Changeset 197011 in webkit for trunk/Source/JavaScriptCore/runtime

Timestamp:

Feb 23, 2016, 8:39:29 PM (9 years ago)

Author:

[email protected]

Message:

arrayProtoFuncConcat doesn't check for an exception after allocating an array
​https://bugs.webkit.org/show_bug.cgi?id=154621

Reviewed by Michael Saboff.

• runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncConcat):

File:

• trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp

@@ -633 +633 @@
         // We add the newTarget because the compiler gets confused between 0 being a number and a pointer.
         result = constructEmptyArray(exec, nullptr, 0, JSValue());
+        if (exec->hadException())
+            return JSValue::encode(jsUndefined());
     }