constructGenericTypedArrayViewWithArguments() is missing an exception check.
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Sep 2017 00:57:35 +0000 (00:57 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 Sep 2017 00:57:35 +0000 (00:57 +0000)
commita5fca428ac14d44a4affc89bb16cfd4ce15f11c8
treedd75784f00ec12a933b1cf5562f32002e3ed4138
parent83e66f644d92a8b2ce47e91126a8390663b7c72a
constructGenericTypedArrayViewWithArguments() is missing an exception check.
https://bugs.webkit.org/show_bug.cgi?id=176485
<rdar://problem/33898874>

Reviewed by Keith Miller.

JSTests:

* stress/regress-176485.js: Added.

Source/JavaScriptCore:

* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayViewWithArguments):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@221711 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/regress-176485.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h