Changeset 214085 in webkit

Timestamp:

Mar 16, 2017 5:51:01 PM (7 years ago)

Author:

mark.lam@apple.com

Message:

Fix exception scope verification failures in GenericArgumentsInlines.h.
​https://bugs.webkit.org/show_bug.cgi?id=165012

Reviewed by Saam Barati.

• runtime/GenericArgumentsInlines.h:

(JSC::GenericArguments<Type>::defineOwnProperty):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/GenericArgumentsInlines.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-03-16  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in GenericArgumentsInlines.h.
+        https://bugs.webkit.org/show_bug.cgi?id=165012
+
+        Reviewed by Saam Barati.
+
+        * runtime/GenericArgumentsInlines.h:
+        (JSC::GenericArguments<Type>::defineOwnProperty):
+
 2017-03-16  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/JavaScriptCore/runtime/GenericArgumentsInlines.h

@@ -201 +201 @@
     Type* thisObject = jsCast<Type*>(object);
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
     
     if (ident == vm.propertyNames->length
@@ -227 +228 @@
                     ASSERT(value);
                     object->putDirectMayBeIndex(exec, ident, value);
-                    
+                    ASSERT(!scope.exception());
+
                     thisObject->setModifiedArgumentDescriptor(vm, index);
                 }
@@ -251 +253 @@
 
     // Now just let the normal object machinery do its thing.
+    scope.release();
     return Base::defineOwnProperty(object, exec, ident, descriptor, shouldThrow);
 }