tree 4ffb0001811c3037b8f632506099ff0f7ba193e4
parent 0f59fbac98361424ce2ecebb383722167b33dda5
author mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571373328 +0000
committer mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571373328 +0000

Add missing checks after calls to the sameValue() JSValue comparator.
https://bugs.webkit.org/show_bug.cgi?id=203126
<rdar://problem/56366561>

Reviewed by Saam Barati.

JSTests:

* stress/validate-exception-check-in-proxy-object-put.js: Added.

Source/JavaScriptCore:

* runtime/JSFunction.cpp:
(JSC::JSFunction::defineOwnProperty):
* runtime/JSObject.cpp:
(JSC::JSObject::defineOwnIndexedProperty):
(JSC::validateAndApplyPropertyDescriptor):
* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::equalTo const):
* runtime/ProxyObject.cpp:
(JSC::performProxyGet):
(JSC::ProxyObject::performPut):
(JSC::ProxyObject::performSetPrototype):
(JSC::ProxyObject::performGetPrototype):
* runtime/RegExpObject.cpp:
(JSC::RegExpObject::defineOwnProperty):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251274 268f45cc-cd09-0410-ab3c-d52691b4dbfc