Changeset 253458 in webkit for trunk/Source/JavaScriptCore/dfg

Timestamp:

Dec 12, 2019, 5:11:15 PM (5 years ago)

Author:

[email protected]

Message:

Fix missing exception in JSValue::toWTFStringSlowCase().
​https://bugs.webkit.org/show_bug.cgi?id=205176
<rdar://problem/57871899>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: Added.

Source/JavaScriptCore:

Also fix all the new exception check failures that fall out of change.
Also replaced some ASSERTs with EXCEPTION_ASSERT so that we can run the exception
check validation on a release build.

• dfg/DFGOperations.cpp:
• jsc.cpp:

(dumpException):

• runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncPush):

• runtime/ExceptionHelpers.cpp:

(JSC::createError):

• runtime/JSCJSValue.cpp:

(JSC::JSValue::toWTFStringSlowCase const):

File:

• trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp

@@ -2376 +2376 @@
 
     JSObject* base = baseValue.toObject(globalObject);
-    ASSERT(!scope.exception() || !base);
+    EXCEPTION_ASSERT(!scope.exception() || !base);
     if (!base)
         return JSValue::encode(JSValue());