Changeset 235491 in webkit for trunk/Source/JavaScriptCore/runtime/JSString.cpp

Timestamp:

Aug 29, 2018, 6:20:20 PM (7 years ago)

Author:

[email protected]

Message:

Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
​https://bugs.webkit.org/show_bug.cgi?id=189132
<rdar://problem/42513068>

Reviewed by Saam Barati.

JSTests:

• stress/regress-189132.js: Added.

Source/JavaScriptCore:

• runtime/JSCJSValueInlines.h:

(JSC::JSValue::toPropertyKey const):

• runtime/JSString.cpp:

(JSC::JSRopeString::resolveRopeToAtomicString const):

File:

• trunk/Source/JavaScriptCore/runtime/JSString.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/JSString.cpp

@@ -179 +179 @@
 void JSRopeString::resolveRopeToAtomicString(ExecState* exec) const
 {
+    VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
     if (length() > maxLengthForOnStackResolve) {
         resolveRope(exec);
+        RETURN_IF_EXCEPTION(scope, void());
         m_value = AtomicString(m_value);
         setIs8Bit(m_value.impl()->is8Bit());