Add missing exception check.

https://bugs.webkit.org/show_bug.cgi?id=172346
<rdar://problem/32289640>

Reviewed by Geoffrey Garen.

JSTests:

* stress/regress-172346.js: Added.

Source/JavaScriptCore:

* runtime/JSObject.cpp:
(JSC::JSObject::hasInstance):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@217157 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index a2bb983..a3f733e 100644 (file)
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,5 +1,15 @@
 2017-05-19  Mark Lam  <mark.lam@apple.com>
 
+        Add missing exception check.
+        https://bugs.webkit.org/show_bug.cgi?id=172346
+        <rdar://problem/32289640>
+
+        Reviewed by Geoffrey Garen.
+
+        * stress/regress-172346.js: Added.
+
+2017-05-19  Mark Lam  <mark.lam@apple.com>
+
         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
         https://bugs.webkit.org/show_bug.cgi?id=172383
         <rdar://problem/31418651>

diff --git a/JSTests/stress/regress-172346.js b/JSTests/stress/regress-172346.js
new file mode 100644 (file)
index 0000000..7c24948
--- /dev/null
+++ b/JSTests/stress/regress-172346.js
@@ -0,0 +1,16 @@
+function test(){
+    var get = [];
+    var p = new Proxy(Function(), { get:function(){ return Proxy; }});
+    ({}) instanceof p;
+}
+
+var exception;
+try {
+    test();
+} catch (e) {
+    exception = e;
+}
+
+if (exception != "TypeError: calling Proxy constructor without new is invalid")
+    throw "FAILED";
+

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 4c7dac0..e4af12a 100644 (file)
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,5 +1,16 @@
 2017-05-19  Mark Lam  <mark.lam@apple.com>
 
+        Add missing exception check.
+        https://bugs.webkit.org/show_bug.cgi?id=172346
+        <rdar://problem/32289640>
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+
+2017-05-19  Mark Lam  <mark.lam@apple.com>
+
         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
         https://bugs.webkit.org/show_bug.cgi?id=172383
         <rdar://problem/31418651>

diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
index ef90020..77f4736 100644 (file)
--- a/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -2036,6 +2036,7 @@ bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue hasInstanceVa
         MarkedArgumentBuffer args;
         args.append(value);
         JSValue result = call(exec, hasInstanceValue, callType, callData, this, args);
+        RETURN_IF_EXCEPTION(scope, false);
         return result.toBoolean(exec);
     }