     JSDataView* thisObject = jsCast<JSDataView*>(cell);
 
-    if (UNLIKELY(isThisValueAltered(slot, thisObject)))
+    if (UNLIKELY(isThisValueAltered(slot, thisObject))) {
+        scope.release();
         return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
+    }
 
     if (propertyName == vm.propertyNames->byteLength
@@ -134 +136 @@
         return typeError(exec, scope, slot.isStrictMode(), ASCIILiteral("Attempting to write to read-only typed array property."));
 
+    scope.release();
     return Base::put(thisObject, exec, propertyName, value, slot);
 }