ASSERTION FAILED: !scope.exception() || !hasProperty in JSObject::get
authortzagallo@apple.com <tzagallo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 9 Apr 2019 07:54:18 +0000 (07:54 +0000)
committertzagallo@apple.com <tzagallo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 9 Apr 2019 07:54:18 +0000 (07:54 +0000)
commitdeadf3b5c8a5b9eec86ac88a52856b256adbf0b5
tree24c168ad5cef6e99426956c5eb6a6d69c26b8e79
parentfc0022e867fd6b6d27d70a4d4a89608151efeccf
ASSERTION FAILED: !scope.exception() || !hasProperty in JSObject::get
https://bugs.webkit.org/show_bug.cgi?id=196708
<rdar://problem/49556803>

Reviewed by Yusuke Suzuki.

JSTests:

* stress/proxy-getter-stack-overflow.js: Added.
(const.handler.get target):
(const.handler.has):
(try.with):
(catch):

Source/JavaScriptCore:

`operationPutToScope` needs to return early if an exception is thrown while
checking if `hasProperty`.

* jit/JITOperations.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@244069 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JSTests/ChangeLog
JSTests/stress/proxy-getter-stack-overflow.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/jit/JITOperations.cpp