[webkit-changes] [246365] branches/safari-607.3.1.2-branch/Source/JavaScriptCore

Wed, 12 Jun 2019 11:17:19 -0700

Title: [246365] branches/safari-607.3.1.2-branch/Source/_javascript_Core
Revision
246365
Author
[email protected]
Date
2019-06-12 11:16:10 -0700 (Wed, 12 Jun 2019)

Log Message

Cherry-pick r246084. rdar://problem/51670920

    Unreviewed, update exception scope for putByIndexBeyondVectorLength
    https://bugs.webkit.org/show_bug.cgi?id=198477

    * runtime/JSObject.cpp:
    (JSC::JSObject::putByIndexBeyondVectorLength):

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246084 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Modified Paths

Diff

Modified: branches/safari-607.3.1.2-branch/Source/_javascript_Core/ChangeLog (246364 => 246365)


--- branches/safari-607.3.1.2-branch/Source/_javascript_Core/ChangeLog	2019-06-12 18:16:06 UTC (rev 246364)
+++ branches/safari-607.3.1.2-branch/Source/_javascript_Core/ChangeLog	2019-06-12 18:16:10 UTC (rev 246365)
@@ -1,5 +1,25 @@
 2019-06-12  Alan Coon  <[email protected]>
 
+        Cherry-pick r246084. rdar://problem/51670920
+
+    Unreviewed, update exception scope for putByIndexBeyondVectorLength
+    https://bugs.webkit.org/show_bug.cgi?id=198477
+    
+    * runtime/JSObject.cpp:
+    (JSC::JSObject::putByIndexBeyondVectorLength):
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246084 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-06-04  Yusuke Suzuki  <[email protected]>
+
+            Unreviewed, update exception scope for putByIndexBeyondVectorLength
+            https://bugs.webkit.org/show_bug.cgi?id=198477
+
+            * runtime/JSObject.cpp:
+            (JSC::JSObject::putByIndexBeyondVectorLength):
+
+2019-06-12  Alan Coon  <[email protected]>
+
         Cherry-pick r246040. rdar://problem/51670920
 
     [JSC] JSObject::attemptToInterceptPutByIndexOnHole should use getPrototype instead of getPrototypeDirect

Modified: branches/safari-607.3.1.2-branch/Source/_javascript_Core/runtime/JSObject.cpp (246364 => 246365)


--- branches/safari-607.3.1.2-branch/Source/_javascript_Core/runtime/JSObject.cpp	2019-06-12 18:16:06 UTC (rev 246364)
+++ branches/safari-607.3.1.2-branch/Source/_javascript_Core/runtime/JSObject.cpp	2019-06-12 18:16:10 UTC (rev 246365)
@@ -2862,6 +2862,7 @@
 bool JSObject::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue value, bool shouldThrow)
 {
     VM& vm = exec->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
 
     RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!isCopyOnWrite(indexingMode()));
 
@@ -2871,18 +2872,17 @@
     switch (indexingType()) {
     case ALL_BLANK_INDEXING_TYPES: {
         if (indexingShouldBeSparse(vm)) {
-            return putByIndexBeyondVectorLengthWithArrayStorage(
+            RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithArrayStorage(
                 exec, i, value, shouldThrow,
-                ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm));
+                ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm)));
         }
         if (indexIsSufficientlyBeyondLengthForSparseMap(i, 0) || i >= MIN_SPARSE_ARRAY_INDEX) {
-            return putByIndexBeyondVectorLengthWithArrayStorage(
-                exec, i, value, shouldThrow, createArrayStorage(vm, 0, 0));
+            RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithArrayStorage(exec, i, value, shouldThrow, createArrayStorage(vm, 0, 0)));
         }
         if (needsSlowPutIndexing(vm)) {
             // Convert the indexing type to the SlowPutArrayStorage and retry.
             createArrayStorage(vm, i + 1, getNewVectorLength(vm, 0, 0, 0, i + 1));
-            return putByIndex(this, exec, i, value, shouldThrow);
+            RELEASE_AND_RETURN(scope, putByIndex(this, exec, i, value, shouldThrow));
         }
         
         createInitialForValueAndSet(vm, i, value);
@@ -2895,18 +2895,17 @@
     }
         
     case ALL_INT32_INDEXING_TYPES:
-        return putByIndexBeyondVectorLengthWithoutAttributes<Int32Shape>(exec, i, value);
+        RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithoutAttributes<Int32Shape>(exec, i, value));
         
     case ALL_DOUBLE_INDEXING_TYPES:
-        return putByIndexBeyondVectorLengthWithoutAttributes<DoubleShape>(exec, i, value);
+        RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithoutAttributes<DoubleShape>(exec, i, value));
         
     case ALL_CONTIGUOUS_INDEXING_TYPES:
-        return putByIndexBeyondVectorLengthWithoutAttributes<ContiguousShape>(exec, i, value);
+        RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithoutAttributes<ContiguousShape>(exec, i, value));
         
     case NonArrayWithSlowPutArrayStorage:
     case ArrayWithSlowPutArrayStorage: {
         // No own property present in the vector, but there might be in the sparse map!
-        auto scope = DECLARE_THROW_SCOPE(vm);
         SparseArrayValueMap* map = arrayStorage()->m_sparseMap.get();
         bool putResult = false;
         if (!(map && map->contains(i))) {
@@ -2915,13 +2914,12 @@
             if (result)
                 return putResult;
         }
-        scope.release();
         FALLTHROUGH;
     }
 
     case NonArrayWithArrayStorage:
     case ArrayWithArrayStorage:
-        return putByIndexBeyondVectorLengthWithArrayStorage(exec, i, value, shouldThrow, arrayStorage());
+        RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithArrayStorage(exec, i, value, shouldThrow, arrayStorage()));
         
     default:
         RELEASE_ASSERT_NOT_REACHED();

_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to