Title: [258081] trunk/Source/_javascript_Core
- Revision
- 258081
- Author
- [email protected]
- Date
- 2020-03-07 14:53:38 -0800 (Sat, 07 Mar 2020)
Log Message
REGRESSION (r258049): Unchecked JS exception in jsc::Stringifier::toJSON
https://bugs.webkit.org/show_bug.cgi?id=208766
Reviewed by Yusuke Suzuki.
* runtime/JSONObject.cpp:
(JSC::Stringifier::toJSON): Add missing RELEASE_AND_RETURN.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (258080 => 258081)
--- trunk/Source/_javascript_Core/ChangeLog 2020-03-07 22:13:14 UTC (rev 258080)
+++ trunk/Source/_javascript_Core/ChangeLog 2020-03-07 22:53:38 UTC (rev 258081)
@@ -1,3 +1,13 @@
+2020-03-07 Alexey Shvayka <[email protected]>
+
+ REGRESSION (r258049): Unchecked JS exception in jsc::Stringifier::toJSON
+ https://bugs.webkit.org/show_bug.cgi?id=208766
+
+ Reviewed by Yusuke Suzuki.
+
+ * runtime/JSONObject.cpp:
+ (JSC::Stringifier::toJSON): Add missing RELEASE_AND_RETURN.
+
2020-03-07 Mark Lam <[email protected]>
Remove bad assertion in FTLLowerDFGToB3's compileDelBy().
Modified: trunk/Source/_javascript_Core/runtime/JSONObject.cpp (258080 => 258081)
--- trunk/Source/_javascript_Core/runtime/JSONObject.cpp 2020-03-07 22:13:14 UTC (rev 258080)
+++ trunk/Source/_javascript_Core/runtime/JSONObject.cpp 2020-03-07 22:53:38 UTC (rev 258081)
@@ -312,7 +312,7 @@
MarkedArgumentBuffer args;
args.append(propertyName.value(m_globalObject));
ASSERT(!args.hasOverflowed());
- return call(m_globalObject, asObject(toJSONFunction), callType, callData, baseValue, args);
+ RELEASE_AND_RETURN(scope, call(m_globalObject, asObject(toJSONFunction), callType, callData, baseValue, args));
}
Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder& builder, JSValue value, const Holder& holder, const PropertyNameForFunctionCall& propertyName)
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
