Changeset 209869 in webkit

Timestamp:

Dec 15, 2016 12:55:18 PM (7 years ago)

Author:

Chris Dumez

Message:

Harden JSObject::getOwnPropertyDescriptor()
​https://bugs.webkit.org/show_bug.cgi?id=165908

Reviewed by Geoffrey Garen.

• runtime/JSObject.cpp:

(JSC::JSObject::getOwnPropertyDescriptor):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSObject.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-12-15  Chris Dumez  <cdumez@apple.com>
+
+        Harden JSObject::getOwnPropertyDescriptor()
+        https://bugs.webkit.org/show_bug.cgi?id=165908
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+
 2016-12-15  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -3218 +3218 @@
 
             ASSERT(maybeGetterSetter);
-            getterSetter = jsCast<CustomGetterSetter*>(maybeGetterSetter);
-        }
+            getterSetter = jsDynamicCast<CustomGetterSetter*>(maybeGetterSetter);
+        }
+        ASSERT(getterSetter);
+        if (!getterSetter)
+            return false;
+
         if (getterSetter->getter())
             descriptor.setGetter(getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, getterSetter, JSCustomGetterSetterFunction::Type::Getter));