Changeset 235554 in webkit for trunk/Source/JavaScriptCore/runtime/JSDataView.cpp

Timestamp:

Aug 31, 2018, 9:05:22 AM (7 years ago)

Author:

[email protected]

Message:

Fix exception check accounting in JSDataView::defineOwnProperty().
​https://bugs.webkit.org/show_bug.cgi?id=189186
<rdar://problem/39786049>

Reviewed by Michael Saboff.

JSTests:

• stress/regress-189186.js: Added.

Source/JavaScriptCore:

• runtime/JSDataView.cpp:

(JSC::JSDataView::defineOwnProperty):

File:

• trunk/Source/JavaScriptCore/runtime/JSDataView.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/JSDataView.cpp

@@ -152 +152 @@
         return typeError(exec, scope, shouldThrow, "Attempting to define read-only typed array property."_s);
 
+    scope.release();
     return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
 }