Changeset 233114 in webkit for trunk/Source/JavaScriptCore/bytecode/PropertyCondition.cpp

Timestamp:

Jun 22, 2018, 5:45:06 PM (7 years ago)

Author:

[email protected]

Message:

PropertyCondition::isValidValueForAttributes() should also consider deleted values.
​https://bugs.webkit.org/show_bug.cgi?id=186943
<rdar://problem/41370337>

Reviewed by Saam Barati.

JSTests:

• stress/regress-186943.js: Added.

Source/JavaScriptCore:

PropertyCondition::isValidValueForAttributes() should check if the passed in value
is a deleted one before it does a jsDynamicCast on it.

• bytecode/PropertyCondition.cpp:

(JSC::PropertyCondition::isValidValueForAttributes):

• runtime/JSCJSValueInlines.h:
• removed an unnecessary #if.

File:

• trunk/Source/JavaScriptCore/bytecode/PropertyCondition.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/bytecode/PropertyCondition.cpp

@@ -378 +378 @@
 bool PropertyCondition::isValidValueForAttributes(VM& vm, JSValue value, unsigned attributes)
 {
+    if (!value)
+        return false;
     bool attributesClaimAccessor = !!(attributes & PropertyAttribute::Accessor);
     bool valueClaimsAccessor = !!jsDynamicCast<GetterSetter*>(vm, value);