Attachment 348611 Details for Bug 189184 – proposed patch.

[patch] proposed patch.

bug-189184.patch (text/plain), 2.31 KB, created by Mark Lam on 2018-08-30 23:31:22 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Lam

Created: 2018-08-30 23:31:22 PDT

Size: 2.31 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 235537)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2018-08-30  Mark Lam  <mark.lam@apple.com>
>+
>+        Add missing exception check in arrayProtoFuncLastIndexOf().
>+        https://bugs.webkit.org/show_bug.cgi?id=189184
>+        <rdar://problem/39785959>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/regress-189184.js: Added.
>+
> 2018-08-30  Saam barati  <sbarati@apple.com>
> 
>         CSE DataViewGet* DFG nodes
>Index: JSTests/stress/regress-189184.js
>===================================================================
>--- JSTests/stress/regress-189184.js	(nonexistent)
>+++ JSTests/stress/regress-189184.js	(working copy)
>@@ -0,0 +1,2 @@
>+// This test passes if it does not crash.
>+['a'+0].lastIndexOf('a0');
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 235491)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2018-08-30  Mark Lam  <mark.lam@apple.com>
>+
>+        Add missing exception check in arrayProtoFuncLastIndexOf().
>+        https://bugs.webkit.org/show_bug.cgi?id=189184
>+        <rdar://problem/39785959>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * runtime/ArrayPrototype.cpp:
>+        (JSC::arrayProtoFuncLastIndexOf):
>+
> 2018-08-29  Mark Lam  <mark.lam@apple.com>
> 
>         Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
>Index: Source/JavaScriptCore/runtime/ArrayPrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/ArrayPrototype.cpp	(revision 235490)
>+++ Source/JavaScriptCore/runtime/ArrayPrototype.cpp	(working copy)
>@@ -1215,9 +1215,10 @@ EncodedJSValue JSC_HOST_CALL arrayProtoF
>         RETURN_IF_EXCEPTION(scope, encodedJSValue());
>         if (!e)
>             continue;
>-        if (JSValue::strictEqual(exec, searchElement, e))
>-            return JSValue::encode(jsNumber(index));
>+        bool isEqual = JSValue::strictEqual(exec, searchElement, e);
>         RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+        if (isEqual)
>+            return JSValue::encode(jsNumber(index));
>     } while (index--);
> 
>     return JSValue::encode(jsNumber(-1));

Actions: View | Formatted Diff | Diff

Attachments on bug 189184: 348611 | 348612