Add missing exception check.
authormark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 19 May 2017 22:28:10 +0000 (22:28 +0000)
committermark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Fri, 19 May 2017 22:28:10 +0000 (22:28 +0000)
https://bugs.webkit.org/show_bug.cgi?id=172346
<rdar://problem/32289640>

Reviewed by Geoffrey Garen.

JSTests:

* stress/regress-172346.js: Added.

Source/JavaScriptCore:

* runtime/JSObject.cpp:
(JSC::JSObject::hasInstance):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@217157 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog
JSTests/stress/regress-172346.js [new file with mode: 0644]
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSObject.cpp

index a2bb983..a3f733e 100644 (file)
@@ -1,5 +1,15 @@
 2017-05-19  Mark Lam  <mark.lam@apple.com>
 
+        Add missing exception check.
+        https://bugs.webkit.org/show_bug.cgi?id=172346
+        <rdar://problem/32289640>
+
+        Reviewed by Geoffrey Garen.
+
+        * stress/regress-172346.js: Added.
+
+2017-05-19  Mark Lam  <mark.lam@apple.com>
+
         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
         https://bugs.webkit.org/show_bug.cgi?id=172383
         <rdar://problem/31418651>
diff --git a/JSTests/stress/regress-172346.js b/JSTests/stress/regress-172346.js
new file mode 100644 (file)
index 0000000..7c24948
--- /dev/null
@@ -0,0 +1,16 @@
+function test(){
+    var get = [];
+    var p = new Proxy(Function(), { get:function(){ return Proxy; }});
+    ({}) instanceof p;
+}
+
+var exception;
+try {
+    test();
+} catch (e) {
+    exception = e;
+}
+
+if (exception != "TypeError: calling Proxy constructor without new is invalid")
+    throw "FAILED";
+
index 4c7dac0..e4af12a 100644 (file)
@@ -1,5 +1,16 @@
 2017-05-19  Mark Lam  <mark.lam@apple.com>
 
+        Add missing exception check.
+        https://bugs.webkit.org/show_bug.cgi?id=172346
+        <rdar://problem/32289640>
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+
+2017-05-19  Mark Lam  <mark.lam@apple.com>
+
         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
         https://bugs.webkit.org/show_bug.cgi?id=172383
         <rdar://problem/31418651>
index ef90020..77f4736 100644 (file)
@@ -2036,6 +2036,7 @@ bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue hasInstanceVa
         MarkedArgumentBuffer args;
         args.append(value);
         JSValue result = call(exec, hasInstanceValue, callType, callData, this, args);
+        RETURN_IF_EXCEPTION(scope, false);
         return result.toBoolean(exec);
     }