tree f356197772ebee391563cbd5f7c1bc6ef89ae223
parent 8ad521e4a21a439df13153b252f6595d5d45cd3d
author tzagallo@apple.com <tzagallo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1557780724 +0000
committer tzagallo@apple.com <tzagallo@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1557780724 +0000

JSObject::getOwnPropertyDescriptor is missing an exception check
https://bugs.webkit.org/show_bug.cgi?id=197693
JSTests:

<rdar://problem/50441784>

Reviewed by Saam Barati.

* stress/proxy-spread.js: Added.
(foo):

Source/JavaScriptCore:

<rdar://problem/50441784>

Reviewed by Saam Barati.

The method table call to getOwnPropertySlot might throw, and JSObject::getOwnPropertyDescriptor
must handle the exception before calling PropertySlot::getValue, which can also throw.

* runtime/JSObject.cpp:
(JSC::JSObject::getOwnPropertyDescriptor):

Source/WebCore:

Reviewed by Saam Barati.

JSObject::getOwnPropertyDescriptor assumes that getOwnPropertySlot returns false
if an exception is thrown, but that was not true for JSLocation::getOwnPropertySlotCommon.

This is already covered by http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html

* bindings/js/JSLocationCustom.cpp:
(WebCore::getOwnPropertySlotCommon):
(WebCore::JSLocation::getOwnPropertySlot):
(WebCore::JSLocation::getOwnPropertySlotByIndex):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@245249 268f45cc-cd09-0410-ab3c-d52691b4dbfc