Changeset 278438 in webkit

Timestamp:

Jun 3, 2021 5:41:01 PM (3 years ago)

Author:

mark.lam@apple.com

Message:

Fix an ASSERT in objectPrototypeHasOwnProperty() to account for TerminationException.
​https://bugs.webkit.org/show_bug.cgi?id=226609
rdar://78465046

Reviewed by Robin Morisset.

JSTests:

• stress/termination-exception-in-objectPrototypeHasOwnProperty.js: Added.

Source/JavaScriptCore:

• runtime/ObjectPrototype.cpp:

(JSC::objectPrototypeHasOwnProperty):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/termination-exception-in-objectPrototypeHasOwnProperty.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/ObjectPrototype.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-06-03  Mark Lam  <mark.lam@apple.com>
+
+        Fix an ASSERT in objectPrototypeHasOwnProperty() to account for TerminationException.
+        https://bugs.webkit.org/show_bug.cgi?id=226609
+        rdar://78465046
+
+        Reviewed by Robin Morisset.
+
+        * stress/termination-exception-in-objectPrototypeHasOwnProperty.js: Added.
+
 2021-06-03  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-06-03  Mark Lam  <mark.lam@apple.com>
+
+        Fix an ASSERT in objectPrototypeHasOwnProperty() to account for TerminationException.
+        https://bugs.webkit.org/show_bug.cgi?id=226609
+        rdar://78465046
+
+        Reviewed by Robin Morisset.
+
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectPrototypeHasOwnProperty):
+
 2021-06-03  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp

@@ -103 +103 @@
     HasOwnPropertyCache* hasOwnPropertyCache = vm.ensureHasOwnPropertyCache();
     if (std::optional<bool> result = hasOwnPropertyCache->get(structure, propertyName)) {
-        ASSERT(*result == thisObject->hasOwnProperty(globalObject, propertyName));
         scope.assertNoExceptionExceptTermination();
+        ASSERT(*result == thisObject->hasOwnProperty(globalObject, propertyName) || vm.hasPendingTerminationException());
         return *result;
     }