Changeset 129432 in webkit for trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

Sep 24, 2012, 5:20:13 PM (13 years ago)

Author:

[email protected]

Message:

JSArray::putByIndex asserts with readonly property on prototype
​https://bugs.webkit.org/show_bug.cgi?id=97435
<rdar://problem/12357084>

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Boy, there were some problems:

• putDirectIndex() should know that it can set the index quickly even if it's a hole and we're in SlowPut mode, since that's the whole point of PutDirect.

• We should have a fast path for putByIndex().

• The LiteralParser should not use push(), since that may throw if we're having a bad time.

• interpreter/Interpreter.cpp:

(JSC::eval):

• runtime/JSObject.h:

(JSC::JSObject::putByIndexInline):
(JSObject):
(JSC::JSObject::putDirectIndex):

• runtime/LiteralParser.cpp:

(JSC::::parse):

LayoutTests:

• fast/js/concat-while-having-a-bad-time.html: Added.
• fast/js/concat-while-having-a-bad-time-expected.txt: Added.
• fast/js/jsc-test-list:
• fast/js/script-tests/concat-while-having-a-bad-time.js: Added.

File:

• trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -167 +167 @@
             }
         }
+        
+        // If the literal parser bailed, it should not have thrown exceptions.
+        ASSERT(!callFrame->globalData().exception);
 
         JSValue exceptionValue;