Fix missing exception check in typed array constructor (2).

This fixes another crash when the the typed array constructor accesses
an array that has a throwing accessor defined on one of it's elements.

R=verwaest@chromium.org
BUG=chromium:168545
TEST=mjsunit/regress/regress-crbug-168545.js

Review URL: https://codereview.chromium.org/11791052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13351 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
parent 64b74e69
...@@ -561,7 +561,11 @@ Handle<Value> Shell::CreateExternalArray(const Arguments& args, ...@@ -561,7 +561,11 @@ Handle<Value> Shell::CreateExternalArray(const Arguments& args,
if (init_from_array) { if (init_from_array) {
Handle<Object> init = args[0]->ToObject(); Handle<Object> init = args[0]->ToObject();
for (int i = 0; i < length; ++i) array->Set(i, init->Get(i)); for (int i = 0; i < length; ++i) {
Local<Value> value = init->Get(i);
if (try_catch.HasCaught()) return try_catch.ReThrow();
array->Set(i, value);
}
} }
return array; return array;
......
...@@ -28,3 +28,7 @@ ...@@ -28,3 +28,7 @@
var o = {}; var o = {};
Object.defineProperty(o, "length", { get: function() { throw "bail"; }}); Object.defineProperty(o, "length", { get: function() { throw "bail"; }});
assertThrows("new Int16Array(o);"); assertThrows("new Int16Array(o);");
var a = [];
Object.defineProperty(a, "0", { get: function() { throw "bail"; }});
assertThrows("new Int16Array(a);");
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment