Changeset 224770 in webkit

Timestamp:

Nov 13, 2017, 12:18:15 PM (8 years ago)

Author:

mark.lam@apple.com

Message:

Make the jsc shell loadGetterFromGetterSetter() function more robust.
​https://bugs.webkit.org/show_bug.cgi?id=179619
<rdar://problem/35492518>

Reviewed by Saam Barati.

JSTests:

• stress/regress-179619.js: Added.

Source/JavaScriptCore:

• jsc.cpp:

(functionLoadGetterFromGetterSetter):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/regress-179619.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/jsc.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2017-11-13  Mark Lam  <mark.lam@apple.com>
+
+        Make the jsc shell loadGetterFromGetterSetter() function more robust.
+        https://bugs.webkit.org/show_bug.cgi?id=179619
+        <rdar://problem/35492518>
+
+        Reviewed by Saam Barati.
+
+        * stress/regress-179619.js: Added.
+
 2017-11-12  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-11-13  Mark Lam  <mark.lam@apple.com>
+
+        Make the jsc shell loadGetterFromGetterSetter() function more robust.
+        https://bugs.webkit.org/show_bug.cgi?id=179619
+        <rdar://problem/35492518>
+
+        Reviewed by Saam Barati.
+
+        * jsc.cpp:
+        (functionLoadGetterFromGetterSetter):
+
 2017-11-12  Darin Adler  <darin@apple.com>
 

trunk/Source/JavaScriptCore/jsc.cpp

@@ -3023 +3023 @@
 {
     VM& vm = exec->vm();
-    RELEASE_ASSERT(exec->argumentCount() >= 1);
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     GetterSetter* getterSetter = jsDynamicCast<GetterSetter*>(vm, exec->argument(0));
-    RELEASE_ASSERT(getterSetter);
+    if (UNLIKELY(!getterSetter)) {
+        throwTypeError(exec, scope, ASCIILiteral("Invalid use of loadGetterFromGetterSetter test function: argument is not a GetterSetter"));
+        return encodedJSValue();
+    }
+
     JSObject* getter = getterSetter->getter();
     RELEASE_ASSERT(getter);