From a5a637f33e7d1a93a22bf40c3eed570ec697ba8a Mon Sep 17 00:00:00 2001 From: "ysuzuki@apple.com" Date: Tue, 4 Jun 2019 22:08:43 +0000 Subject: [PATCH] Unreviewed, update exception scope for putByIndexBeyondVectorLength https://bugs.webkit.org/show_bug.cgi?id=198477 * runtime/JSObject.cpp: (JSC::JSObject::putByIndexBeyondVectorLength): git-svn-id: https://svn.webkit.org/repository/webkit/trunk@246084 268f45cc-cd09-0410-ab3c-d52691b4dbfc --- Source/JavaScriptCore/ChangeLog | 8 ++++++++ Source/JavaScriptCore/runtime/JSObject.cpp | 20 +++++++++----------- 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog index 7adba70..521baaa 100644 --- a/Source/JavaScriptCore/ChangeLog +++ b/Source/JavaScriptCore/ChangeLog @@ -1,3 +1,11 @@ +2019-06-04 Yusuke Suzuki + + Unreviewed, update exception scope for putByIndexBeyondVectorLength + https://bugs.webkit.org/show_bug.cgi?id=198477 + + * runtime/JSObject.cpp: + (JSC::JSObject::putByIndexBeyondVectorLength): + 2019-06-04 Tadeu Zagallo Argument elimination should check transitive dependents for interference diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp index 1cb7ee0..8c2c1c5 100644 --- a/Source/JavaScriptCore/runtime/JSObject.cpp +++ b/Source/JavaScriptCore/runtime/JSObject.cpp @@ -2908,6 +2908,7 @@ bool JSObject::putByIndexBeyondVectorLengthWithArrayStorage(ExecState* exec, uns bool JSObject::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue value, bool shouldThrow) { VM& vm = exec->vm(); + auto scope = DECLARE_THROW_SCOPE(vm); RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!isCopyOnWrite(indexingMode())); @@ -2917,18 +2918,17 @@ bool JSObject::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue switch (indexingType()) { case ALL_BLANK_INDEXING_TYPES: { if (indexingShouldBeSparse(vm)) { - return putByIndexBeyondVectorLengthWithArrayStorage( + RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithArrayStorage( exec, i, value, shouldThrow, - ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm)); + ensureArrayStorageExistsAndEnterDictionaryIndexingMode(vm))); } if (indexIsSufficientlyBeyondLengthForSparseMap(i, 0) || i >= MIN_SPARSE_ARRAY_INDEX) { - return putByIndexBeyondVectorLengthWithArrayStorage( - exec, i, value, shouldThrow, createArrayStorage(vm, 0, 0)); + RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithArrayStorage(exec, i, value, shouldThrow, createArrayStorage(vm, 0, 0))); } if (needsSlowPutIndexing(vm)) { // Convert the indexing type to the SlowPutArrayStorage and retry. createArrayStorage(vm, i + 1, getNewVectorLength(vm, 0, 0, 0, i + 1)); - return putByIndex(this, exec, i, value, shouldThrow); + RELEASE_AND_RETURN(scope, putByIndex(this, exec, i, value, shouldThrow)); } createInitialForValueAndSet(vm, i, value); @@ -2941,18 +2941,17 @@ bool JSObject::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue } case ALL_INT32_INDEXING_TYPES: - return putByIndexBeyondVectorLengthWithoutAttributes(exec, i, value); + RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithoutAttributes(exec, i, value)); case ALL_DOUBLE_INDEXING_TYPES: - return putByIndexBeyondVectorLengthWithoutAttributes(exec, i, value); + RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithoutAttributes(exec, i, value)); case ALL_CONTIGUOUS_INDEXING_TYPES: - return putByIndexBeyondVectorLengthWithoutAttributes(exec, i, value); + RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithoutAttributes(exec, i, value)); case NonArrayWithSlowPutArrayStorage: case ArrayWithSlowPutArrayStorage: { // No own property present in the vector, but there might be in the sparse map! - auto scope = DECLARE_THROW_SCOPE(vm); SparseArrayValueMap* map = arrayStorage()->m_sparseMap.get(); bool putResult = false; if (!(map && map->contains(i))) { @@ -2961,13 +2960,12 @@ bool JSObject::putByIndexBeyondVectorLength(ExecState* exec, unsigned i, JSValue if (result) return putResult; } - scope.release(); FALLTHROUGH; } case NonArrayWithArrayStorage: case ArrayWithArrayStorage: - return putByIndexBeyondVectorLengthWithArrayStorage(exec, i, value, shouldThrow, arrayStorage()); + RELEASE_AND_RETURN(scope, putByIndexBeyondVectorLengthWithArrayStorage(exec, i, value, shouldThrow, arrayStorage())); default: RELEASE_ASSERT_NOT_REACHED(); -- 1.8.3.1