Commit f9fa6194 authored by ulan@chromium.org's avatar ulan@chromium.org

Check that JSArray::SetElementsLength does not throw in array.length accessor.

BUG=
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/252743010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@21045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
parent 4c84cfec
...@@ -175,7 +175,7 @@ void Accessors::ArrayLengthSetter( ...@@ -175,7 +175,7 @@ void Accessors::ArrayLengthSetter(
MaybeHandle<Object> maybe_result = MaybeHandle<Object> maybe_result =
JSObject::SetLocalPropertyIgnoreAttributes( JSObject::SetLocalPropertyIgnoreAttributes(
object, isolate->factory()->length_string(), value, NONE); object, isolate->factory()->length_string(), value, NONE);
maybe_result.ToHandleChecked(); maybe_result.Check();
return; return;
} }
...@@ -197,9 +197,8 @@ void Accessors::ArrayLengthSetter( ...@@ -197,9 +197,8 @@ void Accessors::ArrayLengthSetter(
} }
if (uint32_v->Number() == number_v->Number()) { if (uint32_v->Number() == number_v->Number()) {
MaybeHandle<Object> result; maybe = JSArray::SetElementsLength(array_handle, uint32_v);
result = JSArray::SetElementsLength(array_handle, uint32_v); maybe.Check();
USE(result);
return; return;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment