Attachment 348617 Details for Bug 189186 – proposed patch.

[patch] proposed patch.

bug-189186.patch (text/plain), 2.19 KB, created by Mark Lam on 2018-08-31 00:29:22 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Mark Lam

Created: 2018-08-31 00:29:22 PDT

Size: 2.19 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 235537)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,13 @@
>+2018-08-31  Mark Lam  <mark.lam@apple.com>
>+
>+        Fix exception check accounting in JSDataView::defineOwnProperty().
>+        https://bugs.webkit.org/show_bug.cgi?id=189186
>+        <rdar://problem/39786049>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * stress/regress-189186.js: Added.
>+
> 2018-08-30  Saam barati  <sbarati@apple.com>
> 
>         CSE DataViewGet* DFG nodes
>Index: JSTests/stress/regress-189186.js
>===================================================================
>--- JSTests/stress/regress-189186.js	(nonexistent)
>+++ JSTests/stress/regress-189186.js	(working copy)
>@@ -0,0 +1,4 @@
>+//@ runDefault
>+// This test passes if it does not crash.
>+let x = new DataView(new ArrayBuffer(1));
>+Object.defineProperty(x, 'foo', {});
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 235491)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,14 @@
>+2018-08-31  Mark Lam  <mark.lam@apple.com>
>+
>+        Fix exception check accounting in JSDataView::defineOwnProperty().
>+        https://bugs.webkit.org/show_bug.cgi?id=189186
>+        <rdar://problem/39786049>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * runtime/JSDataView.cpp:
>+        (JSC::JSDataView::defineOwnProperty):
>+
> 2018-08-29  Mark Lam  <mark.lam@apple.com>
> 
>         Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
>Index: Source/JavaScriptCore/runtime/JSDataView.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/JSDataView.cpp	(revision 235490)
>+++ Source/JavaScriptCore/runtime/JSDataView.cpp	(working copy)
>@@ -151,6 +151,7 @@ bool JSDataView::defineOwnProperty(
>         || propertyName == vm.propertyNames->byteOffset)
>         return typeError(exec, scope, shouldThrow, "Attempting to define read-only typed array property."_s);
> 
>+    scope.release();
>     return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
> }
>

Actions: View | Formatted Diff | Diff

Attachments on bug 189186: 348617