Changeset 208936 in webkit

Timestamp:

Nov 20, 2016 5:33:09 PM (7 years ago)

Author:

mark.lam@apple.com

Message:

Fix exception scope verification failures in CommonSlowPaths.cpp/h.
​https://bugs.webkit.org/show_bug.cgi?id=164975

Reviewed by Darin Adler.

• runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

• runtime/CommonSlowPaths.h:

(JSC::CommonSlowPaths::opIn):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/CommonSlowPaths.cpp (modified) (3 diffs)
• runtime/CommonSlowPaths.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-11-20  Mark Lam  <mark.lam@apple.com>
+
+        Fix exception scope verification failures in CommonSlowPaths.cpp/h.
+        https://bugs.webkit.org/show_bug.cgi?id=164975
+
+        Reviewed by Darin Adler.
+
+        * runtime/CommonSlowPaths.cpp:
+        (JSC::SLOW_PATH_DECL):
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+
 2016-11-20  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

@@ -182 +182 @@
         vm.topCallFrame = exec;
         ErrorHandlingScope errorScope(vm);
+        throwScope.release();
         CommonSlowPaths::interpreterThrowInCaller(exec, createStackOverflowError(exec));
         RETURN_TWO(bitwise_cast<void*>(static_cast<uintptr_t>(1)), exec);
@@ -444 +445 @@
     arithProfile.observeLHSAndRHS(v1, v2);
 
-    if (v1.isString() && !v2.isObject())
-        result = jsString(exec, asString(v1), v2.toString(exec));
-    else if (v1.isNumber() && v2.isNumber())
+    if (v1.isString() && !v2.isObject()) {
+        JSString* v2String = v2.toString(exec);
+        if (LIKELY(!throwScope.exception()))
+            result = jsString(exec, asString(v1), v2String);
+    } else if (v1.isNumber() && v2.isNumber())
         result = jsNumber(v1.asNumber() + v2.asNumber());
     else
@@ -825 +828 @@
         if (resolvedScope->isGlobalObject()) {
             JSGlobalObject* globalObject = jsCast<JSGlobalObject*>(resolvedScope);
-            if (globalObject->hasProperty(exec, ident)) {
+            bool hasProperty = globalObject->hasProperty(exec, ident);
+            CHECK_EXCEPTION();
+            if (hasProperty) {
                 ConcurrentJSLocker locker(exec->codeBlock()->m_lock);
                 if (resolveType == UnresolvedProperty)

trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.h

@@ -84 +84 @@
 
     uint32_t i;
-    if (propName.getUInt32(i))
+    if (propName.getUInt32(i)) {
+        scope.release();
         return baseObj->hasProperty(exec, i);
+    }
 
     auto property = propName.toPropertyKey(exec);
     RETURN_IF_EXCEPTION(scope, false);
+    scope.release();
     return baseObj->hasProperty(exec, property);
 }