Changeset 245311 in webkit
- Timestamp:
- May 14, 2019 2:38:12 PM (5 years ago)
- Location:
- trunk/Source/JavaScriptCore
- Files:
-
- 2 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/ChangeLog
r245301 r245311 1 2019-05-14 Tadeu Zagallo <tzagallo@apple.com> 2 3 REGRESSION (r245249): ASSERTION FAILED: !m_needExceptionCheck seen with stress/proxy-delete.js and stress/proxy-property-descriptor.js 4 https://bugs.webkit.org/show_bug.cgi?id=197885 5 <rdar://problem/50770190> 6 7 Reviewed by Yusuke Suzuki. 8 9 In r245249 we added a throw scope to JSObject::getOwnPropertyDescriptor and its 10 callers now need to check for exceptions. 11 12 * runtime/ProxyObject.cpp: 13 (JSC::performProxyGet): 14 (JSC::ProxyObject::performDelete): 15 1 16 2019-05-14 Ross Kirsling <ross.kirsling@sony.com> 2 17 -
trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp
r244330 r245311 168 168 169 169 PropertyDescriptor descriptor; 170 if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) { 170 bool result = target->getOwnPropertyDescriptor(exec, propertyName, descriptor); 171 EXCEPTION_ASSERT(!scope.exception() || !result); 172 if (result) { 171 173 if (descriptor.isDataDescriptor() && !descriptor.configurable() && !descriptor.writable()) { 172 174 if (!sameValue(exec, descriptor.value(), trapResult)) … … 651 653 652 654 PropertyDescriptor descriptor; 653 if (target->getOwnPropertyDescriptor(exec, propertyName, descriptor)) { 655 bool result = target->getOwnPropertyDescriptor(exec, propertyName, descriptor); 656 EXCEPTION_ASSERT(!scope.exception() || !result); 657 if (result) { 654 658 if (!descriptor.configurable()) { 655 659 throwVMTypeError(exec, scope, "Proxy handler's 'deleteProperty' method should return false when the target's property is not configurable"_s);
Note: See TracChangeset
for help on using the changeset viewer.