<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[205595] releases/WebKitGTK/webkit-2.14/Source</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/205595">205595</a></dd>
<dt>Author</dt> <dd>carlosgc@webkit.org</dd>
<dt>Date</dt> <dd>2016-09-08 00:44:11 -0700 (Thu, 08 Sep 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/205198">r205198</a> - Introduce the ThrowScope and force every throw site to instantiate a ThrowScope.
https://bugs.webkit.org/show_bug.cgi?id=161171

Reviewed by Filip Pizlo and Geoffrey Garen.

Source/JavaScriptCore:

This is the first step towards having a mechanism (using the ThrowScope) to
verify that we're properly checking for exceptions in all the needed places.
See comments at the top of ThrowScope.cpp for details on how the ThrowScope works.

This patch only introduces the ThrowScope, and changes all throw sites to throw
using a ThrowScope instance.  VM::throwException() functions are now private, and
cannot be accessed directly.  All throws must now go through a ThrowScope.

Verification is disabled for the moment until we can fix all the verification
failures that will show up.

I also did a smoke test of the ThrowScope mechanisms by running verification on
the JSTests/stress/op-add-exceptions.js test with a local build with verification
turned on.

Performance is neutral on aggregate with this patch.

Misc other changes:
- deleted the unused CALL_THROW() macro from LLIntSlowPaths.cpp.
- moved createListFromArrayLike() from JSObject.h to JSObjectInlines.h.

* API/APICallbackFunction.h:
(JSC::APICallbackFunction::call):
(JSC::APICallbackFunction::construct):
* API/JSCallbackObjectFunctions.h:
(JSC::JSCallbackObject&lt;Parent&gt;::getOwnPropertySlot):
(JSC::JSCallbackObject&lt;Parent&gt;::defaultValue):
(JSC::JSCallbackObject&lt;Parent&gt;::put):
(JSC::JSCallbackObject&lt;Parent&gt;::putByIndex):
(JSC::JSCallbackObject&lt;Parent&gt;::deleteProperty):
(JSC::JSCallbackObject&lt;Parent&gt;::construct):
(JSC::JSCallbackObject&lt;Parent&gt;::customHasInstance):
(JSC::JSCallbackObject&lt;Parent&gt;::call):
(JSC::JSCallbackObject&lt;Parent&gt;::getStaticValue):
(JSC::JSCallbackObject&lt;Parent&gt;::staticFunctionGetter):
(JSC::JSCallbackObject&lt;Parent&gt;::callbackGetter):
* API/JSTypedArray.cpp:
(createTypedArray):
* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* dfg/DFGOperations.cpp:
(JSC::DFG::newTypedArrayWithSize):
* inspector/JSInjectedScriptHost.cpp:
(Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
* inspector/JSInjectedScriptHostPrototype.cpp:
(Inspector::jsInjectedScriptHostPrototypeAttributeEvaluate):
(Inspector::jsInjectedScriptHostPrototypeFunctionInternalConstructorName):
(Inspector::jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection):
(Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapSize):
(Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapEntries):
(Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetSize):
(Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetEntries):
(Inspector::jsInjectedScriptHostPrototypeFunctionIteratorEntries):
(Inspector::jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension):
(Inspector::jsInjectedScriptHostPrototypeFunctionSubtype):
(Inspector::jsInjectedScriptHostPrototypeFunctionFunctionDetails):
(Inspector::jsInjectedScriptHostPrototypeFunctionGetInternalProperties):
* inspector/JSJavaScriptCallFrame.cpp:
(Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
* inspector/JSJavaScriptCallFramePrototype.cpp:
(Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension):
(Inspector::jsJavaScriptCallFramePrototypeFunctionScopeDescriptions):
(Inspector::jsJavaScriptCallFrameAttributeCaller):
(Inspector::jsJavaScriptCallFrameAttributeSourceID):
(Inspector::jsJavaScriptCallFrameAttributeLine):
(Inspector::jsJavaScriptCallFrameAttributeColumn):
(Inspector::jsJavaScriptCallFrameAttributeFunctionName):
(Inspector::jsJavaScriptCallFrameAttributeScopeChain):
(Inspector::jsJavaScriptCallFrameAttributeThisObject):
(Inspector::jsJavaScriptCallFrameAttributeType):
(Inspector::jsJavaScriptCallFrameIsTailDeleted):
* interpreter/CachedCall.h:
(JSC::CachedCall::CachedCall):
* interpreter/Interpreter.cpp:
(JSC::eval):
(JSC::sizeOfVarargs):
(JSC::sizeFrameForForwardArguments):
(JSC::sizeFrameForVarargs):
(JSC::Interpreter::execute):
(JSC::Interpreter::executeCall):
(JSC::Interpreter::executeConstruct):
(JSC::Interpreter::prepareForRepeatCall):
* jit/JITOperations.cpp:
* jsc.cpp:
(WTF::CustomGetter::customGetter):
(WTF::RuntimeArray::lengthGetter):
(functionCreateElement):
(functionRun):
(functionRunString):
(functionLoad):
(functionLoadString):
(functionReadFile):
(functionCheckSyntax):
(functionTransferArrayBuffer):
(functionLoadModule):
(functionCheckModuleSyntax):
(functionSamplingProfilerStackTraces):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::getByVal):
(JSC::LLInt::handleHostCall):
(JSC::LLInt::setUpCall):
(JSC::LLInt::llint_throw_stack_overflow_error):
* runtime/ArrayConstructor.cpp:
(JSC::constructArrayWithSizeQuirk):
* runtime/ArrayConstructor.h:
(JSC::isArray):
* runtime/ArrayPrototype.cpp:
(JSC::shift):
(JSC::unshift):
(JSC::arrayProtoFuncToString):
(JSC::arrayProtoFuncPop):
(JSC::arrayProtoFuncReverse):
(JSC::arrayProtoFuncSplice):
(JSC::concatAppendOne):
(JSC::arrayProtoPrivateFuncConcatMemcpy):
* runtime/BooleanPrototype.cpp:
(JSC::booleanProtoFuncToString):
(JSC::booleanProtoFuncValueOf):
* runtime/CommonSlowPaths.cpp:
* runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::opIn):
* runtime/CommonSlowPathsExceptions.cpp:
(JSC::CommonSlowPaths::interpreterThrowInCaller):
* runtime/ConstructData.cpp:
(JSC::construct):
* runtime/DatePrototype.cpp:
(JSC::formateDateInstance):
(JSC::dateProtoFuncToISOString):
(JSC::dateProtoFuncToLocaleString):
(JSC::dateProtoFuncToLocaleDateString):
(JSC::dateProtoFuncToLocaleTimeString):
(JSC::dateProtoFuncToPrimitiveSymbol):
(JSC::dateProtoFuncGetTime):
(JSC::dateProtoFuncGetFullYear):
(JSC::dateProtoFuncGetUTCFullYear):
(JSC::dateProtoFuncGetMonth):
(JSC::dateProtoFuncGetUTCMonth):
(JSC::dateProtoFuncGetDate):
(JSC::dateProtoFuncGetUTCDate):
(JSC::dateProtoFuncGetDay):
(JSC::dateProtoFuncGetUTCDay):
(JSC::dateProtoFuncGetHours):
(JSC::dateProtoFuncGetUTCHours):
(JSC::dateProtoFuncGetMinutes):
(JSC::dateProtoFuncGetUTCMinutes):
(JSC::dateProtoFuncGetSeconds):
(JSC::dateProtoFuncGetUTCSeconds):
(JSC::dateProtoFuncGetMilliSeconds):
(JSC::dateProtoFuncGetUTCMilliseconds):
(JSC::dateProtoFuncGetTimezoneOffset):
(JSC::dateProtoFuncSetTime):
(JSC::setNewValueFromTimeArgs):
(JSC::setNewValueFromDateArgs):
(JSC::dateProtoFuncSetYear):
(JSC::dateProtoFuncGetYear):
(JSC::dateProtoFuncToJSON):
* runtime/Error.cpp:
(JSC::throwConstructorCannotBeCalledAsFunctionTypeError):
(JSC::throwTypeError):
(JSC::throwSyntaxError):
* runtime/Error.h:
(JSC::throwRangeError):
(JSC::throwVMError):
(JSC::throwVMTypeError):
(JSC::throwVMRangeError):
(JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
(JSC::StrictModeTypeErrorFunction::callThrowTypeError):
* runtime/ErrorPrototype.cpp:
(JSC::errorProtoFuncToString):
* runtime/ExceptionFuzz.cpp:
(JSC::doExceptionFuzzing):
* runtime/ExceptionHelpers.cpp:
(JSC::throwOutOfMemoryError):
(JSC::throwStackOverflowError):
(JSC::throwTerminatedExecutionException):
* runtime/ExceptionHelpers.h:
* runtime/Executable.cpp:
(JSC::ScriptExecutable::newCodeBlockFor):
(JSC::EvalExecutable::create):
* runtime/FunctionConstructor.cpp:
(JSC::constructFunction):
(JSC::constructFunctionSkippingEvalEnabledCheck):
* runtime/FunctionPrototype.cpp:
(JSC::functionProtoFuncToString):
(JSC::functionProtoFuncBind):
* runtime/GetterSetter.cpp:
(JSC::callSetter):
* runtime/IntlCollator.cpp:
(JSC::IntlCollator::compareStrings):
* runtime/IntlCollatorPrototype.cpp:
(JSC::IntlCollatorPrototypeGetterCompare):
(JSC::IntlCollatorPrototypeFuncResolvedOptions):
* runtime/IntlDateTimeFormat.cpp:
(JSC::IntlDateTimeFormat::initializeDateTimeFormat):
(JSC::IntlDateTimeFormat::format):
* runtime/IntlDateTimeFormatPrototype.cpp:
(JSC::IntlDateTimeFormatPrototypeGetterFormat):
(JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
* runtime/IntlNumberFormat.cpp:
(JSC::IntlNumberFormat::initializeNumberFormat):
(JSC::IntlNumberFormat::formatNumber):
* runtime/IntlNumberFormatPrototype.cpp:
(JSC::IntlNumberFormatPrototypeGetterFormat):
(JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
* runtime/IntlObject.cpp:
(JSC::intlStringOption):
(JSC::intlNumberOption):
(JSC::canonicalizeLocaleList):
(JSC::lookupSupportedLocales):
* runtime/IteratorOperations.cpp:
(JSC::iteratorNext):
(JSC::iteratorClose):
(JSC::createIteratorResultObject):
(JSC::iteratorForIterable):
* runtime/JSArray.cpp:
(JSC::JSArray::defineOwnProperty):
(JSC::JSArray::put):
(JSC::JSArray::appendMemcpy):
(JSC::JSArray::setLength):
(JSC::JSArray::pop):
(JSC::JSArray::push):
(JSC::JSArray::unshiftCountWithArrayStorage):
(JSC::JSArray::unshiftCountWithAnyIndexingType):
* runtime/JSArrayBufferConstructor.cpp:
(JSC::constructArrayBuffer):
(JSC::callArrayBuffer):
* runtime/JSArrayBufferPrototype.cpp:
(JSC::arrayBufferProtoFuncSlice):
* runtime/JSCInlines.h:
* runtime/JSCJSValue.cpp:
(JSC::JSValue::toObjectSlowCase):
(JSC::JSValue::synthesizePrototype):
(JSC::JSValue::putToPrimitive):
(JSC::JSValue::putToPrimitiveByIndex):
(JSC::JSValue::toStringSlowCase):
* runtime/JSCJSValueInlines.h:
(JSC::toPreferredPrimitiveType):
(JSC::JSValue::requireObjectCoercible):
* runtime/JSDataView.cpp:
(JSC::JSDataView::create):
* runtime/JSDataViewPrototype.cpp:
(JSC::getData):
(JSC::setData):
(JSC::dataViewProtoGetterBuffer):
(JSC::dataViewProtoGetterByteLength):
(JSC::dataViewProtoGetterByteOffset):
* runtime/JSFunction.cpp:
(JSC::callHostFunctionAsConstructor):
(JSC::JSFunction::callerGetter):
(JSC::JSFunction::put):
(JSC::JSFunction::defineOwnProperty):
* runtime/JSGenericTypedArrayView.h:
(JSC::JSGenericTypedArrayView::setIndex):
* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::constructGenericTypedArrayViewFromIterator):
(JSC::constructGenericTypedArrayViewWithArguments):
(JSC::constructGenericTypedArrayView):
(JSC::callGenericTypedArrayView):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::create):
(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::createUninitialized):
(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::validateRange):
(JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::throwNeuteredTypedArrayTypeError):
* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::speciesConstruct):
(JSC::genericTypedArrayViewProtoFuncSet):
(JSC::genericTypedArrayViewProtoFuncCopyWithin):
(JSC::genericTypedArrayViewProtoFuncIncludes):
(JSC::genericTypedArrayViewProtoFuncIndexOf):
(JSC::genericTypedArrayViewProtoFuncJoin):
(JSC::genericTypedArrayViewProtoFuncLastIndexOf):
(JSC::genericTypedArrayViewProtoGetterFuncBuffer):
(JSC::genericTypedArrayViewProtoGetterFuncLength):
(JSC::genericTypedArrayViewProtoGetterFuncByteLength):
(JSC::genericTypedArrayViewProtoGetterFuncByteOffset):
(JSC::genericTypedArrayViewProtoFuncReverse):
(JSC::genericTypedArrayViewPrivateFuncSort):
(JSC::genericTypedArrayViewProtoFuncSlice):
(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::createEvalCodeBlock):
(JSC::JSGlobalObject::createModuleProgramCodeBlock):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::encode):
(JSC::decode):
(JSC::globalFuncEval):
(JSC::globalFuncThrowTypeError):
(JSC::globalFuncThrowTypeErrorArgumentsCalleeAndCaller):
(JSC::globalFuncProtoGetter):
(JSC::globalFuncProtoSetter):
* runtime/JSModuleEnvironment.cpp:
(JSC::JSModuleEnvironment::put):
* runtime/JSModuleNamespaceObject.cpp:
(JSC::JSModuleNamespaceObject::getOwnPropertySlot):
(JSC::JSModuleNamespaceObject::put):
(JSC::JSModuleNamespaceObject::putByIndex):
(JSC::JSModuleNamespaceObject::defineOwnProperty):
(JSC::moduleNamespaceObjectSymbolIterator):
* runtime/JSModuleRecord.cpp:
(JSC::JSModuleRecord::getModuleNamespace):
(JSC::JSModuleRecord::link):
(JSC::JSModuleRecord::instantiateDeclarations):
* runtime/JSONObject.cpp:
(JSC::Stringifier::appendStringifiedValue):
(JSC::Walker::walk):
(JSC::JSONProtoFuncParse):
(JSC::JSONProtoFuncStringify):
* runtime/JSObject.cpp:
(JSC::JSObject::setPrototypeWithCycleCheck):
(JSC::callToPrimitiveFunction):
(JSC::JSObject::ordinaryToPrimitive):
(JSC::JSObject::hasInstance):
(JSC::JSObject::defaultHasInstance):
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
(JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
(JSC::validateAndApplyPropertyDescriptor):
(JSC::JSObject::getMethod):
* runtime/JSObject.h:
(JSC::createListFromArrayLike): Deleted.
* runtime/JSObjectInlines.h:
(JSC::createListFromArrayLike):
(JSC::JSObject::putInline):
* runtime/JSPromiseConstructor.cpp:
(JSC::constructPromise):
(JSC::callPromise):
* runtime/JSPropertyNameIterator.cpp:
(JSC::propertyNameIteratorFuncNext):
* runtime/JSString.cpp:
(JSC::JSRopeString::outOfMemory):
* runtime/JSStringBuilder.h:
(JSC::JSStringBuilder::build):
(JSC::jsMakeNontrivialString):
* runtime/JSStringJoiner.cpp:
(JSC::JSStringJoiner::joinedLength):
(JSC::JSStringJoiner::join):
* runtime/JSStringJoiner.h:
(JSC::JSStringJoiner::JSStringJoiner):
* runtime/JSSymbolTableObject.h:
(JSC::symbolTablePut):
* runtime/JSTypedArrayViewConstructor.cpp:
(JSC::constructTypedArrayView):
* runtime/JSTypedArrayViewPrototype.cpp:
(JSC::typedArrayViewPrivateFuncLength):
(JSC::typedArrayViewPrivateFuncSort):
(JSC::typedArrayViewProtoFuncSet):
(JSC::typedArrayViewProtoFuncCopyWithin):
(JSC::typedArrayViewProtoFuncIncludes):
(JSC::typedArrayViewProtoFuncLastIndexOf):
(JSC::typedArrayViewProtoFuncIndexOf):
(JSC::typedArrayViewProtoFuncJoin):
(JSC::typedArrayViewProtoGetterFuncBuffer):
(JSC::typedArrayViewProtoGetterFuncLength):
(JSC::typedArrayViewProtoGetterFuncByteLength):
(JSC::typedArrayViewProtoGetterFuncByteOffset):
(JSC::typedArrayViewProtoFuncReverse):
(JSC::typedArrayViewPrivateFuncSubarrayCreate):
(JSC::typedArrayViewProtoFuncSlice):
* runtime/MapConstructor.cpp:
(JSC::callMap):
(JSC::constructMap):
* runtime/MapDataInlines.h:
(JSC::JSIterator&gt;::ensureSpaceForAppend):
* runtime/MapIteratorPrototype.cpp:
(JSC::MapIteratorPrototypeFuncNext):
* runtime/MapPrototype.cpp:
(JSC::getMap):
(JSC::mapProtoFuncValues):
(JSC::mapProtoFuncEntries):
(JSC::mapProtoFuncKeys):
* runtime/ModuleLoaderPrototype.cpp:
(JSC::moduleLoaderPrototypeParseModule):
* runtime/NullSetterFunction.cpp:
(JSC::callReturnUndefined):
* runtime/NumberPrototype.cpp:
(JSC::numberProtoFuncToExponential):
(JSC::numberProtoFuncToFixed):
(JSC::numberProtoFuncToPrecision):
(JSC::numberProtoFuncToString):
(JSC::numberProtoFuncToLocaleString):
(JSC::numberProtoFuncValueOf):
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorSetPrototypeOf):
(JSC::toPropertyDescriptor):
(JSC::objectConstructorDefineProperty):
(JSC::objectConstructorDefineProperties):
(JSC::objectConstructorCreate):
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncDefineGetter):
(JSC::objectProtoFuncDefineSetter):
(JSC::objectProtoFuncToString):
* runtime/Operations.h:
(JSC::jsString):
(JSC::jsStringFromRegisterArray):
(JSC::jsStringFromArguments):
* runtime/ProxyConstructor.cpp:
(JSC::makeRevocableProxy):
(JSC::proxyRevocableConstructorThrowError):
(JSC::constructProxyObject):
(JSC::callProxy):
* runtime/ProxyObject.cpp:
(JSC::ProxyObject::finishCreation):
(JSC::performProxyGet):
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::getOwnPropertySlotCommon):
(JSC::ProxyObject::performPut):
(JSC::performProxyCall):
(JSC::performProxyConstruct):
(JSC::ProxyObject::performDelete):
(JSC::ProxyObject::performPreventExtensions):
(JSC::ProxyObject::performIsExtensible):
(JSC::ProxyObject::performDefineOwnProperty):
(JSC::ProxyObject::performGetOwnPropertyNames):
(JSC::ProxyObject::performSetPrototype):
(JSC::ProxyObject::performGetPrototype):
* runtime/ReflectObject.cpp:
(JSC::reflectObjectConstruct):
(JSC::reflectObjectDefineProperty):
(JSC::reflectObjectEnumerate):
(JSC::reflectObjectGet):
(JSC::reflectObjectGetOwnPropertyDescriptor):
(JSC::reflectObjectGetPrototypeOf):
(JSC::reflectObjectIsExtensible):
(JSC::reflectObjectOwnKeys):
(JSC::reflectObjectPreventExtensions):
(JSC::reflectObjectSet):
(JSC::reflectObjectSetPrototypeOf):
* runtime/RegExpConstructor.cpp:
(JSC::toFlags):
(JSC::regExpCreate):
* runtime/RegExpObject.cpp:
(JSC::collectMatches):
* runtime/RegExpObject.h:
(JSC::RegExpObject::setLastIndex):
* runtime/RegExpPrototype.cpp:
(JSC::regExpProtoFuncTestFast):
(JSC::regExpProtoFuncExec):
(JSC::regExpProtoFuncMatchFast):
(JSC::regExpProtoFuncCompile):
(JSC::regExpProtoFuncToString):
(JSC::regExpProtoGetterGlobal):
(JSC::regExpProtoGetterIgnoreCase):
(JSC::regExpProtoGetterMultiline):
(JSC::regExpProtoGetterSticky):
(JSC::regExpProtoGetterUnicode):
(JSC::regExpProtoGetterFlags):
(JSC::regExpProtoGetterSource):
(JSC::regExpProtoFuncSplitFast):
* runtime/Reject.h:
(JSC::reject):
* runtime/SetConstructor.cpp:
(JSC::callSet):
(JSC::constructSet):
* runtime/SetIteratorPrototype.cpp:
(JSC::SetIteratorPrototypeFuncNext):
* runtime/SetPrototype.cpp:
(JSC::getSet):
(JSC::setProtoFuncValues):
(JSC::setProtoFuncEntries):
* runtime/SparseArrayValueMap.cpp:
(JSC::SparseArrayValueMap::putEntry):
(JSC::SparseArrayEntry::put):
* runtime/StringConstructor.cpp:
(JSC::stringFromCodePoint):
* runtime/StringObject.cpp:
(JSC::StringObject::put):
(JSC::StringObject::putByIndex):
* runtime/StringPrototype.cpp:
(JSC::jsSpliceSubstrings):
(JSC::jsSpliceSubstringsWithSeparators):
(JSC::repeatCharacter):
(JSC::replace):
(JSC::stringProtoFuncToString):
(JSC::stringProtoFuncCharAt):
(JSC::stringProtoFuncCharCodeAt):
(JSC::stringProtoFuncCodePointAt):
(JSC::stringProtoFuncConcat):
(JSC::stringProtoFuncIndexOf):
(JSC::stringProtoFuncLastIndexOf):
(JSC::stringProtoFuncSlice):
(JSC::stringProtoFuncSubstr):
(JSC::stringProtoFuncSubstring):
(JSC::stringProtoFuncToLowerCase):
(JSC::stringProtoFuncToUpperCase):
(JSC::stringProtoFuncLocaleCompare):
(JSC::toLocaleCase):
(JSC::stringProtoFuncBig):
(JSC::stringProtoFuncSmall):
(JSC::stringProtoFuncBlink):
(JSC::stringProtoFuncBold):
(JSC::stringProtoFuncFixed):
(JSC::stringProtoFuncItalics):
(JSC::stringProtoFuncStrike):
(JSC::stringProtoFuncSub):
(JSC::stringProtoFuncSup):
(JSC::stringProtoFuncFontcolor):
(JSC::stringProtoFuncFontsize):
(JSC::stringProtoFuncAnchor):
(JSC::stringProtoFuncLink):
(JSC::trimString):
(JSC::stringProtoFuncStartsWith):
(JSC::stringProtoFuncEndsWith):
(JSC::stringProtoFuncIncludes):
(JSC::stringProtoFuncIterator):
(JSC::normalize):
(JSC::stringProtoFuncNormalize):
* runtime/StringRecursionChecker.cpp:
(JSC::StringRecursionChecker::throwStackOverflowError):
* runtime/Symbol.cpp:
(JSC::Symbol::toNumber):
* runtime/SymbolConstructor.cpp:
(JSC::symbolConstructorKeyFor):
* runtime/SymbolPrototype.cpp:
(JSC::symbolProtoFuncToString):
(JSC::symbolProtoFuncValueOf):
* runtime/ThrowScope.cpp: Added.
(JSC::ThrowScope::ThrowScope):
(JSC::ThrowScope::~ThrowScope):
(JSC::ThrowScope::throwException):
(JSC::ThrowScope::printIfNeedCheck):
(JSC::ThrowScope::simulateThrow):
(JSC::ThrowScope::verifyExceptionCheckNeedIsSatisfied):
* runtime/ThrowScope.h: Added.
(JSC::ThrowScope::vm):
(JSC::ThrowScope::exception):
(JSC::ThrowScope::release):
(JSC::ThrowScope::ThrowScope):
(JSC::ThrowScope::throwException):
(JSC::throwException):
* runtime/ThrowScopeLocation.h: Added.
(JSC::ThrowScopeLocation::ThrowScopeLocation):
* runtime/VM.h:
* runtime/VMEntryScope.h:
(JSC::VMEntryScope::vm):
* runtime/WeakMapConstructor.cpp:
(JSC::callWeakMap):
(JSC::constructWeakMap):
* runtime/WeakMapPrototype.cpp:
(JSC::getWeakMapData):
(JSC::protoFuncWeakMapSet):
* runtime/WeakSetConstructor.cpp:
(JSC::callWeakSet):
(JSC::constructWeakSet):
* runtime/WeakSetPrototype.cpp:
(JSC::getWeakMapData):
(JSC::protoFuncWeakSetAdd):

Source/WebCore:

No new tests because this is only an internal API change. If it builds, it should be good.

* bindings/js/JSApplePaySessionCustom.cpp:
(WebCore::JSApplePaySession::completeShippingMethodSelection):
(WebCore::JSApplePaySession::completeShippingContactSelection):
(WebCore::JSApplePaySession::completePaymentMethodSelection):
* bindings/js/JSBlobCustom.cpp:
(WebCore::constructJSBlob):
* bindings/js/JSCSSStyleDeclarationCustom.cpp:
(WebCore::JSCSSStyleDeclaration::getPropertyCSSValue):
* bindings/js/JSCryptoAlgorithmDictionary.cpp:
(WebCore::JSCryptoAlgorithmDictionary::getAlgorithmIdentifier):
(WebCore::createAesCbcParams):
(WebCore::createAesKeyGenParams):
(WebCore::createHmacParams):
(WebCore::createHmacKeyParams):
(WebCore::createRsaKeyGenParams):
(WebCore::createRsaOaepParams):
(WebCore::createRsaSsaParams):
* bindings/js/JSCryptoCustom.cpp:
(WebCore::JSCrypto::getRandomValues):
* bindings/js/JSCryptoKeySerializationJWK.cpp:
(WebCore::getJSArrayFromJSON):
(WebCore::getStringFromJSON):
(WebCore::getBooleanFromJSON):
(WebCore::getBigIntegerVectorFromJSON):
(WebCore::JSCryptoKeySerializationJWK::JSCryptoKeySerializationJWK):
(WebCore::JSCryptoKeySerializationJWK::reconcileAlgorithm):
(WebCore::tryJWKKeyOpsValue):
(WebCore::JSCryptoKeySerializationJWK::reconcileUsages):
(WebCore::JSCryptoKeySerializationJWK::keyDataOctetSequence):
(WebCore::JSCryptoKeySerializationJWK::keyDataRSAComponents):
(WebCore::JSCryptoKeySerializationJWK::keyData):
(WebCore::addJWKAlgorithmToJSON):
(WebCore::JSCryptoKeySerializationJWK::serialize):
* bindings/js/JSCryptoOperationData.cpp:
(WebCore::cryptoOperationDataFromJSValue):
* bindings/js/JSCustomElementInterface.cpp:
(WebCore::JSCustomElementInterface::upgradeElement):
* bindings/js/JSCustomElementRegistryCustom.cpp:
(WebCore::getCustomElementCallback):
(WebCore::JSCustomElementRegistry::define):
* bindings/js/JSDOMBinding.cpp:
(WebCore::setDOMException):
(WebCore::enforceRange):
(WebCore::toSmallerInt):
(WebCore::toSmallerUInt):
(WebCore::canAccessDocument):
(WebCore::throwTypeError):
(WebCore::throwNotSupportedError):
(WebCore::throwInvalidStateError):
(WebCore::throwSecurityError):
(WebCore::throwArgumentMustBeEnumError):
(WebCore::throwArgumentMustBeFunctionError):
(WebCore::throwArgumentTypeError):
(WebCore::throwArrayElementTypeError):
(WebCore::throwAttributeTypeError):
(WebCore::throwConstructorScriptExecutionContextUnavailableError):
(WebCore::throwSequenceTypeError):
(WebCore::throwNonFiniteTypeError):
(WebCore::throwGetterTypeError):
(WebCore::throwSetterTypeError):
(WebCore::throwThisTypeError):
(WebCore::callThrowTypeError):
* bindings/js/JSDOMBinding.h:
(WebCore::toJSSequence):
(WebCore::toRefPtrNativeArray):
(WebCore::toNativeArray):
* bindings/js/JSDOMConstructor.h:
(WebCore::JSDOMConstructorNotConstructable::callThrowTypeError):
(WebCore::JSBuiltinConstructor&lt;JSClass&gt;::callConstructor):
* bindings/js/JSDOMConvert.h:
(WebCore::convertWrapperType):
* bindings/js/JSDOMIterator.h:
(WebCore::iteratorCreate):
(WebCore::iteratorForEach):
(WebCore::JSDOMIteratorPrototype&lt;JSWrapper&gt;::next):
* bindings/js/JSDOMWindowCustom.cpp:
(WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
(WebCore::JSDOMWindow::put):
(WebCore::JSDOMWindow::showModalDialog):
(WebCore::handlePostMessage):
(WebCore::JSDOMWindow::setTimeout):
(WebCore::JSDOMWindow::setInterval):
* bindings/js/JSDataCueCustom.cpp:
(WebCore::constructJSDataCue):
* bindings/js/JSDictionary.cpp:
(WebCore::JSDictionary::convertValue):
* bindings/js/JSDocumentCustom.cpp:
(WebCore::JSDocument::createTouchList):
(WebCore::JSDocument::getCSSCanvasContext):
* bindings/js/JSFileCustom.cpp:
(WebCore::constructJSFile):
* bindings/js/JSHTMLAllCollectionCustom.cpp:
(WebCore::JSHTMLAllCollection::item):
* bindings/js/JSHTMLCanvasElementCustom.cpp:
(WebCore::JSHTMLCanvasElement::getContext):
(WebCore::JSHTMLCanvasElement::probablySupportsContext):
* bindings/js/JSHTMLDocumentCustom.cpp:
(WebCore::JSHTMLDocument::open):
* bindings/js/JSHTMLElementCustom.cpp:
(WebCore::constructJSHTMLElement):
* bindings/js/JSHTMLFormControlsCollectionCustom.cpp:
(WebCore::JSHTMLFormControlsCollection::namedItem):
* bindings/js/JSHTMLInputElementCustom.cpp:
(WebCore::JSHTMLInputElement::selectionStart):
(WebCore::JSHTMLInputElement::setSelectionStart):
(WebCore::JSHTMLInputElement::selectionEnd):
(WebCore::JSHTMLInputElement::setSelectionEnd):
(WebCore::JSHTMLInputElement::selectionDirection):
(WebCore::JSHTMLInputElement::setSelectionDirection):
(WebCore::JSHTMLInputElement::setSelectionRange):
* bindings/js/JSHistoryCustom.cpp:
(WebCore::JSHistory::pushState):
(WebCore::JSHistory::replaceState):
* bindings/js/JSIDBDatabaseCustom.cpp:
(WebCore::JSIDBDatabase::createObjectStore):
* bindings/js/JSImageConstructor.cpp:
(WebCore::JSImageConstructor::construct):
* bindings/js/JSLocationCustom.cpp:
(WebCore::JSLocation::getOwnPropertySlotDelegate):
* bindings/js/JSMediaDevicesCustom.cpp:
(WebCore::JSMediaDevices::getUserMedia):
* bindings/js/JSMediaStreamTrackCustom.cpp:
(WebCore::JSMediaStreamTrack::getSettings):
(WebCore::JSMediaStreamTrack::getCapabilities):
* bindings/js/JSMessagePortCustom.cpp:
(WebCore::fillMessagePortArray):
* bindings/js/JSMessagePortCustom.h:
(WebCore::handlePostMessage):
* bindings/js/JSMockContentFilterSettingsCustom.cpp:
(WebCore::JSMockContentFilterSettings::setDecisionPoint):
(WebCore::toDecision):
* bindings/js/JSModuleLoader.cpp:
(WebCore::JSModuleLoader::evaluate):
* bindings/js/JSMutationObserverCustom.cpp:
(WebCore::constructJSMutationObserver):
* bindings/js/JSNodeCustom.cpp:
(WebCore::JSNode::insertBefore):
(WebCore::JSNode::replaceChild):
(WebCore::JSNode::removeChild):
(WebCore::JSNode::appendChild):
* bindings/js/JSNodeFilterCustom.cpp:
(WebCore::JSNodeFilter::acceptNode):
* bindings/js/JSPluginElementFunctions.cpp:
(WebCore::pluginElementPropertyGetter):
* bindings/js/JSReadableStreamPrivateConstructors.cpp:
(WebCore::constructJSReadableStreamDefaultController):
(WebCore::constructJSReadableStreamDefaultReader):
* bindings/js/JSSVGLengthCustom.cpp:
(WebCore::JSSVGLength::setValue):
(WebCore::JSSVGLength::convertToSpecifiedUnits):
* bindings/js/JSWebGL2RenderingContextCustom.cpp:
(WebCore::JSWebGL2RenderingContext::getIndexedParameter):
* bindings/js/JSWebGLRenderingContextBaseCustom.cpp:
(WebCore::getObjectParameter):
(WebCore::JSWebGLRenderingContextBase::getAttachedShaders):
(WebCore::JSWebGLRenderingContextBase::getExtension):
(WebCore::JSWebGLRenderingContextBase::getFramebufferAttachmentParameter):
(WebCore::JSWebGLRenderingContextBase::getParameter):
(WebCore::JSWebGLRenderingContextBase::getProgramParameter):
(WebCore::JSWebGLRenderingContextBase::getShaderParameter):
(WebCore::JSWebGLRenderingContextBase::getUniform):
(WebCore::dataFunctionf):
(WebCore::dataFunctioni):
(WebCore::dataFunctionMatrix):
* bindings/js/JSWebKitSubtleCryptoCustom.cpp:
(WebCore::cryptoKeyFormatFromJSValue):
(WebCore::cryptoKeyUsagesFromJSValue):
(WebCore::JSWebKitSubtleCrypto::encrypt):
(WebCore::JSWebKitSubtleCrypto::decrypt):
(WebCore::JSWebKitSubtleCrypto::sign):
(WebCore::JSWebKitSubtleCrypto::verify):
(WebCore::JSWebKitSubtleCrypto::digest):
(WebCore::JSWebKitSubtleCrypto::generateKey):
(WebCore::importKey):
(WebCore::JSWebKitSubtleCrypto::importKey):
(WebCore::exportKey):
(WebCore::JSWebKitSubtleCrypto::exportKey):
(WebCore::JSWebKitSubtleCrypto::wrapKey):
(WebCore::JSWebKitSubtleCrypto::unwrapKey):
* bindings/js/JSWorkerCustom.cpp:
(WebCore::constructJSWorker):
* bindings/js/JSWorkerGlobalScopeCustom.cpp:
(WebCore::JSWorkerGlobalScope::setTimeout):
(WebCore::JSWorkerGlobalScope::setInterval):
* bindings/js/ReadableStreamDefaultController.cpp:
(WebCore::ReadableStreamDefaultController::invoke):
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneBase::throwStackOverflow):
(WebCore::CloneDeserializer::throwValidationError):
(WebCore::SerializedScriptValue::maybeThrowExceptionIfSerializationFailed):
* bindings/js/WorkerScriptController.cpp:
(WebCore::WorkerScriptController::evaluate):
(WebCore::WorkerScriptController::setException):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateEnumerationImplementationContent):
(GenerateDictionaryImplementationContent):
(GenerateOverloadedFunctionOrConstructor):
(GenerateImplementation):
(GenerateFunctionCastedThis):
(GenerateArgumentsCountCheck):
(GenerateParametersCheck):
(GenerateConstructorDefinition):
* bindings/scripts/test/JS/JSInterfaceName.cpp:
(WebCore::jsInterfaceNameConstructor):
(WebCore::setJSInterfaceNameConstructor):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::jsTestActiveDOMObjectExcitingAttr):
(WebCore::jsTestActiveDOMObjectConstructor):
(WebCore::setJSTestActiveDOMObjectConstructor):
(WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):
(WebCore::jsTestActiveDOMObjectPrototypeFunctionPostMessage):
* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
(WebCore::jsTestClassWithJSBuiltinConstructorConstructor):
(WebCore::setJSTestClassWithJSBuiltinConstructorConstructor):
* bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
(WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):
(WebCore::setJSTestCustomConstructorWithNoInterfaceObjectConstructor):
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore::jsTestCustomNamedGetterConstructor):
(WebCore::setJSTestCustomNamedGetterConstructor):
(WebCore::jsTestCustomNamedGetterPrototypeFunctionAnotherFunction):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore::JSTestEventConstructorConstructor::construct):
(WebCore::jsTestEventConstructorAttr1):
(WebCore::jsTestEventConstructorAttr2):
(WebCore::jsTestEventConstructorAttr3):
(WebCore::jsTestEventConstructorConstructor):
(WebCore::setJSTestEventConstructorConstructor):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::jsTestEventTargetConstructor):
(WebCore::setJSTestEventTargetConstructor):
(WebCore::jsTestEventTargetPrototypeFunctionItem):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::jsTestExceptionName):
(WebCore::jsTestExceptionConstructor):
(WebCore::setJSTestExceptionConstructor):
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
(WebCore::jsTestGenerateIsReachableConstructor):
(WebCore::setJSTestGenerateIsReachableConstructor):
* bindings/scripts/test/JS/JSTestGlobalObject.cpp:
(WebCore::jsTestGlobalObjectRegularAttribute):
(WebCore::jsTestGlobalObjectPublicAndPrivateAttribute):
(WebCore::jsTestGlobalObjectPublicAndPrivateConditionalAttribute):
(WebCore::jsTestGlobalObjectEnabledAtRuntimeAttribute):
(WebCore::jsTestGlobalObjectConstructor):
(WebCore::setJSTestGlobalObjectConstructor):
(WebCore::setJSTestGlobalObjectRegularAttribute):
(WebCore::setJSTestGlobalObjectPublicAndPrivateAttribute):
(WebCore::setJSTestGlobalObjectPublicAndPrivateConditionalAttribute):
(WebCore::setJSTestGlobalObjectEnabledAtRuntimeAttribute):
(WebCore::jsTestGlobalObjectInstanceFunctionRegularOperation):
(WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation1):
(WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation2):
(WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation):
(WebCore::jsTestGlobalObjectInstanceFunctionTestPrivateFunction):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterfaceConstructor::construct):
(WebCore::jsTestInterfaceConstructorImplementsStaticReadOnlyAttr):
(WebCore::jsTestInterfaceConstructorImplementsStaticAttr):
(WebCore::jsTestInterfaceImplementsStr1):
(WebCore::jsTestInterfaceImplementsStr2):
(WebCore::jsTestInterfaceImplementsStr3):
(WebCore::jsTestInterfaceImplementsNode):
(WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
(WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
(WebCore::jsTestInterfaceSupplementalStr1):
(WebCore::jsTestInterfaceSupplementalStr2):
(WebCore::jsTestInterfaceSupplementalStr3):
(WebCore::jsTestInterfaceSupplementalNode):
(WebCore::jsTestInterfaceConstructor):
(WebCore::setJSTestInterfaceConstructor):
(WebCore::setJSTestInterfaceConstructorImplementsStaticAttr):
(WebCore::setJSTestInterfaceImplementsStr2):
(WebCore::setJSTestInterfaceImplementsStr3):
(WebCore::setJSTestInterfaceImplementsNode):
(WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
(WebCore::setJSTestInterfaceSupplementalStr2):
(WebCore::setJSTestInterfaceSupplementalStr3):
(WebCore::setJSTestInterfaceSupplementalNode):
(WebCore::jsTestInterfacePrototypeFunctionImplementsMethod1):
(WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
(WebCore::jsTestInterfacePrototypeFunctionImplementsMethod3):
(WebCore::jsTestInterfaceConstructorFunctionImplementsMethod4):
(WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod1):
(WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
(WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod3):
(WebCore::jsTestInterfaceConstructorFunctionSupplementalMethod4):
* bindings/scripts/test/JS/JSTestIterable.cpp:
(WebCore::jsTestIterableConstructor):
(WebCore::setJSTestIterableConstructor):
* bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
(WebCore::jsTestJSBuiltinConstructorTestAttributeCustom):
(WebCore::jsTestJSBuiltinConstructorTestAttributeRWCustom):
(WebCore::jsTestJSBuiltinConstructorConstructor):
(WebCore::setJSTestJSBuiltinConstructorConstructor):
(WebCore::setJSTestJSBuiltinConstructorTestAttributeRWCustom):
(WebCore::jsTestJSBuiltinConstructorPrototypeFunctionTestCustomFunction):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::jsTestMediaQueryListListenerConstructor):
(WebCore::setJSTestMediaQueryListListenerConstructor):
(WebCore::jsTestMediaQueryListListenerPrototypeFunctionMethod):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore::JSTestNamedConstructorNamedConstructor::construct):
(WebCore::jsTestNamedConstructorConstructor):
(WebCore::setJSTestNamedConstructorConstructor):
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore::JSTestNodeConstructor::construct):
(WebCore::jsTestNodeName):
(WebCore::jsTestNodeConstructor):
(WebCore::setJSTestNodeConstructor):
(WebCore::setJSTestNodeName):
* bindings/scripts/test/JS/JSTestNondeterministic.cpp:
(WebCore::jsTestNondeterministicNondeterministicReadonlyAttr):
(WebCore::jsTestNondeterministicNondeterministicWriteableAttr):
(WebCore::jsTestNondeterministicNondeterministicExceptionAttr):
(WebCore::jsTestNondeterministicNondeterministicGetterExceptionAttr):
(WebCore::jsTestNondeterministicNondeterministicSetterExceptionAttr):
(WebCore::jsTestNondeterministicConstructor):
(WebCore::setJSTestNondeterministicConstructor):
(WebCore::setJSTestNondeterministicNondeterministicWriteableAttr):
(WebCore::setJSTestNondeterministicNondeterministicExceptionAttr):
(WebCore::setJSTestNondeterministicNondeterministicGetterExceptionAttr):
(WebCore::setJSTestNondeterministicNondeterministicSetterExceptionAttr):
(WebCore::jsTestNondeterministicPrototypeFunctionNondeterministicZeroArgFunction):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::convert&lt;TestObj::EnumType&gt;):
(WebCore::convert&lt;TestObj::Optional&gt;):
(WebCore::convert&lt;AlternateEnumName&gt;):
(WebCore::convert&lt;TestObj::EnumA&gt;):
(WebCore::convert&lt;TestObj::EnumB&gt;):
(WebCore::convert&lt;TestObj::EnumC&gt;):
(WebCore::convert&lt;TestObj::Kind&gt;):
(WebCore::convert&lt;TestObj::Size&gt;):
(WebCore::convert&lt;TestObj::Confidence&gt;):
(WebCore::convertDictionary&lt;TestObj::Dictionary&gt;):
(WebCore::convertDictionary&lt;TestObj::DictionaryThatShouldNotTolerateNull&gt;):
(WebCore::convertDictionary&lt;TestObj::DictionaryThatShouldTolerateNull&gt;):
(WebCore::convertDictionary&lt;AlternateDictionaryName&gt;):
(WebCore::JSTestObjConstructor::construct):
(WebCore::jsTestObjReadOnlyLongAttr):
(WebCore::jsTestObjReadOnlyStringAttr):
(WebCore::jsTestObjReadOnlyTestObjAttr):
(WebCore::jsTestObjConstructorStaticReadOnlyLongAttr):
(WebCore::jsTestObjConstructorStaticStringAttr):
(WebCore::jsTestObjConstructorTestSubObj):
(WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
(WebCore::jsTestObjEnumAttr):
(WebCore::jsTestObjByteAttr):
(WebCore::jsTestObjOctetAttr):
(WebCore::jsTestObjShortAttr):
(WebCore::jsTestObjClampedShortAttr):
(WebCore::jsTestObjEnforceRangeShortAttr):
(WebCore::jsTestObjUnsignedShortAttr):
(WebCore::jsTestObjLongAttr):
(WebCore::jsTestObjLongLongAttr):
(WebCore::jsTestObjUnsignedLongLongAttr):
(WebCore::jsTestObjStringAttr):
(WebCore::jsTestObjUsvstringAttr):
(WebCore::jsTestObjTestObjAttr):
(WebCore::jsTestObjTestNullableObjAttr):
(WebCore::jsTestObjLenientTestObjAttr):
(WebCore::jsTestObjUnforgeableAttr):
(WebCore::jsTestObjStringAttrTreatingNullAsEmptyString):
(WebCore::jsTestObjUsvstringAttrTreatingNullAsEmptyString):
(WebCore::jsTestObjImplementationEnumAttr):
(WebCore::jsTestObjXMLObjAttr):
(WebCore::jsTestObjCreate):
(WebCore::jsTestObjReflectedStringAttr):
(WebCore::jsTestObjReflectedUSVStringAttr):
(WebCore::jsTestObjReflectedIntegralAttr):
(WebCore::jsTestObjReflectedUnsignedIntegralAttr):
(WebCore::jsTestObjReflectedBooleanAttr):
(WebCore::jsTestObjReflectedURLAttr):
(WebCore::jsTestObjReflectedUSVURLAttr):
(WebCore::jsTestObjReflectedCustomIntegralAttr):
(WebCore::jsTestObjReflectedCustomBooleanAttr):
(WebCore::jsTestObjReflectedCustomURLAttr):
(WebCore::jsTestObjEnabledAtRuntimeAttribute):
(WebCore::jsTestObjTypedArrayAttr):
(WebCore::jsTestObjAttrWithGetterException):
(WebCore::jsTestObjAttrWithGetterExceptionWithMessage):
(WebCore::jsTestObjAttrWithSetterException):
(WebCore::jsTestObjAttrWithSetterExceptionWithMessage):
(WebCore::jsTestObjStringAttrWithGetterException):
(WebCore::jsTestObjStringAttrWithSetterException):
(WebCore::jsTestObjCustomAttr):
(WebCore::jsTestObjOnfoo):
(WebCore::jsTestObjOnwebkitfoo):
(WebCore::jsTestObjWithScriptStateAttribute):
(WebCore::jsTestObjWithCallWithAndSetterCallWithAttribute):
(WebCore::jsTestObjWithScriptExecutionContextAttribute):
(WebCore::jsTestObjWithScriptStateAttributeRaises):
(WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
(WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
(WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
(WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
(WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
(WebCore::jsTestObjConditionalAttr1):
(WebCore::jsTestObjConditionalAttr2):
(WebCore::jsTestObjConditionalAttr3):
(WebCore::jsTestObjConditionalAttr4Constructor):
(WebCore::jsTestObjConditionalAttr5Constructor):
(WebCore::jsTestObjConditionalAttr6Constructor):
(WebCore::jsTestObjCachedAttribute1):
(WebCore::jsTestObjCachedAttribute2):
(WebCore::jsTestObjAnyAttribute):
(WebCore::jsTestObjContentDocument):
(WebCore::jsTestObjMutablePoint):
(WebCore::jsTestObjImmutablePoint):
(WebCore::jsTestObjStrawberry):
(WebCore::jsTestObjDescription):
(WebCore::jsTestObjId):
(WebCore::jsTestObjHash):
(WebCore::jsTestObjReplaceableAttribute):
(WebCore::jsTestObjNullableDoubleAttribute):
(WebCore::jsTestObjNullableLongAttribute):
(WebCore::jsTestObjNullableBooleanAttribute):
(WebCore::jsTestObjNullableStringAttribute):
(WebCore::jsTestObjNullableLongSettableAttribute):
(WebCore::jsTestObjNullableStringSettableAttribute):
(WebCore::jsTestObjNullableUSVStringSettableAttribute):
(WebCore::jsTestObjNullableStringValue):
(WebCore::jsTestObjAttribute):
(WebCore::jsTestObjAttributeWithReservedEnumType):
(WebCore::jsTestObjPutForwardsAttribute):
(WebCore::jsTestObjPutForwardsNullableAttribute):
(WebCore::jsTestObjStringifierAttribute):
(WebCore::jsTestObjConstructor):
(WebCore::setJSTestObjConstructor):
(WebCore::setJSTestObjConstructorStaticStringAttr):
(WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
(WebCore::setJSTestObjEnumAttr):
(WebCore::setJSTestObjByteAttr):
(WebCore::setJSTestObjOctetAttr):
(WebCore::setJSTestObjShortAttr):
(WebCore::setJSTestObjClampedShortAttr):
(WebCore::setJSTestObjEnforceRangeShortAttr):
(WebCore::setJSTestObjUnsignedShortAttr):
(WebCore::setJSTestObjLongAttr):
(WebCore::setJSTestObjLongLongAttr):
(WebCore::setJSTestObjUnsignedLongLongAttr):
(WebCore::setJSTestObjStringAttr):
(WebCore::setJSTestObjUsvstringAttr):
(WebCore::setJSTestObjTestObjAttr):
(WebCore::setJSTestObjTestNullableObjAttr):
(WebCore::setJSTestObjLenientTestObjAttr):
(WebCore::setJSTestObjStringAttrTreatingNullAsEmptyString):
(WebCore::setJSTestObjUsvstringAttrTreatingNullAsEmptyString):
(WebCore::setJSTestObjImplementationEnumAttr):
(WebCore::setJSTestObjXMLObjAttr):
(WebCore::setJSTestObjCreate):
(WebCore::setJSTestObjReflectedStringAttr):
(WebCore::setJSTestObjReflectedUSVStringAttr):
(WebCore::setJSTestObjReflectedIntegralAttr):
(WebCore::setJSTestObjReflectedUnsignedIntegralAttr):
(WebCore::setJSTestObjReflectedBooleanAttr):
(WebCore::setJSTestObjReflectedURLAttr):
(WebCore::setJSTestObjReflectedUSVURLAttr):
(WebCore::setJSTestObjReflectedCustomIntegralAttr):
(WebCore::setJSTestObjReflectedCustomBooleanAttr):
(WebCore::setJSTestObjReflectedCustomURLAttr):
(WebCore::setJSTestObjEnabledAtRuntimeAttribute):
(WebCore::setJSTestObjTypedArrayAttr):
(WebCore::setJSTestObjAttrWithGetterException):
(WebCore::setJSTestObjAttrWithGetterExceptionWithMessage):
(WebCore::setJSTestObjAttrWithSetterException):
(WebCore::setJSTestObjAttrWithSetterExceptionWithMessage):
(WebCore::setJSTestObjStringAttrWithGetterException):
(WebCore::setJSTestObjStringAttrWithSetterException):
(WebCore::setJSTestObjCustomAttr):
(WebCore::setJSTestObjOnfoo):
(WebCore::setJSTestObjOnwebkitfoo):
(WebCore::setJSTestObjWithScriptStateAttribute):
(WebCore::setJSTestObjWithCallWithAndSetterCallWithAttribute):
(WebCore::setJSTestObjWithScriptExecutionContextAttribute):
(WebCore::setJSTestObjWithScriptStateAttributeRaises):
(WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
(WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
(WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
(WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
(WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
(WebCore::setJSTestObjConditionalAttr1):
(WebCore::setJSTestObjConditionalAttr2):
(WebCore::setJSTestObjConditionalAttr3):
(WebCore::setJSTestObjConditionalAttr4Constructor):
(WebCore::setJSTestObjConditionalAttr5Constructor):
(WebCore::setJSTestObjConditionalAttr6Constructor):
(WebCore::setJSTestObjAnyAttribute):
(WebCore::setJSTestObjMutablePoint):
(WebCore::setJSTestObjImmutablePoint):
(WebCore::setJSTestObjStrawberry):
(WebCore::setJSTestObjId):
(WebCore::setJSTestObjReplaceableAttribute):
(WebCore::setJSTestObjNullableLongSettableAttribute):
(WebCore::setJSTestObjNullableStringSettableAttribute):
(WebCore::setJSTestObjNullableUSVStringSettableAttribute):
(WebCore::setJSTestObjNullableStringValue):
(WebCore::setJSTestObjAttributeWithReservedEnumType):
(WebCore::setJSTestObjPutForwardsAttribute):
(WebCore::setJSTestObjPutForwardsNullableAttribute):
(WebCore::setJSTestObjStringifierAttribute):
(WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation1):
(WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation2):
(WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation):
(WebCore::jsTestObjPrototypeFunctionVoidMethod):
(WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
(WebCore::jsTestObjPrototypeFunctionByteMethod):
(WebCore::jsTestObjPrototypeFunctionByteMethodWithArgs):
(WebCore::jsTestObjPrototypeFunctionOctetMethod):
(WebCore::jsTestObjPrototypeFunctionOctetMethodWithArgs):
(WebCore::jsTestObjPrototypeFunctionLongMethod):
(WebCore::jsTestObjPrototypeFunctionLongMethodWithArgs):
(WebCore::jsTestObjPrototypeFunctionObjMethod):
(WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
(WebCore::jsTestObjInstanceFunctionUnforgeableMethod):
(WebCore::jsTestObjPrototypeFunctionMethodWithArgTreatingNullAsEmptyString):
(WebCore::jsTestObjPrototypeFunctionMethodWithXPathNSResolverParameter):
(WebCore::jsTestObjPrototypeFunctionNullableStringMethod):
(WebCore::jsTestObjConstructorFunctionNullableStringStaticMethod):
(WebCore::jsTestObjPrototypeFunctionNullableStringSpecialMethod):
(WebCore::jsTestObjPrototypeFunctionMethodWithEnumArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalEnumArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalEnumArgAndDefaultValue):
(WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
(WebCore::jsTestObjPrototypeFunctionMethodWithUSVStringArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNullableUSVStringArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithUSVStringArgTreatingNullAsEmptyString):
(WebCore::jsTestObjPrototypeFunctionSerializedValue):
(WebCore::jsTestObjPrototypeFunctionOptionsObject):
(WebCore::jsTestObjPrototypeFunctionMethodWithException):
(WebCore::jsTestObjPrototypeFunctionMethodWithExceptionWithMessage):
(WebCore::jsTestObjPrototypeFunctionCustomMethod):
(WebCore::jsTestObjPrototypeFunctionCustomMethodWithArgs):
(WebCore::jsTestObjPrototypeFunctionPrivateMethod):
(WebCore::jsTestObjPrototypeFunctionPublicAndPrivateMethod):
(WebCore::jsTestObjPrototypeFunctionAddEventListener):
(WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
(WebCore::jsTestObjPrototypeFunctionWithScriptStateVoid):
(WebCore::jsTestObjPrototypeFunctionWithScriptStateObj):
(WebCore::jsTestObjPrototypeFunctionWithScriptStateVoidException):
(WebCore::jsTestObjPrototypeFunctionWithScriptStateObjException):
(WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContext):
(WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState):
(WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
(WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
(WebCore::jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack):
(WebCore::jsTestObjPrototypeFunctionWithDocumentArgument):
(WebCore::jsTestObjPrototypeFunctionWithCallerDocumentArgument):
(WebCore::jsTestObjPrototypeFunctionWithCallerWindowArgument):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArgAndDefaultValue):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUSVString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringAndDefaultValue):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringAndDefaultValue):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsNull):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringIsNull):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsEmptyString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUSVStringIsEmptyString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringIsEmptyString):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalDoubleIsNaN):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalFloatIsNaN):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalLongLong):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalLongLongIsZero):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUnsignedLongLong):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUnsignedLongLongIsZero):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalSequence):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalSequenceIsEmpty):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBoolean):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBooleanIsFalse):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAny):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalNullableWrapper):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalNullableWrapperIsNull):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalXPathNSResolver):
(WebCore::jsTestObjPrototypeFunctionMethodWithCallbackArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithCallbackFunctionArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackFunctionArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithCallbackFunctionAndOptionalArg):
(WebCore::jsTestObjConstructorFunctionStaticMethodWithCallbackAndOptionalArg):
(WebCore::jsTestObjConstructorFunctionStaticMethodWithCallbackArg):
(WebCore::jsTestObjPrototypeFunctionConditionalMethod1):
(WebCore::jsTestObjPrototypeFunctionConditionalMethod2):
(WebCore::jsTestObjPrototypeFunctionConditionalMethod3):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod1):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod3):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod4):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod5):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod6):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod11):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod12):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter1):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter):
(WebCore::jsTestObjConstructorFunctionClassMethod):
(WebCore::jsTestObjConstructorFunctionClassMethodWithOptional):
(WebCore::jsTestObjConstructorFunctionClassMethod2):
(WebCore::jsTestObjConstructorFunctionOverloadedMethod11):
(WebCore::jsTestObjConstructorFunctionOverloadedMethod12):
(WebCore::jsTestObjConstructorFunctionOverloadedMethod1):
(WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
(WebCore::jsTestObjPrototypeFunctionClassMethodWithEnforceRange):
(WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongSequence):
(WebCore::jsTestObjPrototypeFunctionStringArrayFunction):
(WebCore::jsTestObjPrototypeFunctionDomStringListFunction):
(WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence):
(WebCore::jsTestObjPrototypeFunctionGetElementById):
(WebCore::jsTestObjPrototypeFunctionGetSVGDocument):
(WebCore::jsTestObjPrototypeFunctionConvert1):
(WebCore::jsTestObjPrototypeFunctionConvert2):
(WebCore::jsTestObjPrototypeFunctionConvert3):
(WebCore::jsTestObjPrototypeFunctionConvert4):
(WebCore::jsTestObjPrototypeFunctionMutablePointFunction):
(WebCore::jsTestObjPrototypeFunctionImmutablePointFunction):
(WebCore::jsTestObjPrototypeFunctionOrange):
(WebCore::jsTestObjPrototypeFunctionVariadicStringMethod):
(WebCore::jsTestObjPrototypeFunctionVariadicDoubleMethod):
(WebCore::jsTestObjPrototypeFunctionVariadicNodeMethod):
(WebCore::jsTestObjPrototypeFunctionAny):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionPromise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithFloatArgumentPromise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithExceptionPromise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithOptionalIntArgumentPromise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1Promise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction):
(WebCore::jsTestObjConstructorFunctionTestStaticPromiseFunctionPromise):
(WebCore::jsTestObjConstructorFunctionTestStaticPromiseFunctionWithExceptionPromise):
(WebCore::jsTestObjPrototypeFunctionMethodWithNeedsCustomElementReactionStack):
(WebCore::jsTestObjPrototypeFunctionConditionalOverload1):
(WebCore::jsTestObjPrototypeFunctionConditionalOverload2):
(WebCore::jsTestObjPrototypeFunctionConditionalOverload):
(WebCore::jsTestObjPrototypeFunctionSingleConditionalOverload1):
(WebCore::jsTestObjPrototypeFunctionSingleConditionalOverload2):
(WebCore::jsTestObjPrototypeFunctionSingleConditionalOverload):
(WebCore::jsTestObjPrototypeFunctionAttachShadowRoot):
(WebCore::jsTestObjPrototypeFunctionToString):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
(WebCore::constructJSTestOverloadedConstructors1):
(WebCore::constructJSTestOverloadedConstructors2):
(WebCore::constructJSTestOverloadedConstructors3):
(WebCore::constructJSTestOverloadedConstructors4):
(WebCore::constructJSTestOverloadedConstructors5):
(WebCore::JSTestOverloadedConstructorsConstructor::construct):
(WebCore::jsTestOverloadedConstructorsConstructor):
(WebCore::setJSTestOverloadedConstructorsConstructor):
* bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:
(WebCore::constructJSTestOverloadedConstructorsWithSequence1):
(WebCore::constructJSTestOverloadedConstructorsWithSequence2):
(WebCore::JSTestOverloadedConstructorsWithSequenceConstructor::construct):
(WebCore::jsTestOverloadedConstructorsWithSequenceConstructor):
(WebCore::setJSTestOverloadedConstructorsWithSequenceConstructor):
* bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
(WebCore::jsTestOverrideBuiltinsConstructor):
(WebCore::setJSTestOverrideBuiltinsConstructor):
(WebCore::jsTestOverrideBuiltinsPrototypeFunctionNamedItem):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::jsTestSerializedScriptValueInterfaceValue):
(WebCore::jsTestSerializedScriptValueInterfaceReadonlyValue):
(WebCore::jsTestSerializedScriptValueInterfaceCachedValue):
(WebCore::jsTestSerializedScriptValueInterfacePorts):
(WebCore::jsTestSerializedScriptValueInterfaceCachedReadonlyValue):
(WebCore::jsTestSerializedScriptValueInterfaceConstructor):
(WebCore::setJSTestSerializedScriptValueInterfaceConstructor):
(WebCore::setJSTestSerializedScriptValueInterfaceValue):
(WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::JSTestTypedefsConstructor::construct):
(WebCore::jsTestTypedefsUnsignedLongLongAttr):
(WebCore::jsTestTypedefsImmutableSerializedScriptValue):
(WebCore::jsTestTypedefsConstructorTestSubObj):
(WebCore::jsTestTypedefsAttrWithGetterException):
(WebCore::jsTestTypedefsAttrWithSetterException):
(WebCore::jsTestTypedefsStringAttrWithGetterException):
(WebCore::jsTestTypedefsStringAttrWithSetterException):
(WebCore::jsTestTypedefsConstructor):
(WebCore::setJSTestTypedefsConstructor):
(WebCore::setJSTestTypedefsUnsignedLongLongAttr):
(WebCore::setJSTestTypedefsImmutableSerializedScriptValue):
(WebCore::setJSTestTypedefsAttrWithGetterException):
(WebCore::setJSTestTypedefsAttrWithSetterException):
(WebCore::setJSTestTypedefsStringAttrWithGetterException):
(WebCore::setJSTestTypedefsStringAttrWithSetterException):
(WebCore::jsTestTypedefsPrototypeFunctionFunc):
(WebCore::jsTestTypedefsPrototypeFunctionSetShadow):
(WebCore::jsTestTypedefsPrototypeFunctionMethodWithSequenceArg):
(WebCore::jsTestTypedefsPrototypeFunctionNullableSequenceArg):
(WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):
(WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction):
(WebCore::jsTestTypedefsPrototypeFunctionStringSequenceFunction):
(WebCore::jsTestTypedefsPrototypeFunctionStringSequenceFunction2):
(WebCore::jsTestTypedefsPrototypeFunctionCallWithSequenceThatRequiresInclude):
(WebCore::jsTestTypedefsPrototypeFunctionMethodWithException):
* bindings/scripts/test/JS/JSattribute.cpp:
(WebCore::jsattributeReadonly):
(WebCore::jsattributeConstructor):
(WebCore::setJSattributeConstructor):
* bindings/scripts/test/JS/JSreadonly.cpp:
(WebCore::jsreadonlyConstructor):
(WebCore::setJSreadonlyConstructor):
* bridge/c/c_instance.cpp:
(JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
(JSC::Bindings::CInstance::invokeMethod):
(JSC::Bindings::CInstance::invokeDefaultMethod):
(JSC::Bindings::CInstance::invokeConstruct):
(JSC::Bindings::CInstance::toJSPrimitive):
* bridge/objc/objc_instance.mm:
(ObjcInstance::moveGlobalExceptionToExecState):
(ObjcInstance::invokeMethod):
* bridge/objc/objc_runtime.mm:
(JSC::Bindings::ObjcField::valueFromInstance):
(JSC::Bindings::ObjcField::setValueToInstance):
(JSC::Bindings::ObjcArray::setValueAt):
(JSC::Bindings::ObjcArray::valueAt):
(JSC::Bindings::callObjCFallbackObject):
* bridge/objc/objc_utility.h:
* bridge/objc/objc_utility.mm:
(JSC::Bindings::throwError):
* bridge/runtime_array.cpp:
(JSC::RuntimeArray::lengthGetter):
(JSC::RuntimeArray::put):
(JSC::RuntimeArray::putByIndex):
* bridge/runtime_method.cpp:
(JSC::RuntimeMethod::lengthGetter):
(JSC::callRuntimeMethod):
* bridge/runtime_object.cpp:
(JSC::Bindings::RuntimeObject::fallbackObjectGetter):
(JSC::Bindings::RuntimeObject::fieldGetter):
(JSC::Bindings::RuntimeObject::methodGetter):
(JSC::Bindings::RuntimeObject::getOwnPropertySlot):
(JSC::Bindings::RuntimeObject::put):
(JSC::Bindings::RuntimeObject::defaultValue):
(JSC::Bindings::RuntimeObject::getOwnPropertyNames):
(JSC::Bindings::RuntimeObject::throwInvalidAccessError):
* bridge/runtime_object.h:

Source/WebKit/mac:

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::moveGlobalExceptionToExecState):
* Plugins/Hosted/ProxyInstance.mm:
(WebKit::ProxyInstance::invokeMethod):

Source/WebKit2:

* WebProcess/Plugins/Netscape/JSNPMethod.cpp:
(WebKit::callMethod):
* WebProcess/Plugins/Netscape/JSNPObject.cpp:
(WebKit::JSNPObject::callMethod):
(WebKit::JSNPObject::callObject):
(WebKit::JSNPObject::callConstructor):
(WebKit::JSNPObject::getOwnPropertySlot):
(WebKit::JSNPObject::put):
(WebKit::JSNPObject::deleteProperty):
(WebKit::JSNPObject::getOwnPropertyNames):
(WebKit::JSNPObject::propertyGetter):
(WebKit::JSNPObject::methodGetter):
(WebKit::JSNPObject::throwInvalidAccessError):
* WebProcess/Plugins/Netscape/JSNPObject.h:
* WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
(WebKit::NPRuntimeObjectMap::moveGlobalExceptionToExecState):

Source/WTF:

* wtf/Platform.h:
- Introduced the ENABLE(THROW_SCOPE_VERIFICATION) flag.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreAPIAPICallbackFunctionh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/APICallbackFunction.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreAPIJSCallbackObjectFunctionsh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreAPIJSTypedArraycpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/JSTypedArray.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreCMakeListstxt">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreChangeLog">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoredfgDFGOperationscpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreinspectorJSInjectedScriptHostcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreinspectorJSInjectedScriptHostPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreinspectorJSJavaScriptCallFramecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreinspectorJSJavaScriptCallFramePrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreinterpreterCachedCallh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/interpreter/CachedCall.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreinterpreterInterpretercpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/interpreter/Interpreter.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCorejitJITOperationscpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/jit/JITOperations.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCorejsccpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCorellintLLIntSlowPathscpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeArrayConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeArrayConstructorh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayConstructor.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeArrayPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeBooleanPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/BooleanPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeCommonSlowPathscpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeCommonSlowPathsh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPaths.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeCommonSlowPathsExceptionscpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeConstructDatacpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ConstructData.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeDatePrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/DatePrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeErrorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Error.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeErrorh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Error.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeErrorPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ErrorPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeExceptionFuzzcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionFuzz.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeExceptionHelperscpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeExceptionHelpersh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionHelpers.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeExecutablecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Executable.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeFunctionConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/FunctionConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeFunctionPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/FunctionPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeGetterSettercpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/GetterSetter.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlCollatorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlCollator.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlCollatorPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlDateTimeFormatcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlNumberFormatcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlNumberFormatPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlObjectcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIteratorOperationscpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IteratorOperations.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSArraycpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArray.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSArrayBufferConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSArrayBufferPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSCInlinesh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCInlines.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSCJSValuecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCJSValue.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSCJSValueInlinesh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCJSValueInlines.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSDataViewcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSDataView.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSDataViewPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSFunctioncpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSFunction.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGenericTypedArrayViewh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorInlinesh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGlobalObjectcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSModuleEnvironmentcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSModuleNamespaceObjectcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSModuleRecordcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleRecord.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSONObjectcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSONObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSObjectcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSObjecth">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSObjectInlinesh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObjectInlines.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSPromiseConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSPropertyNameIteratorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSStringcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSString.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSStringBuilderh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringBuilder.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSStringJoinercpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringJoiner.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSStringJoinerh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringJoiner.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSSymbolTableObjecth">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSSymbolTableObject.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSTypedArrayViewConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSTypedArrayViewPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeMapConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeMapDataInlinesh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapDataInlines.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeMapIteratorPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeMapPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeModuleLoaderPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeNullSetterFunctioncpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/NullSetterFunction.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeNumberPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/NumberPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeObjectConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ObjectConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeObjectPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ObjectPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeOperationsh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Operations.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeProxyConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ProxyConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeProxyObjectcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ProxyObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeReflectObjectcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ReflectObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRegExpConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRegExpObjectcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRegExpObjecth">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpObject.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRegExpPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRejecth">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Reject.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSetConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSetIteratorPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSetPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSparseArrayValueMapcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeStringConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeStringObjectcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeStringPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeStringRecursionCheckercpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSymbolcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Symbol.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSymbolConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SymbolConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSymbolPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SymbolPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeVMh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/VM.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeVMEntryScopeh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/VMEntryScope.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeWeakMapConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeWeakMapPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeWeakSetConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeWeakSetPrototypecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWTFChangeLog">releases/WebKitGTK/webkit-2.14/Source/WTF/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWTFwtfPlatformh">releases/WebKitGTK/webkit-2.14/Source/WTF/wtf/Platform.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCoreChangeLog">releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSApplePaySessionCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSApplePaySessionCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSBlobCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSBlobCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCSSStyleDeclarationCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCryptoAlgorithmDictionarycpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCryptoCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCryptoKeySerializationJWKcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoKeySerializationJWK.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCryptoOperationDatacpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoOperationData.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCustomElementInterfacecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCustomElementInterface.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCustomElementRegistryCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCustomElementRegistryCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMBindingcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMBinding.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMBindingh">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMBinding.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMConstructorh">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMConstructor.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMConverth">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMConvert.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMIteratorh">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMIterator.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMWindowCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDataCueCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDataCueCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDictionarycpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDictionary.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDocumentCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDocumentCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSFileCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSFileCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLAllCollectionCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLCanvasElementCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLDocumentCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLElementCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLElementCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLFormControlsCollectionCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLFormControlsCollectionCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLInputElementCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLInputElementCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHistoryCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHistoryCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSIDBDatabaseCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSIDBDatabaseCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSImageConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSImageConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSLocationCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSLocationCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMediaDevicesCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMediaDevicesCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMediaStreamTrackCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMediaStreamTrackCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMessagePortCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMessagePortCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMessagePortCustomh">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMessagePortCustom.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMockContentFilterSettingsCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMockContentFilterSettingsCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSModuleLoadercpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSModuleLoader.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMutationObserverCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMutationObserverCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSNodeCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSNodeCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSNodeFilterCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSPluginElementFunctionscpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSReadableStreamPrivateConstructorscpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSReadableStreamPrivateConstructors.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSSVGLengthCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSSVGLengthCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSWebGL2RenderingContextCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebGL2RenderingContextCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSWebGLRenderingContextBaseCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebGLRenderingContextBaseCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSWebKitSubtleCryptoCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebKitSubtleCryptoCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSWorkerCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWorkerCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSWorkerGlobalScopeCustomcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWorkerGlobalScopeCustom.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsReadableStreamDefaultControllercpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/ReadableStreamDefaultController.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsSerializedScriptValuecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/SerializedScriptValue.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsjsWorkerScriptControllercpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/WorkerScriptController.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptsCodeGeneratorJSpm">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSInterfaceNamecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestCustomConstructorWithNoInterfaceObjectcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestEventTargetcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestExceptioncpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestGlobalObjectcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestInterfacecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestIterablecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestJSBuiltinConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenercpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestNamedConstructorcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestNodecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestNondeterministiccpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestObjcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsWithSequencecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinscpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestTypedefscpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSattributecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSreadonlycpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebridgecc_instancecpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/c/c_instance.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebridgeobjcobjc_instancemm">releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_instance.mm</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebridgeobjcobjc_runtimemm">releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_runtime.mm</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebridgeobjcobjc_utilityh">releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_utility.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebridgeobjcobjc_utilitymm">releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_utility.mm</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebridgeruntime_arraycpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_array.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebridgeruntime_methodcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_method.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebridgeruntime_objectcpp">releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_object.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebCorebridgeruntime_objecth">releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_object.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebKitmacChangeLog">releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebKitmacPluginsHostedNetscapePluginInstanceProxymm">releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebKitmacPluginsHostedProxyInstancemm">releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebKit2ChangeLog">releases/WebKitGTK/webkit-2.14/Source/WebKit2/ChangeLog</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebKit2WebProcessPluginsNetscapeJSNPMethodcpp">releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebKit2WebProcessPluginsNetscapeJSNPObjectcpp">releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebKit2WebProcessPluginsNetscapeJSNPObjecth">releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceWebKit2WebProcessPluginsNetscapeNPRuntimeObjectMapcpp">releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeThrowScopecpp">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScope.cpp</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeThrowScopeh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScope.h</a></li>
<li><a href="#releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeThrowScopeLocationh">releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScopeLocation.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreAPIAPICallbackFunctionh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/APICallbackFunction.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/APICallbackFunction.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/APICallbackFunction.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -44,6 +44,8 @@
</span><span class="cx"> template &lt;typename T&gt;
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL APICallbackFunction::call(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSContextRef execRef = toRef(exec);
</span><span class="cx">     JSObjectRef functionRef = toRef(exec-&gt;callee());
</span><span class="cx">     JSObjectRef thisObjRef = toRef(jsCast&lt;JSObject*&gt;(exec-&gt;thisValue().toThis(exec, NotStrictMode)));
</span><span class="lines">@@ -61,7 +63,7 @@
</span><span class="cx">         result = jsCast&lt;T*&gt;(toJS(functionRef))-&gt;functionCallback()(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &amp;exception);
</span><span class="cx">     }
</span><span class="cx">     if (exception)
</span><del>-        exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+        throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx"> 
</span><span class="cx">     // result must be a valid JSValue.
</span><span class="cx">     if (!result)
</span><span class="lines">@@ -73,6 +75,8 @@
</span><span class="cx"> template &lt;typename T&gt;
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL APICallbackFunction::construct(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSObject* constructor = exec-&gt;callee();
</span><span class="cx">     JSContextRef ctx = toRef(exec);
</span><span class="cx">     JSObjectRef constructorRef = toRef(constructor);
</span><span class="lines">@@ -92,12 +96,12 @@
</span><span class="cx">             result = callback(ctx, constructorRef, argumentCount, arguments.data(), &amp;exception);
</span><span class="cx">         }
</span><span class="cx">         if (exception) {
</span><del>-            exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+            throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">             return JSValue::encode(toJS(exec, exception));
</span><span class="cx">         }
</span><span class="cx">         // result must be a valid JSValue.
</span><span class="cx">         if (!result)
</span><del>-            return throwVMTypeError(exec);
</del><ins>+            return throwVMTypeError(exec, scope);
</ins><span class="cx">         return JSValue::encode(toJS(result));
</span><span class="cx">     }
</span><span class="cx">     
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreAPIJSCallbackObjectFunctionsh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2006, 2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  * Copyright (C) 2007 Eric Seidel &lt;eric@webkit.org&gt;
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -133,6 +133,9 @@
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> bool JSCallbackObject&lt;Parent&gt;::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSCallbackObject* thisObject = jsCast&lt;JSCallbackObject*&gt;(object);
</span><span class="cx">     JSContextRef ctx = toRef(exec);
</span><span class="cx">     JSObjectRef thisRef = toRef(thisObject);
</span><span class="lines">@@ -159,7 +162,7 @@
</span><span class="cx">                     value = getProperty(ctx, thisRef, propertyNameRef.get(), &amp;exception);
</span><span class="cx">                 }
</span><span class="cx">                 if (exception) {
</span><del>-                    exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                    throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">                     slot.setValue(thisObject, ReadOnly | DontEnum, jsUndefined());
</span><span class="cx">                     return true;
</span><span class="cx">                 }
</span><span class="lines">@@ -200,6 +203,9 @@
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> JSValue JSCallbackObject&lt;Parent&gt;::defaultValue(const JSObject* object, ExecState* exec, PreferredPrimitiveType hint)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     const JSCallbackObject* thisObject = jsCast&lt;const JSCallbackObject*&gt;(object);
</span><span class="cx">     JSContextRef ctx = toRef(exec);
</span><span class="cx">     JSObjectRef thisRef = toRef(thisObject);
</span><span class="lines">@@ -210,7 +216,7 @@
</span><span class="cx">             JSValueRef exception = 0;
</span><span class="cx">             JSValueRef result = convertToType(ctx, thisRef, jsHint, &amp;exception);
</span><span class="cx">             if (exception) {
</span><del>-                exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">                 return jsUndefined();
</span><span class="cx">             }
</span><span class="cx">             if (result)
</span><span class="lines">@@ -224,6 +230,9 @@
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> bool JSCallbackObject&lt;Parent&gt;::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSCallbackObject* thisObject = jsCast&lt;JSCallbackObject*&gt;(cell);
</span><span class="cx">     JSContextRef ctx = toRef(exec);
</span><span class="cx">     JSObjectRef thisRef = toRef(thisObject);
</span><span class="lines">@@ -242,7 +251,7 @@
</span><span class="cx">                     result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &amp;exception);
</span><span class="cx">                 }
</span><span class="cx">                 if (exception)
</span><del>-                    exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                    throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">                 if (result || exception)
</span><span class="cx">                     return result;
</span><span class="cx">             }
</span><span class="lines">@@ -259,7 +268,7 @@
</span><span class="cx">                             result = setProperty(ctx, thisRef, entry-&gt;propertyNameRef.get(), valueRef, &amp;exception);
</span><span class="cx">                         }
</span><span class="cx">                         if (exception)
</span><del>-                            exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                            throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">                         if (result || exception)
</span><span class="cx">                             return result;
</span><span class="cx">                     }
</span><span class="lines">@@ -273,7 +282,7 @@
</span><span class="cx">                         return Parent::put(thisObject, exec, propertyName, value, slot);
</span><span class="cx">                     if (entry-&gt;attributes &amp; kJSPropertyAttributeReadOnly)
</span><span class="cx">                         return false;
</span><del>-                    return thisObject-&gt;JSCallbackObject&lt;Parent&gt;::putDirect(exec-&gt;vm(), propertyName, value); // put as override property
</del><ins>+                    return thisObject-&gt;JSCallbackObject&lt;Parent&gt;::putDirect(vm, propertyName, value); // put as override property
</ins><span class="cx">                 }
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="lines">@@ -285,6 +294,9 @@
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> bool JSCallbackObject&lt;Parent&gt;::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyIndex, JSValue value, bool shouldThrow)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSCallbackObject* thisObject = jsCast&lt;JSCallbackObject*&gt;(cell);
</span><span class="cx">     JSContextRef ctx = toRef(exec);
</span><span class="cx">     JSObjectRef thisRef = toRef(thisObject);
</span><span class="lines">@@ -303,7 +315,7 @@
</span><span class="cx">                 result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &amp;exception);
</span><span class="cx">             }
</span><span class="cx">             if (exception)
</span><del>-                exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">             if (result || exception)
</span><span class="cx">                 return result;
</span><span class="cx">         }
</span><span class="lines">@@ -320,7 +332,7 @@
</span><span class="cx">                         result = setProperty(ctx, thisRef, entry-&gt;propertyNameRef.get(), valueRef, &amp;exception);
</span><span class="cx">                     }
</span><span class="cx">                     if (exception)
</span><del>-                        exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                        throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">                     if (result || exception)
</span><span class="cx">                         return result;
</span><span class="cx">                 }
</span><span class="lines">@@ -342,6 +354,9 @@
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> bool JSCallbackObject&lt;Parent&gt;::deleteProperty(JSCell* cell, ExecState* exec, PropertyName propertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSCallbackObject* thisObject = jsCast&lt;JSCallbackObject*&gt;(cell);
</span><span class="cx">     JSContextRef ctx = toRef(exec);
</span><span class="cx">     JSObjectRef thisRef = toRef(thisObject);
</span><span class="lines">@@ -359,7 +374,7 @@
</span><span class="cx">                     result = deleteProperty(ctx, thisRef, propertyNameRef.get(), &amp;exception);
</span><span class="cx">                 }
</span><span class="cx">                 if (exception)
</span><del>-                    exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                    throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">                 if (result || exception)
</span><span class="cx">                     return true;
</span><span class="cx">             }
</span><span class="lines">@@ -408,6 +423,9 @@
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> EncodedJSValue JSCallbackObject&lt;Parent&gt;::construct(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSObject* constructor = exec-&gt;callee();
</span><span class="cx">     JSContextRef execRef = toRef(exec);
</span><span class="cx">     JSObjectRef constructorRef = toRef(constructor);
</span><span class="lines">@@ -426,7 +444,7 @@
</span><span class="cx">                 result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), &amp;exception));
</span><span class="cx">             }
</span><span class="cx">             if (exception)
</span><del>-                exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">             return JSValue::encode(result);
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -438,6 +456,9 @@
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> bool JSCallbackObject&lt;Parent&gt;::customHasInstance(JSObject* object, ExecState* exec, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSCallbackObject* thisObject = jsCast&lt;JSCallbackObject*&gt;(object);
</span><span class="cx">     JSContextRef execRef = toRef(exec);
</span><span class="cx">     JSObjectRef thisRef = toRef(thisObject);
</span><span class="lines">@@ -452,7 +473,7 @@
</span><span class="cx">                 result = hasInstance(execRef, thisRef, valueRef, &amp;exception);
</span><span class="cx">             }
</span><span class="cx">             if (exception)
</span><del>-                exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">             return result;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -475,6 +496,9 @@
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> EncodedJSValue JSCallbackObject&lt;Parent&gt;::call(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSContextRef execRef = toRef(exec);
</span><span class="cx">     JSObjectRef functionRef = toRef(exec-&gt;callee());
</span><span class="cx">     JSObjectRef thisObjRef = toRef(jsCast&lt;JSObject*&gt;(exec-&gt;thisValue().toThis(exec, NotStrictMode)));
</span><span class="lines">@@ -493,7 +517,7 @@
</span><span class="cx">                 result = toJS(exec, callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &amp;exception));
</span><span class="cx">             }
</span><span class="cx">             if (exception)
</span><del>-                exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">             return JSValue::encode(result);
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -570,6 +594,9 @@
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> JSValue JSCallbackObject&lt;Parent&gt;::getStaticValue(ExecState* exec, PropertyName propertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSObjectRef thisRef = toRef(this);
</span><span class="cx">     
</span><span class="cx">     if (StringImpl* name = propertyName.uid()) {
</span><span class="lines">@@ -584,7 +611,7 @@
</span><span class="cx">                             value = getProperty(toRef(exec), thisRef, entry-&gt;propertyNameRef.get(), &amp;exception);
</span><span class="cx">                         }
</span><span class="cx">                         if (exception) {
</span><del>-                            exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                            throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">                             return jsUndefined();
</span><span class="cx">                         }
</span><span class="cx">                         if (value)
</span><span class="lines">@@ -601,6 +628,9 @@
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> EncodedJSValue JSCallbackObject&lt;Parent&gt;::staticFunctionGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSCallbackObject* thisObj = asCallbackObject(thisValue);
</span><span class="cx">     
</span><span class="cx">     // Check for cached or override property.
</span><span class="lines">@@ -613,7 +643,6 @@
</span><span class="cx">             if (OpaqueJSClassStaticFunctionsTable* staticFunctions = jsClass-&gt;staticFunctions(exec)) {
</span><span class="cx">                 if (StaticFunctionEntry* entry = staticFunctions-&gt;get(name)) {
</span><span class="cx">                     if (JSObjectCallAsFunctionCallback callAsFunction = entry-&gt;callAsFunction) {
</span><del>-                        VM&amp; vm = exec-&gt;vm();
</del><span class="cx">                         JSObject* o = JSCallbackFunction::create(vm, thisObj-&gt;globalObject(), callAsFunction, name);
</span><span class="cx">                         thisObj-&gt;putDirect(vm, propertyName, o, entry-&gt;attributes);
</span><span class="cx">                         return JSValue::encode(o);
</span><span class="lines">@@ -623,12 +652,15 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return JSValue::encode(exec-&gt;vm().throwException(exec, createReferenceError(exec, ASCIILiteral(&quot;Static function property defined with NULL callAsFunction callback.&quot;))));
</del><ins>+    return JSValue::encode(throwException(exec, scope, createReferenceError(exec, ASCIILiteral(&quot;Static function property defined with NULL callAsFunction callback.&quot;))));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template &lt;class Parent&gt;
</span><span class="cx"> EncodedJSValue JSCallbackObject&lt;Parent&gt;::callbackGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSCallbackObject* thisObj = asCallbackObject(thisValue);
</span><span class="cx">     
</span><span class="cx">     JSObjectRef thisRef = toRef(thisObj);
</span><span class="lines">@@ -646,7 +678,7 @@
</span><span class="cx">                     value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &amp;exception);
</span><span class="cx">                 }
</span><span class="cx">                 if (exception) {
</span><del>-                    exec-&gt;vm().throwException(exec, toJS(exec, exception));
</del><ins>+                    throwException(exec, scope, toJS(exec, exception));
</ins><span class="cx">                     return JSValue::encode(jsUndefined());
</span><span class="cx">                 }
</span><span class="cx">                 if (value)
</span><span class="lines">@@ -655,7 +687,7 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return JSValue::encode(exec-&gt;vm().throwException(exec, createReferenceError(exec, ASCIILiteral(&quot;hasProperty callback returned true for a property that doesn't exist.&quot;))));
</del><ins>+    return JSValue::encode(throwException(exec, scope, createReferenceError(exec, ASCIILiteral(&quot;hasProperty callback returned true for a property that doesn't exist.&quot;))));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreAPIJSTypedArraycpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/JSTypedArray.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/JSTypedArray.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/API/JSTypedArray.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -100,9 +100,11 @@
</span><span class="cx"> 
</span><span class="cx"> static JSObject* createTypedArray(ExecState* exec, JSTypedArrayType type, RefPtr&lt;ArrayBuffer&gt;&amp;&amp; buffer, size_t offset, size_t length)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSGlobalObject* globalObject = exec-&gt;lexicalGlobalObject();
</span><span class="cx">     if (!buffer) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     switch (type) {
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/CMakeLists.txt (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/CMakeLists.txt        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/CMakeLists.txt        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -814,6 +814,7 @@
</span><span class="cx">     runtime/SymbolObject.cpp
</span><span class="cx">     runtime/SymbolPrototype.cpp
</span><span class="cx">     runtime/SymbolTable.cpp
</span><ins>+    runtime/ThrowScope.cpp
</ins><span class="cx">     runtime/TemplateRegistry.cpp
</span><span class="cx">     runtime/TestRunnerUtils.cpp
</span><span class="cx">     runtime/TypeLocationCache.cpp
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/ChangeLog (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/ChangeLog        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/ChangeLog        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,3 +1,558 @@
</span><ins>+2016-08-30  Mark Lam  &lt;mark.lam@apple.com&gt;
+
+        Introduce the ThrowScope and force every throw site to instantiate a ThrowScope.
+        https://bugs.webkit.org/show_bug.cgi?id=161171
+
+        Reviewed by Filip Pizlo and Geoffrey Garen.
+
+        This is the first step towards having a mechanism (using the ThrowScope) to
+        verify that we're properly checking for exceptions in all the needed places.
+        See comments at the top of ThrowScope.cpp for details on how the ThrowScope works.
+
+        This patch only introduces the ThrowScope, and changes all throw sites to throw
+        using a ThrowScope instance.  VM::throwException() functions are now private, and
+        cannot be accessed directly.  All throws must now go through a ThrowScope.
+
+        Verification is disabled for the moment until we can fix all the verification
+        failures that will show up.
+
+        I also did a smoke test of the ThrowScope mechanisms by running verification on
+        the JSTests/stress/op-add-exceptions.js test with a local build with verification
+        turned on.
+
+        Performance is neutral on aggregate with this patch.
+
+        Misc other changes:
+        - deleted the unused CALL_THROW() macro from LLIntSlowPaths.cpp.
+        - moved createListFromArrayLike() from JSObject.h to JSObjectInlines.h.
+
+        * API/APICallbackFunction.h:
+        (JSC::APICallbackFunction::call):
+        (JSC::APICallbackFunction::construct):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject&lt;Parent&gt;::getOwnPropertySlot):
+        (JSC::JSCallbackObject&lt;Parent&gt;::defaultValue):
+        (JSC::JSCallbackObject&lt;Parent&gt;::put):
+        (JSC::JSCallbackObject&lt;Parent&gt;::putByIndex):
+        (JSC::JSCallbackObject&lt;Parent&gt;::deleteProperty):
+        (JSC::JSCallbackObject&lt;Parent&gt;::construct):
+        (JSC::JSCallbackObject&lt;Parent&gt;::customHasInstance):
+        (JSC::JSCallbackObject&lt;Parent&gt;::call):
+        (JSC::JSCallbackObject&lt;Parent&gt;::getStaticValue):
+        (JSC::JSCallbackObject&lt;Parent&gt;::staticFunctionGetter):
+        (JSC::JSCallbackObject&lt;Parent&gt;::callbackGetter):
+        * API/JSTypedArray.cpp:
+        (createTypedArray):
+        * CMakeLists.txt:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * dfg/DFGOperations.cpp:
+        (JSC::DFG::newTypedArrayWithSize):
+        * inspector/JSInjectedScriptHost.cpp:
+        (Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::jsInjectedScriptHostPrototypeAttributeEvaluate):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionInternalConstructorName):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapSize):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakMapEntries):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetSize):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionWeakSetEntries):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionIteratorEntries):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionSubtype):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionFunctionDetails):
+        (Inspector::jsInjectedScriptHostPrototypeFunctionGetInternalProperties):
+        * inspector/JSJavaScriptCallFrame.cpp:
+        (Inspector::JSJavaScriptCallFrame::evaluateWithScopeExtension):
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension):
+        (Inspector::jsJavaScriptCallFramePrototypeFunctionScopeDescriptions):
+        (Inspector::jsJavaScriptCallFrameAttributeCaller):
+        (Inspector::jsJavaScriptCallFrameAttributeSourceID):
+        (Inspector::jsJavaScriptCallFrameAttributeLine):
+        (Inspector::jsJavaScriptCallFrameAttributeColumn):
+        (Inspector::jsJavaScriptCallFrameAttributeFunctionName):
+        (Inspector::jsJavaScriptCallFrameAttributeScopeChain):
+        (Inspector::jsJavaScriptCallFrameAttributeThisObject):
+        (Inspector::jsJavaScriptCallFrameAttributeType):
+        (Inspector::jsJavaScriptCallFrameIsTailDeleted):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::eval):
+        (JSC::sizeOfVarargs):
+        (JSC::sizeFrameForForwardArguments):
+        (JSC::sizeFrameForVarargs):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::executeCall):
+        (JSC::Interpreter::executeConstruct):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JITOperations.cpp:
+        * jsc.cpp:
+        (WTF::CustomGetter::customGetter):
+        (WTF::RuntimeArray::lengthGetter):
+        (functionCreateElement):
+        (functionRun):
+        (functionRunString):
+        (functionLoad):
+        (functionLoadString):
+        (functionReadFile):
+        (functionCheckSyntax):
+        (functionTransferArrayBuffer):
+        (functionLoadModule):
+        (functionCheckModuleSyntax):
+        (functionSamplingProfilerStackTraces):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        (JSC::LLInt::getByVal):
+        (JSC::LLInt::handleHostCall):
+        (JSC::LLInt::setUpCall):
+        (JSC::LLInt::llint_throw_stack_overflow_error):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayConstructor.h:
+        (JSC::isArray):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::shift):
+        (JSC::unshift):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::concatAppendOne):
+        (JSC::arrayProtoPrivateFuncConcatMemcpy):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CommonSlowPaths.cpp:
+        * runtime/CommonSlowPaths.h:
+        (JSC::CommonSlowPaths::opIn):
+        * runtime/CommonSlowPathsExceptions.cpp:
+        (JSC::CommonSlowPaths::interpreterThrowInCaller):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/DatePrototype.cpp:
+        (JSC::formateDateInstance):
+        (JSC::dateProtoFuncToISOString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncToPrimitiveSymbol):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        (JSC::dateProtoFuncToJSON):
+        * runtime/Error.cpp:
+        (JSC::throwConstructorCannotBeCalledAsFunctionTypeError):
+        (JSC::throwTypeError):
+        (JSC::throwSyntaxError):
+        * runtime/Error.h:
+        (JSC::throwRangeError):
+        (JSC::throwVMError):
+        (JSC::throwVMTypeError):
+        (JSC::throwVMRangeError):
+        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionFuzz.cpp:
+        (JSC::doExceptionFuzzing):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::throwOutOfMemoryError):
+        (JSC::throwStackOverflowError):
+        (JSC::throwTerminatedExecutionException):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Executable.cpp:
+        (JSC::ScriptExecutable::newCodeBlockFor):
+        (JSC::EvalExecutable::create):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        (JSC::constructFunctionSkippingEvalEnabledCheck):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncBind):
+        * runtime/GetterSetter.cpp:
+        (JSC::callSetter):
+        * runtime/IntlCollator.cpp:
+        (JSC::IntlCollator::compareStrings):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototypeGetterCompare):
+        (JSC::IntlCollatorPrototypeFuncResolvedOptions):
+        * runtime/IntlDateTimeFormat.cpp:
+        (JSC::IntlDateTimeFormat::initializeDateTimeFormat):
+        (JSC::IntlDateTimeFormat::format):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        (JSC::IntlDateTimeFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlNumberFormat.cpp:
+        (JSC::IntlNumberFormat::initializeNumberFormat):
+        (JSC::IntlNumberFormat::formatNumber):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        (JSC::IntlNumberFormatPrototypeFuncResolvedOptions):
+        * runtime/IntlObject.cpp:
+        (JSC::intlStringOption):
+        (JSC::intlNumberOption):
+        (JSC::canonicalizeLocaleList):
+        (JSC::lookupSupportedLocales):
+        * runtime/IteratorOperations.cpp:
+        (JSC::iteratorNext):
+        (JSC::iteratorClose):
+        (JSC::createIteratorResultObject):
+        (JSC::iteratorForIterable):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::defineOwnProperty):
+        (JSC::JSArray::put):
+        (JSC::JSArray::appendMemcpy):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::unshiftCountWithArrayStorage):
+        (JSC::JSArray::unshiftCountWithAnyIndexingType):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::constructArrayBuffer):
+        (JSC::callArrayBuffer):
+        * runtime/JSArrayBufferPrototype.cpp:
+        (JSC::arrayBufferProtoFuncSlice):
+        * runtime/JSCInlines.h:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::toObjectSlowCase):
+        (JSC::JSValue::synthesizePrototype):
+        (JSC::JSValue::putToPrimitive):
+        (JSC::JSValue::putToPrimitiveByIndex):
+        (JSC::JSValue::toStringSlowCase):
+        * runtime/JSCJSValueInlines.h:
+        (JSC::toPreferredPrimitiveType):
+        (JSC::JSValue::requireObjectCoercible):
+        * runtime/JSDataView.cpp:
+        (JSC::JSDataView::create):
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::getData):
+        (JSC::setData):
+        (JSC::dataViewProtoGetterBuffer):
+        (JSC::dataViewProtoGetterByteLength):
+        (JSC::dataViewProtoGetterByteOffset):
+        * runtime/JSFunction.cpp:
+        (JSC::callHostFunctionAsConstructor):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGenericTypedArrayView.h:
+        (JSC::JSGenericTypedArrayView::setIndex):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::constructGenericTypedArrayViewFromIterator):
+        (JSC::constructGenericTypedArrayViewWithArguments):
+        (JSC::constructGenericTypedArrayView):
+        (JSC::callGenericTypedArrayView):
+        * runtime/JSGenericTypedArrayViewInlines.h:
+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::create):
+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::createUninitialized):
+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::validateRange):
+        (JSC::JSGenericTypedArrayView&lt;Adaptor&gt;::throwNeuteredTypedArrayTypeError):
+        * runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
+        (JSC::speciesConstruct):
+        (JSC::genericTypedArrayViewProtoFuncSet):
+        (JSC::genericTypedArrayViewProtoFuncCopyWithin):
+        (JSC::genericTypedArrayViewProtoFuncIncludes):
+        (JSC::genericTypedArrayViewProtoFuncIndexOf):
+        (JSC::genericTypedArrayViewProtoFuncJoin):
+        (JSC::genericTypedArrayViewProtoFuncLastIndexOf):
+        (JSC::genericTypedArrayViewProtoGetterFuncBuffer):
+        (JSC::genericTypedArrayViewProtoGetterFuncLength):
+        (JSC::genericTypedArrayViewProtoGetterFuncByteLength):
+        (JSC::genericTypedArrayViewProtoGetterFuncByteOffset):
+        (JSC::genericTypedArrayViewProtoFuncReverse):
+        (JSC::genericTypedArrayViewPrivateFuncSort):
+        (JSC::genericTypedArrayViewProtoFuncSlice):
+        (JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::createEvalCodeBlock):
+        (JSC::JSGlobalObject::createModuleProgramCodeBlock):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncThrowTypeError):
+        (JSC::globalFuncThrowTypeErrorArgumentsCalleeAndCaller):
+        (JSC::globalFuncProtoGetter):
+        (JSC::globalFuncProtoSetter):
+        * runtime/JSModuleEnvironment.cpp:
+        (JSC::JSModuleEnvironment::put):
+        * runtime/JSModuleNamespaceObject.cpp:
+        (JSC::JSModuleNamespaceObject::getOwnPropertySlot):
+        (JSC::JSModuleNamespaceObject::put):
+        (JSC::JSModuleNamespaceObject::putByIndex):
+        (JSC::JSModuleNamespaceObject::defineOwnProperty):
+        (JSC::moduleNamespaceObjectSymbolIterator):
+        * runtime/JSModuleRecord.cpp:
+        (JSC::JSModuleRecord::getModuleNamespace):
+        (JSC::JSModuleRecord::link):
+        (JSC::JSModuleRecord::instantiateDeclarations):
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendStringifiedValue):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::callToPrimitiveFunction):
+        (JSC::JSObject::ordinaryToPrimitive):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::defaultHasInstance):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
+        (JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage):
+        (JSC::validateAndApplyPropertyDescriptor):
+        (JSC::JSObject::getMethod):
+        * runtime/JSObject.h:
+        (JSC::createListFromArrayLike): Deleted.
+        * runtime/JSObjectInlines.h:
+        (JSC::createListFromArrayLike):
+        (JSC::JSObject::putInline):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::constructPromise):
+        (JSC::callPromise):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::propertyNameIteratorFuncNext):
+        * runtime/JSString.cpp:
+        (JSC::JSRopeString::outOfMemory):
+        * runtime/JSStringBuilder.h:
+        (JSC::JSStringBuilder::build):
+        (JSC::jsMakeNontrivialString):
+        * runtime/JSStringJoiner.cpp:
+        (JSC::JSStringJoiner::joinedLength):
+        (JSC::JSStringJoiner::join):
+        * runtime/JSStringJoiner.h:
+        (JSC::JSStringJoiner::JSStringJoiner):
+        * runtime/JSSymbolTableObject.h:
+        (JSC::symbolTablePut):
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::constructTypedArrayView):
+        * runtime/JSTypedArrayViewPrototype.cpp:
+        (JSC::typedArrayViewPrivateFuncLength):
+        (JSC::typedArrayViewPrivateFuncSort):
+        (JSC::typedArrayViewProtoFuncSet):
+        (JSC::typedArrayViewProtoFuncCopyWithin):
+        (JSC::typedArrayViewProtoFuncIncludes):
+        (JSC::typedArrayViewProtoFuncLastIndexOf):
+        (JSC::typedArrayViewProtoFuncIndexOf):
+        (JSC::typedArrayViewProtoFuncJoin):
+        (JSC::typedArrayViewProtoGetterFuncBuffer):
+        (JSC::typedArrayViewProtoGetterFuncLength):
+        (JSC::typedArrayViewProtoGetterFuncByteLength):
+        (JSC::typedArrayViewProtoGetterFuncByteOffset):
+        (JSC::typedArrayViewProtoFuncReverse):
+        (JSC::typedArrayViewPrivateFuncSubarrayCreate):
+        (JSC::typedArrayViewProtoFuncSlice):
+        * runtime/MapConstructor.cpp:
+        (JSC::callMap):
+        (JSC::constructMap):
+        * runtime/MapDataInlines.h:
+        (JSC::JSIterator&gt;::ensureSpaceForAppend):
+        * runtime/MapIteratorPrototype.cpp:
+        (JSC::MapIteratorPrototypeFuncNext):
+        * runtime/MapPrototype.cpp:
+        (JSC::getMap):
+        (JSC::mapProtoFuncValues):
+        (JSC::mapProtoFuncEntries):
+        (JSC::mapProtoFuncKeys):
+        * runtime/ModuleLoaderPrototype.cpp:
+        (JSC::moduleLoaderPrototypeParseModule):
+        * runtime/NullSetterFunction.cpp:
+        (JSC::callReturnUndefined):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::objectConstructorSetPrototypeOf):
+        (JSC::toPropertyDescriptor):
+        (JSC::objectConstructorDefineProperty):
+        (JSC::objectConstructorDefineProperties):
+        (JSC::objectConstructorCreate):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.h:
+        (JSC::jsString):
+        (JSC::jsStringFromRegisterArray):
+        (JSC::jsStringFromArguments):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::makeRevocableProxy):
+        (JSC::proxyRevocableConstructorThrowError):
+        (JSC::constructProxyObject):
+        (JSC::callProxy):
+        * runtime/ProxyObject.cpp:
+        (JSC::ProxyObject::finishCreation):
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performInternalMethodGetOwnProperty):
+        (JSC::ProxyObject::performHasProperty):
+        (JSC::ProxyObject::getOwnPropertySlotCommon):
+        (JSC::ProxyObject::performPut):
+        (JSC::performProxyCall):
+        (JSC::performProxyConstruct):
+        (JSC::ProxyObject::performDelete):
+        (JSC::ProxyObject::performPreventExtensions):
+        (JSC::ProxyObject::performIsExtensible):
+        (JSC::ProxyObject::performDefineOwnProperty):
+        (JSC::ProxyObject::performGetOwnPropertyNames):
+        (JSC::ProxyObject::performSetPrototype):
+        (JSC::ProxyObject::performGetPrototype):
+        * runtime/ReflectObject.cpp:
+        (JSC::reflectObjectConstruct):
+        (JSC::reflectObjectDefineProperty):
+        (JSC::reflectObjectEnumerate):
+        (JSC::reflectObjectGet):
+        (JSC::reflectObjectGetOwnPropertyDescriptor):
+        (JSC::reflectObjectGetPrototypeOf):
+        (JSC::reflectObjectIsExtensible):
+        (JSC::reflectObjectOwnKeys):
+        (JSC::reflectObjectPreventExtensions):
+        (JSC::reflectObjectSet):
+        (JSC::reflectObjectSetPrototypeOf):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::toFlags):
+        (JSC::regExpCreate):
+        * runtime/RegExpObject.cpp:
+        (JSC::collectMatches):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTestFast):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncMatchFast):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        (JSC::regExpProtoGetterGlobal):
+        (JSC::regExpProtoGetterIgnoreCase):
+        (JSC::regExpProtoGetterMultiline):
+        (JSC::regExpProtoGetterSticky):
+        (JSC::regExpProtoGetterUnicode):
+        (JSC::regExpProtoGetterFlags):
+        (JSC::regExpProtoGetterSource):
+        (JSC::regExpProtoFuncSplitFast):
+        * runtime/Reject.h:
+        (JSC::reject):
+        * runtime/SetConstructor.cpp:
+        (JSC::callSet):
+        (JSC::constructSet):
+        * runtime/SetIteratorPrototype.cpp:
+        (JSC::SetIteratorPrototypeFuncNext):
+        * runtime/SetPrototype.cpp:
+        (JSC::getSet):
+        (JSC::setProtoFuncValues):
+        (JSC::setProtoFuncEntries):
+        * runtime/SparseArrayValueMap.cpp:
+        (JSC::SparseArrayValueMap::putEntry):
+        (JSC::SparseArrayEntry::put):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCodePoint):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        (JSC::StringObject::putByIndex):
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstrings):
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::repeatCharacter):
+        (JSC::replace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncCodePointAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::toLocaleCase):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        (JSC::trimString):
+        (JSC::stringProtoFuncStartsWith):
+        (JSC::stringProtoFuncEndsWith):
+        (JSC::stringProtoFuncIncludes):
+        (JSC::stringProtoFuncIterator):
+        (JSC::normalize):
+        (JSC::stringProtoFuncNormalize):
+        * runtime/StringRecursionChecker.cpp:
+        (JSC::StringRecursionChecker::throwStackOverflowError):
+        * runtime/Symbol.cpp:
+        (JSC::Symbol::toNumber):
+        * runtime/SymbolConstructor.cpp:
+        (JSC::symbolConstructorKeyFor):
+        * runtime/SymbolPrototype.cpp:
+        (JSC::symbolProtoFuncToString):
+        (JSC::symbolProtoFuncValueOf):
+        * runtime/ThrowScope.cpp: Added.
+        (JSC::ThrowScope::ThrowScope):
+        (JSC::ThrowScope::~ThrowScope):
+        (JSC::ThrowScope::throwException):
+        (JSC::ThrowScope::printIfNeedCheck):
+        (JSC::ThrowScope::simulateThrow):
+        (JSC::ThrowScope::verifyExceptionCheckNeedIsSatisfied):
+        * runtime/ThrowScope.h: Added.
+        (JSC::ThrowScope::vm):
+        (JSC::ThrowScope::exception):
+        (JSC::ThrowScope::release):
+        (JSC::ThrowScope::ThrowScope):
+        (JSC::ThrowScope::throwException):
+        (JSC::throwException):
+        * runtime/ThrowScopeLocation.h: Added.
+        (JSC::ThrowScopeLocation::ThrowScopeLocation):
+        * runtime/VM.h:
+        * runtime/VMEntryScope.h:
+        (JSC::VMEntryScope::vm):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::callWeakMap):
+        (JSC::constructWeakMap):
+        * runtime/WeakMapPrototype.cpp:
+        (JSC::getWeakMapData):
+        (JSC::protoFuncWeakMapSet):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::callWeakSet):
+        (JSC::constructWeakSet):
+        * runtime/WeakSetPrototype.cpp:
+        (JSC::getWeakMapData):
+        (JSC::protoFuncWeakSetAdd):
+
</ins><span class="cx"> 2016-08-30  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed. Remove incorrect assert causing crashes in debug builds.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -2096,8 +2096,10 @@
</span><span class="cx">                 FE1C0FFF1B194FD100B53FCA /* Exception.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE1C0FFE1B194FD100B53FCA /* Exception.cpp */; };
</span><span class="cx">                 FE20CE9D15F04A9500DF3430 /* LLIntCLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */; };
</span><span class="cx">                 FE20CE9E15F04A9500DF3430 /* LLIntCLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                FE2E6A7B1D6EA62C0060F896 /* ThrowScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE2E6A7A1D6EA5FE0060F896 /* ThrowScope.cpp */; };
</ins><span class="cx">                 FE318FDF1CAC982700DFCC54 /* ECMAScriptSpecInternalFunctions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */; };
</span><span class="cx">                 FE318FE01CAC982F00DFCC54 /* ECMAScriptSpecInternalFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */; };
</span><ins>+                FE3422121D6B81C30032BE88 /* ThrowScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FE3422111D6B818C0032BE88 /* ThrowScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 FE384EE51ADDB7AD0055DE2C /* JSDollarVM.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE384EE11ADDB7AD0055DE2C /* JSDollarVM.cpp */; };
</span><span class="cx">                 FE384EE61ADDB7AD0055DE2C /* JSDollarVM.h in Headers */ = {isa = PBXBuildFile; fileRef = FE384EE21ADDB7AD0055DE2C /* JSDollarVM.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 FE384EE71ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE384EE31ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp */; };
</span><span class="lines">@@ -2124,6 +2126,7 @@
</span><span class="cx">                 FE5068671AE25E280009DAB7 /* DeferredSourceDump.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE5068661AE25E280009DAB7 /* DeferredSourceDump.cpp */; };
</span><span class="cx">                 FE5932A7183C5A2600A1ECCC /* VMEntryScope.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE5932A5183C5A2600A1ECCC /* VMEntryScope.cpp */; };
</span><span class="cx">                 FE5932A8183C5A2600A1ECCC /* VMEntryScope.h in Headers */ = {isa = PBXBuildFile; fileRef = FE5932A6183C5A2600A1ECCC /* VMEntryScope.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                FE6029D91D6E1E4F0030204D /* ThrowScopeLocation.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6029D81D6E1E330030204D /* ThrowScopeLocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
</ins><span class="cx">                 FE68C6371B90DE040042BCB3 /* MacroAssemblerPrinter.h in Headers */ = {isa = PBXBuildFile; fileRef = FE68C6361B90DDD90042BCB3 /* MacroAssemblerPrinter.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 FE68C6381B90DE0B0042BCB3 /* MacroAssemblerPrinter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE68C6351B90DDD90042BCB3 /* MacroAssemblerPrinter.cpp */; };
</span><span class="cx">                 FE7BA60F1A1A7CEC00F1F7B4 /* HeapVerifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE7BA60D1A1A7CEC00F1F7B4 /* HeapVerifier.cpp */; };
</span><span class="lines">@@ -4398,8 +4401,10 @@
</span><span class="cx">                 FE1C0FFE1B194FD100B53FCA /* Exception.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Exception.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE20CE9B15F04A9500DF3430 /* LLIntCLoop.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LLIntCLoop.cpp; path = llint/LLIntCLoop.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE20CE9C15F04A9500DF3430 /* LLIntCLoop.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LLIntCLoop.h; path = llint/LLIntCLoop.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                FE2E6A7A1D6EA5FE0060F896 /* ThrowScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThrowScope.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ECMAScriptSpecInternalFunctions.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE318FDE1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ECMAScriptSpecInternalFunctions.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                FE3422111D6B818C0032BE88 /* ThrowScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThrowScope.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 FE384EE11ADDB7AD0055DE2C /* JSDollarVM.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDollarVM.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE384EE21ADDB7AD0055DE2C /* JSDollarVM.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDollarVM.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE384EE31ADDB7AD0055DE2C /* JSDollarVMPrototype.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDollarVMPrototype.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -4426,6 +4431,7 @@
</span><span class="cx">                 FE5068661AE25E280009DAB7 /* DeferredSourceDump.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DeferredSourceDump.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE5932A5183C5A2600A1ECCC /* VMEntryScope.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = VMEntryScope.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE5932A6183C5A2600A1ECCC /* VMEntryScope.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VMEntryScope.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                FE6029D81D6E1E330030204D /* ThrowScopeLocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThrowScopeLocation.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 FE68C6351B90DDD90042BCB3 /* MacroAssemblerPrinter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MacroAssemblerPrinter.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE68C6361B90DDD90042BCB3 /* MacroAssemblerPrinter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerPrinter.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 FE7BA60D1A1A7CEC00F1F7B4 /* HeapVerifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HeapVerifier.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -6129,6 +6135,9 @@
</span><span class="cx">                                 70ECA6041AFDBEA200449739 /* TemplateRegistryKey.h */,
</span><span class="cx">                                 0FA2C17917D7CF84009D015F /* TestRunnerUtils.cpp */,
</span><span class="cx">                                 0FA2C17A17D7CF84009D015F /* TestRunnerUtils.h */,
</span><ins>+                                FE2E6A7A1D6EA5FE0060F896 /* ThrowScope.cpp */,
+                                FE3422111D6B818C0032BE88 /* ThrowScope.h */,
+                                FE6029D81D6E1E330030204D /* ThrowScopeLocation.h */,
</ins><span class="cx">                                 0F55989717C86C5600A1E543 /* ToNativeFromValue.h */,
</span><span class="cx">                                 0F2B66D817B6B5AB00A7AE3F /* TypedArrayAdaptors.h */,
</span><span class="cx">                                 0F2B66D917B6B5AB00A7AE3F /* TypedArrayController.cpp */,
</span><span class="lines">@@ -7635,6 +7644,7 @@
</span><span class="cx">                                 BC18C4050E16F5CD00B34460 /* FunctionPrototype.h in Headers */,
</span><span class="cx">                                 62D2D3901ADF103F000206C1 /* FunctionRareData.h in Headers */,
</span><span class="cx">                                 2AACE63D18CA5A0300ED0191 /* GCActivityCallback.h in Headers */,
</span><ins>+                                FE3422121D6B81C30032BE88 /* ThrowScope.h in Headers */,
</ins><span class="cx">                                 BCBE2CAE14E985AA000593AD /* GCAssertions.h in Headers */,
</span><span class="cx">                                 0F766D3015A8DCE2008F363E /* GCAwareJITStubRoutine.h in Headers */,
</span><span class="cx">                                 0F2B66AC17B6B53F00A7AE3F /* GCIncomingRefCounted.h in Headers */,
</span><span class="lines">@@ -7676,6 +7686,7 @@
</span><span class="cx">                                 0FE0501A1AA9091100D33B33 /* GenericArgumentsInlines.h in Headers */,
</span><span class="cx">                                 FE3A06C01C11041A00390FDD /* JITRightShiftGenerator.h in Headers */,
</span><span class="cx">                                 708EBE241CE8F35800453146 /* IntlObjectInlines.h in Headers */,
</span><ins>+                                FE6029D91D6E1E4F0030204D /* ThrowScopeLocation.h in Headers */,
</ins><span class="cx">                                 0FE0501B1AA9091100D33B33 /* GenericOffset.h in Headers */,
</span><span class="cx">                                 0F2B66E017B6B5AB00A7AE3F /* GenericTypedArrayView.h in Headers */,
</span><span class="cx">                                 0F2B66E117B6B5AB00A7AE3F /* GenericTypedArrayViewInlines.h in Headers */,
</span><span class="lines">@@ -9177,6 +9188,7 @@
</span><span class="cx">                                 0FCEFAAB1804C13E00472CE4 /* FTLSaveRestore.cpp in Sources */,
</span><span class="cx">                                 0F25F1B1181635F300522F39 /* FTLSlowPathCall.cpp in Sources */,
</span><span class="cx">                                 0F338DF11BE93AD10013C88F /* B3StackmapValue.cpp in Sources */,
</span><ins>+                                FE2E6A7B1D6EA62C0060F896 /* ThrowScope.cpp in Sources */,
</ins><span class="cx">                                 0F25F1B3181635F300522F39 /* FTLSlowPathCallKey.cpp in Sources */,
</span><span class="cx">                                 E328DAEA1D38D005001A2529 /* BytecodeRewriter.cpp in Sources */,
</span><span class="cx">                                 4319DA031C1BE40A001D260B /* B3LowerMacrosAfterOptimizations.cpp in Sources */,
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGOperations.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGOperations.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/dfg/DFGOperations.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -138,8 +138,10 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (size &lt; 0) {
</span><del>-        vm.throwException(exec, createRangeError(exec, ASCIILiteral(&quot;Requested length is negative&quot;)));
</del><ins>+        throwException(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Requested length is negative&quot;)));
</ins><span class="cx">         return 0;
</span><span class="cx">     }
</span><span class="cx">     return bitwise_cast&lt;char*&gt;(ViewClass::create(exec, structure, size));
</span><span class="lines">@@ -725,12 +727,13 @@
</span><span class="cx">     
</span><span class="cx">     VM&amp; vm = globalObject-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSValue base = JSValue::decode(encodedBase);
</span><span class="cx">     JSValue argument = JSValue::decode(encodedArgument);
</span><span class="cx">     
</span><span class="cx">     if (!base.inherits(RegExpObject::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     JSString* input = argument.toStringOrNull(exec);
</span><span class="cx">     if (!input)
</span><span class="lines">@@ -769,12 +772,13 @@
</span><span class="cx">     
</span><span class="cx">     VM&amp; vm = globalObject-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSValue base = JSValue::decode(encodedBase);
</span><span class="cx">     JSValue argument = JSValue::decode(encodedArgument);
</span><span class="cx"> 
</span><span class="cx">     if (!base.inherits(RegExpObject::info())) {
</span><del>-        throwTypeError(exec);
</del><ins>+        throwTypeError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -933,9 +937,10 @@
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(size &lt; 0))
</span><del>-        return bitwise_cast&lt;char*&gt;(exec-&gt;vm().throwException(exec, createRangeError(exec, ASCIILiteral(&quot;Array size is not a small enough positive integer.&quot;))));
</del><ins>+        return bitwise_cast&lt;char*&gt;(throwException(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Array size is not a small enough positive integer.&quot;))));
</ins><span class="cx"> 
</span><span class="cx">     JSArray* result = JSArray::create(*vm, arrayStructure, size);
</span><span class="cx">     result-&gt;butterfly(); // Ensure that the backing store is in to-space.
</span><span class="lines">@@ -1388,9 +1393,10 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     if (sumOverflows&lt;int32_t&gt;(left-&gt;length(), right-&gt;length())) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1401,9 +1407,10 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     if (sumOverflows&lt;int32_t&gt;(a-&gt;length(), b-&gt;length(), c-&gt;length())) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1414,6 +1421,7 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSString* str1 = JSValue::decode(a).toString(exec);
</span><span class="cx">     ASSERT(!vm.exception()); // Impossible, since we must have been given primitives.
</span><span class="lines">@@ -1421,7 +1429,7 @@
</span><span class="cx">     ASSERT(!vm.exception());
</span><span class="cx"> 
</span><span class="cx">     if (sumOverflows&lt;int32_t&gt;(str1-&gt;length(), str2-&gt;length())) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1432,6 +1440,7 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSString* str1 = JSValue::decode(a).toString(exec);
</span><span class="cx">     ASSERT(!vm.exception()); // Impossible, since we must have been given primitives.
</span><span class="lines">@@ -1441,7 +1450,7 @@
</span><span class="cx">     ASSERT(!vm.exception());
</span><span class="cx"> 
</span><span class="cx">     if (sumOverflows&lt;int32_t&gt;(str1-&gt;length(), str2-&gt;length(), str3-&gt;length())) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1545,7 +1554,8 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><del>-    throwStackOverflowError(exec);
</del><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+    throwStackOverflowError(exec, scope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> int32_t JIT_OPERATION operationSizeOfVarargs(ExecState* exec, EncodedJSValue encodedArguments, int32_t firstVarArgOffset)
</span><span class="lines">@@ -1732,6 +1742,7 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     Identifier ident = Identifier::fromUid(exec, impl);
</span><span class="cx">     return JSValue::encode(scope-&gt;getPropertySlot(exec, ident, [&amp;] (bool found, PropertySlot&amp; slot) -&gt; JSValue {
</span><span class="lines">@@ -1738,7 +1749,7 @@
</span><span class="cx">         if (!found) {
</span><span class="cx">             GetPutInfo getPutInfo(getPutInfoBits);
</span><span class="cx">             if (getPutInfo.resolveMode() == ThrowIfNotFound)
</span><del>-                vm.throwException(exec, createUndefinedVariableError(exec, ident));
</del><ins>+                throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
</ins><span class="cx">             return jsUndefined();
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -1746,7 +1757,7 @@
</span><span class="cx">             // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
</span><span class="cx">             JSValue result = slot.getValue(exec, ident);
</span><span class="cx">             if (result == jsTDZValue()) {
</span><del>-                exec-&gt;vm().throwException(exec, createTDZError(exec));
</del><ins>+                throwException(exec, throwScope, createTDZError(exec));
</ins><span class="cx">                 return jsUndefined();
</span><span class="cx">             }
</span><span class="cx">             return result;
</span><span class="lines">@@ -1760,6 +1771,7 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     const Identifier&amp; ident = Identifier::fromUid(exec, impl);
</span><span class="cx">     GetPutInfo getPutInfo(getPutInfoBits);
</span><span class="lines">@@ -1771,13 +1783,13 @@
</span><span class="cx">         PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
</span><span class="cx">         JSGlobalLexicalEnvironment::getOwnPropertySlot(scope, exec, ident, slot);
</span><span class="cx">         if (slot.getValue(exec, ident) == jsTDZValue()) {
</span><del>-            exec-&gt;vm().throwException(exec, createTDZError(exec));
</del><ins>+            throwException(exec, throwScope, createTDZError(exec));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (getPutInfo.resolveMode() == ThrowIfNotFound &amp;&amp; !hasProperty) {
</span><del>-        exec-&gt;vm().throwException(exec, createUndefinedVariableError(exec, ident));
</del><ins>+        throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreinspectorJSInjectedScriptHostcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSInjectedScriptHost.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -95,9 +95,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSInjectedScriptHost::evaluateWithScopeExtension(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue scriptValue = exec-&gt;argument(0);
</span><span class="cx">     if (!scriptValue.isString())
</span><del>-        return throwTypeError(exec, ASCIILiteral(&quot;InjectedScriptHost.evaluateWithScopeExtension first argument must be a string.&quot;));
</del><ins>+        return throwTypeError(exec, scope, ASCIILiteral(&quot;InjectedScriptHost.evaluateWithScopeExtension first argument must be a string.&quot;));
</ins><span class="cx"> 
</span><span class="cx">     String program = scriptValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -107,7 +110,7 @@
</span><span class="cx">     JSObject* scopeExtension = exec-&gt;argument(1).getObject();
</span><span class="cx">     JSValue result = JSC::evaluateWithScopeExtension(exec, makeSource(program), scopeExtension, exception);
</span><span class="cx">     if (exception)
</span><del>-        exec-&gt;vm().throwException(exec, exception);
</del><ins>+        throwException(exec, scope, exception);
</ins><span class="cx"> 
</span><span class="cx">     return result;
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreinspectorJSInjectedScriptHostPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013, 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -77,10 +77,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeAttributeEvaluate(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;evaluate(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -87,10 +90,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionInternalConstructorName(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;internalConstructorName(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -97,10 +103,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;isHTMLAllCollection(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -107,10 +116,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakMapSize(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;weakMapSize(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -117,10 +129,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakMapEntries(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;weakMapEntries(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -127,10 +142,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakSetSize(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;weakSetSize(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -137,10 +155,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionWeakSetEntries(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;weakSetEntries(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -147,10 +168,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionIteratorEntries(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;iteratorEntries(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -157,10 +181,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;evaluateWithScopeExtension(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -167,10 +194,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionSubtype(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;subtype(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -177,10 +207,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionFunctionDetails(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;functionDetails(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -187,10 +220,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsInjectedScriptHostPrototypeFunctionGetInternalProperties(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSInjectedScriptHost* castedThis = jsDynamicCast&lt;JSInjectedScriptHost*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;getInternalProperties(exec));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreinspectorJSJavaScriptCallFramecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSJavaScriptCallFrame.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -77,9 +77,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSJavaScriptCallFrame::evaluateWithScopeExtension(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue scriptValue = exec-&gt;argument(0);
</span><span class="cx">     if (!scriptValue.isString())
</span><del>-        return throwTypeError(exec, ASCIILiteral(&quot;JSJavaScriptCallFrame.evaluateWithScopeExtension first argument must be a string.&quot;));
</del><ins>+        return throwTypeError(exec, scope, ASCIILiteral(&quot;JSJavaScriptCallFrame.evaluateWithScopeExtension first argument must be a string.&quot;));
</ins><span class="cx"> 
</span><span class="cx">     String script = scriptValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -89,7 +92,7 @@
</span><span class="cx">     JSObject* scopeExtension = exec-&gt;argument(1).getObject();
</span><span class="cx">     JSValue result = impl().evaluateWithScopeExtension(script, scopeExtension, exception);
</span><span class="cx">     if (exception)
</span><del>-        exec-&gt;vm().throwException(exec, exception);
</del><ins>+        throwException(exec, scope, exception);
</ins><span class="cx"> 
</span><span class="cx">     return result;
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreinspectorJSJavaScriptCallFramePrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -76,10 +76,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionEvaluateWithScopeExtension(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;evaluateWithScopeExtension(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -86,10 +89,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionScopeDescriptions(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;scopeDescriptions(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -96,10 +102,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeCaller(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;caller(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -106,10 +115,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeSourceID(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;sourceID(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -116,10 +128,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeLine(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;line(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -126,10 +141,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeColumn(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;column(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -136,10 +154,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeFunctionName(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;functionName(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -146,10 +167,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeScopeChain(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;scopeChain(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -156,10 +180,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeThisObject(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;thisObject(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -166,10 +193,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameAttributeType(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;type(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -176,10 +206,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsJavaScriptCallFrameIsTailDeleted(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSJavaScriptCallFrame* castedThis = jsDynamicCast&lt;JSJavaScriptCallFrame*&gt;(thisValue);
</span><span class="cx">     if (!castedThis)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(castedThis-&gt;isTailDeleted(exec));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreinterpreterCachedCallh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/interpreter/CachedCall.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/interpreter/CachedCall.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/interpreter/CachedCall.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -44,12 +44,15 @@
</span><span class="cx">             , m_interpreter(callFrame-&gt;interpreter())
</span><span class="cx">             , m_entryScope(callFrame-&gt;vm(), function-&gt;scope()-&gt;globalObject())
</span><span class="cx">         {
</span><ins>+            VM&amp; vm = m_entryScope.vm();
+            auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">             ASSERT(!function-&gt;isHostFunctionNonInline());
</span><del>-            if (UNLIKELY(callFrame-&gt;vm().isSafeToRecurseSoft())) {
</del><ins>+            if (UNLIKELY(vm.isSafeToRecurseSoft())) {
</ins><span class="cx">                 m_arguments.resize(argumentCount);
</span><span class="cx">                 m_closure = m_interpreter-&gt;prepareForRepeatCall(function-&gt;jsExecutable(), callFrame, &amp;m_protoCallFrame, function, argumentCount + 1, function-&gt;scope(), m_arguments.data());
</span><span class="cx">             } else
</span><del>-                throwStackOverflowError(callFrame);
</del><ins>+                throwStackOverflowError(callFrame, scope);
</ins><span class="cx">             m_valid = !callFrame-&gt;hadException();
</span><span class="cx">         }
</span><span class="cx">         
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreinterpreterInterpretercpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/interpreter/Interpreter.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/interpreter/Interpreter.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/interpreter/Interpreter.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2009, 2010, 2012-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008-2010, 2012-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  * Copyright (C) 2008 Cameron Zwarich &lt;cwzwarich@uwaterloo.ca&gt;
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -127,6 +127,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue eval(CallFrame* callFrame)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!callFrame-&gt;argumentCount())
</span><span class="cx">         return jsUndefined();
</span><span class="cx"> 
</span><span class="lines">@@ -134,10 +137,10 @@
</span><span class="cx">     if (!program.isString())
</span><span class="cx">         return program;
</span><span class="cx"> 
</span><del>-    TopCallFrameSetter topCallFrame(callFrame-&gt;vm(), callFrame);
</del><ins>+    TopCallFrameSetter topCallFrame(vm, callFrame);
</ins><span class="cx">     JSGlobalObject* globalObject = callFrame-&gt;lexicalGlobalObject();
</span><span class="cx">     if (!globalObject-&gt;evalEnabled()) {
</span><del>-        callFrame-&gt;vm().throwException(callFrame, createEvalError(callFrame, globalObject-&gt;evalDisabledErrorMessage()));
</del><ins>+        throwException(callFrame, scope, createEvalError(callFrame, globalObject-&gt;evalDisabledErrorMessage()));
</ins><span class="cx">         return jsUndefined();
</span><span class="cx">     }
</span><span class="cx">     String programSource = asString(program)-&gt;value(callFrame);
</span><span class="lines">@@ -181,7 +184,7 @@
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         // If the literal parser bailed, it should not have thrown exceptions.
</span><del>-        ASSERT(!callFrame-&gt;vm().exception());
</del><ins>+        ASSERT(!vm.exception());
</ins><span class="cx"> 
</span><span class="cx">         eval = callerCodeBlock-&gt;evalCodeCache().getSlow(callFrame, callerCodeBlock, callerCodeBlock-&gt;isStrictMode(), derivedContextType, evalContextType, isArrowFunctionContext, programSource, callerScopeChain);
</span><span class="cx"> 
</span><span class="lines">@@ -190,17 +193,20 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSValue thisValue = callerFrame-&gt;thisValue();
</span><del>-    Interpreter* interpreter = callFrame-&gt;vm().interpreter;
</del><ins>+    Interpreter* interpreter = vm.interpreter;
</ins><span class="cx">     return interpreter-&gt;execute(eval, callFrame, thisValue, callerScopeChain);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> unsigned sizeOfVarargs(CallFrame* callFrame, JSValue arguments, uint32_t firstVarArgOffset)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(!arguments.isCell())) {
</span><span class="cx">         if (arguments.isUndefinedOrNull())
</span><span class="cx">             return 0;
</span><span class="cx">         
</span><del>-        callFrame-&gt;vm().throwException(callFrame, createInvalidFunctionApplyParameterError(callFrame, arguments));
</del><ins>+        throwException(callFrame, scope, createInvalidFunctionApplyParameterError(callFrame, arguments));
</ins><span class="cx">         return 0;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -215,7 +221,7 @@
</span><span class="cx">         break;
</span><span class="cx">     case StringType:
</span><span class="cx">     case SymbolType:
</span><del>-        callFrame-&gt;vm().throwException(callFrame, createInvalidFunctionApplyParameterError(callFrame,  arguments));
</del><ins>+        throwException(callFrame, scope, createInvalidFunctionApplyParameterError(callFrame,  arguments));
</ins><span class="cx">         return 0;
</span><span class="cx">         
</span><span class="cx">     default:
</span><span class="lines">@@ -237,10 +243,12 @@
</span><span class="cx"> 
</span><span class="cx"> unsigned sizeFrameForForwardArguments(CallFrame* callFrame, VM&amp; vm, unsigned numUsedStackSlots)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     unsigned length = callFrame-&gt;argumentCount();
</span><span class="cx">     CallFrame* calleeFrame = calleeFrameForVarargs(callFrame, numUsedStackSlots, length + 1);
</span><span class="cx">     if (UNLIKELY(!vm.ensureStackCapacityFor(calleeFrame-&gt;registers())))
</span><del>-        throwStackOverflowError(callFrame);
</del><ins>+        throwStackOverflowError(callFrame, scope);
</ins><span class="cx"> 
</span><span class="cx">     return length;
</span><span class="cx"> }
</span><span class="lines">@@ -247,11 +255,13 @@
</span><span class="cx"> 
</span><span class="cx"> unsigned sizeFrameForVarargs(CallFrame* callFrame, VM&amp; vm, JSValue arguments, unsigned numUsedStackSlots, uint32_t firstVarArgOffset)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     unsigned length = sizeOfVarargs(callFrame, arguments, firstVarArgOffset);
</span><span class="cx">     
</span><span class="cx">     CallFrame* calleeFrame = calleeFrameForVarargs(callFrame, numUsedStackSlots, length + 1);
</span><span class="cx">     if (UNLIKELY(length &gt; maxArguments || !vm.ensureStackCapacityFor(calleeFrame-&gt;registers()))) {
</span><del>-        throwStackOverflowError(callFrame);
</del><ins>+        throwStackOverflowError(callFrame, scope);
</ins><span class="cx">         return 0;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -822,8 +832,9 @@
</span><span class="cx"> {
</span><span class="cx">     JSScope* scope = thisObj-&gt;globalObject()-&gt;globalScope();
</span><span class="cx">     VM&amp; vm = *scope-&gt;vm();
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><del>-    ASSERT(!vm.exception());
</del><ins>+    ASSERT(!throwScope.exception());
</ins><span class="cx">     ASSERT(!vm.isCollectorBusy());
</span><span class="cx">     RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());
</span><span class="cx">     if (vm.isCollectorBusy())
</span><span class="lines">@@ -830,7 +841,7 @@
</span><span class="cx">         return jsNull();
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft()))
</span><del>-        return checkedReturn(throwStackOverflowError(callFrame));
</del><ins>+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
</ins><span class="cx"> 
</span><span class="cx">     // First check if the &quot;program&quot; is actually just a JSON object. If so,
</span><span class="cx">     // we'll handle the JSON object here. Else, we'll handle real JS code
</span><span class="lines">@@ -871,22 +882,22 @@
</span><span class="cx">                     if (i == 0) {
</span><span class="cx">                         PropertySlot slot(globalObject, PropertySlot::InternalMethodType::Get);
</span><span class="cx">                         if (!globalObject-&gt;getPropertySlot(callFrame, JSONPPath[i].m_pathEntryName, slot)) {
</span><del>-                            if (callFrame-&gt;hadException())
</del><ins>+                            if (throwScope.exception())
</ins><span class="cx">                                 return jsUndefined();
</span><span class="cx">                             if (entry)
</span><del>-                                return callFrame-&gt;vm().throwException(callFrame, createUndefinedVariableError(callFrame, JSONPPath[i].m_pathEntryName));
</del><ins>+                                return throwException(callFrame, throwScope, createUndefinedVariableError(callFrame, JSONPPath[i].m_pathEntryName));
</ins><span class="cx">                             goto failedJSONP;
</span><span class="cx">                         }
</span><span class="cx">                         baseObject = slot.getValue(callFrame, JSONPPath[i].m_pathEntryName);
</span><span class="cx">                     } else
</span><span class="cx">                         baseObject = baseObject.get(callFrame, JSONPPath[i].m_pathEntryName);
</span><del>-                    if (callFrame-&gt;hadException())
</del><ins>+                    if (throwScope.exception())
</ins><span class="cx">                         return jsUndefined();
</span><span class="cx">                     continue;
</span><span class="cx">                 }
</span><span class="cx">                 case JSONPPathEntryTypeLookup: {
</span><span class="cx">                     baseObject = baseObject.get(callFrame, static_cast&lt;unsigned&gt;(JSONPPath[i].m_pathIndex));
</span><del>-                    if (callFrame-&gt;hadException())
</del><ins>+                    if (throwScope.exception())
</ins><span class="cx">                         return jsUndefined();
</span><span class="cx">                     continue;
</span><span class="cx">                 }
</span><span class="lines">@@ -899,29 +910,29 @@
</span><span class="cx">             switch (JSONPPath.last().m_type) {
</span><span class="cx">             case JSONPPathEntryTypeCall: {
</span><span class="cx">                 JSValue function = baseObject.get(callFrame, JSONPPath.last().m_pathEntryName);
</span><del>-                if (callFrame-&gt;hadException())
</del><ins>+                if (throwScope.exception())
</ins><span class="cx">                     return jsUndefined();
</span><span class="cx">                 CallData callData;
</span><span class="cx">                 CallType callType = getCallData(function, callData);
</span><span class="cx">                 if (callType == CallType::None)
</span><del>-                    return callFrame-&gt;vm().throwException(callFrame, createNotAFunctionError(callFrame, function));
</del><ins>+                    return throwException(callFrame, throwScope, createNotAFunctionError(callFrame, function));
</ins><span class="cx">                 MarkedArgumentBuffer jsonArg;
</span><span class="cx">                 jsonArg.append(JSONPValue);
</span><span class="cx">                 JSValue thisValue = JSONPPath.size() == 1 ? jsUndefined(): baseObject;
</span><span class="cx">                 JSONPValue = JSC::call(callFrame, function, callType, callData, thisValue, jsonArg);
</span><del>-                if (callFrame-&gt;hadException())
</del><ins>+                if (throwScope.exception())
</ins><span class="cx">                     return jsUndefined();
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">             case JSONPPathEntryTypeDot: {
</span><span class="cx">                 baseObject.put(callFrame, JSONPPath.last().m_pathEntryName, JSONPValue, slot);
</span><del>-                if (callFrame-&gt;hadException())
</del><ins>+                if (throwScope.exception())
</ins><span class="cx">                     return jsUndefined();
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">             case JSONPPathEntryTypeLookup: {
</span><span class="cx">                 baseObject.putByIndex(callFrame, JSONPPath.last().m_pathIndex, JSONPValue, slot.isStrictMode());
</span><del>-                if (callFrame-&gt;hadException())
</del><ins>+                if (throwScope.exception())
</ins><span class="cx">                     return jsUndefined();
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="lines">@@ -941,18 +952,20 @@
</span><span class="cx"> 
</span><span class="cx">     // Compile source to bytecode if necessary:
</span><span class="cx">     if (JSObject* error = program-&gt;initializeGlobalProperties(vm, callFrame, scope))
</span><del>-        return checkedReturn(callFrame-&gt;vm().throwException(callFrame, error));
</del><ins>+        return checkedReturn(throwException(callFrame, throwScope, error));
</ins><span class="cx"> 
</span><span class="cx">     ProgramCodeBlock* codeBlock;
</span><span class="cx">     {
</span><span class="cx">         CodeBlock* tempCodeBlock;
</span><del>-        if (JSObject* error = program-&gt;prepareForExecution&lt;ProgramExecutable&gt;(callFrame, nullptr, scope, CodeForCall, tempCodeBlock))
-            return checkedReturn(callFrame-&gt;vm().throwException(callFrame, error));
</del><ins>+        JSObject* error = program-&gt;prepareForExecution&lt;ProgramExecutable&gt;(callFrame, nullptr, scope, CodeForCall, tempCodeBlock);
+        ASSERT(!throwScope.exception() || throwScope.exception() == jsDynamicCast&lt;Exception*&gt;(error));
+        if (error)
+            return checkedReturn(throwException(callFrame, throwScope, error));
</ins><span class="cx">         codeBlock = jsCast&lt;ProgramCodeBlock*&gt;(tempCodeBlock);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
</span><del>-        return throwTerminatedExecutionException(callFrame);
</del><ins>+        return throwTerminatedExecutionException(callFrame, throwScope);
</ins><span class="cx"> 
</span><span class="cx">     if (scope-&gt;structure()-&gt;isUncacheableDictionary())
</span><span class="cx">         scope-&gt;flattenDictionaryObject(vm);
</span><span class="lines">@@ -971,6 +984,8 @@
</span><span class="cx"> JSValue Interpreter::executeCall(CallFrame* callFrame, JSObject* function, CallType callType, const CallData&amp; callData, JSValue thisValue, const ArgList&amp; args)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = callFrame-&gt;vm();
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT(!callFrame-&gt;hadException());
</span><span class="cx">     ASSERT(!vm.isCollectorBusy());
</span><span class="cx">     if (vm.isCollectorBusy())
</span><span class="lines">@@ -993,13 +1008,14 @@
</span><span class="cx"> 
</span><span class="cx">     VMEntryScope entryScope(vm, globalObject);
</span><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft()))
</span><del>-        return checkedReturn(throwStackOverflowError(callFrame));
</del><ins>+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
</ins><span class="cx"> 
</span><span class="cx">     if (isJSCall) {
</span><span class="cx">         // Compile the callee:
</span><span class="cx">         JSObject* compileError = callData.js.functionExecutable-&gt;prepareForExecution&lt;FunctionExecutable&gt;(callFrame, jsCast&lt;JSFunction*&gt;(function), scope, CodeForCall, newCodeBlock);
</span><ins>+        ASSERT(throwScope.exception() == reinterpret_cast&lt;Exception*&gt;(compileError));
</ins><span class="cx">         if (UNLIKELY(!!compileError))
</span><del>-            return checkedReturn(callFrame-&gt;vm().throwException(callFrame, compileError));
</del><ins>+            return checkedReturn(throwException(callFrame, throwScope, compileError));
</ins><span class="cx"> 
</span><span class="cx">         ASSERT(!!newCodeBlock);
</span><span class="cx">         newCodeBlock-&gt;m_shouldAlwaysBeInlined = false;
</span><span class="lines">@@ -1007,7 +1023,7 @@
</span><span class="cx">         newCodeBlock = 0;
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
</span><del>-        return throwTerminatedExecutionException(callFrame);
</del><ins>+        return throwTerminatedExecutionException(callFrame, throwScope);
</ins><span class="cx"> 
</span><span class="cx">     ProtoCallFrame protoCallFrame;
</span><span class="cx">     protoCallFrame.init(newCodeBlock, function, thisValue, argsCount, args.data());
</span><span class="lines">@@ -1015,11 +1031,12 @@
</span><span class="cx">     JSValue result;
</span><span class="cx">     {
</span><span class="cx">         // Execute the code:
</span><del>-        if (isJSCall)
</del><ins>+        if (isJSCall) {
</ins><span class="cx">             result = callData.js.functionExecutable-&gt;generatedJITCodeForCall()-&gt;execute(&amp;vm, &amp;protoCallFrame);
</span><del>-        else {
</del><ins>+            throwScope.release();
+        } else {
</ins><span class="cx">             result = JSValue::decode(vmEntryToNative(reinterpret_cast&lt;void*&gt;(callData.native.function), &amp;vm, &amp;protoCallFrame));
</span><del>-            if (callFrame-&gt;hadException())
</del><ins>+            if (throwScope.exception())
</ins><span class="cx">                 result = jsNull();
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -1030,12 +1047,14 @@
</span><span class="cx"> JSObject* Interpreter::executeConstruct(CallFrame* callFrame, JSObject* constructor, ConstructType constructType, const ConstructData&amp; constructData, const ArgList&amp; args, JSValue newTarget)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = callFrame-&gt;vm();
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT(!callFrame-&gt;hadException());
</span><span class="cx">     ASSERT(!vm.isCollectorBusy());
</span><span class="cx">     // We throw in this case because we have to return something &quot;valid&quot; but we're
</span><span class="cx">     // already in an invalid state.
</span><span class="cx">     if (vm.isCollectorBusy())
</span><del>-        return checkedReturn(throwStackOverflowError(callFrame));
</del><ins>+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
</ins><span class="cx"> 
</span><span class="cx">     bool isJSConstruct = (constructType == ConstructType::JS);
</span><span class="cx">     JSScope* scope = nullptr;
</span><span class="lines">@@ -1054,13 +1073,13 @@
</span><span class="cx"> 
</span><span class="cx">     VMEntryScope entryScope(vm, globalObject);
</span><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft()))
</span><del>-        return checkedReturn(throwStackOverflowError(callFrame));
</del><ins>+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
</ins><span class="cx"> 
</span><span class="cx">     if (isJSConstruct) {
</span><span class="cx">         // Compile the callee:
</span><span class="cx">         JSObject* compileError = constructData.js.functionExecutable-&gt;prepareForExecution&lt;FunctionExecutable&gt;(callFrame, jsCast&lt;JSFunction*&gt;(constructor), scope, CodeForConstruct, newCodeBlock);
</span><span class="cx">         if (UNLIKELY(!!compileError))
</span><del>-            return checkedReturn(callFrame-&gt;vm().throwException(callFrame, compileError));
</del><ins>+            return checkedReturn(throwException(callFrame, throwScope, compileError));
</ins><span class="cx"> 
</span><span class="cx">         ASSERT(!!newCodeBlock);
</span><span class="cx">         newCodeBlock-&gt;m_shouldAlwaysBeInlined = false;
</span><span class="lines">@@ -1068,7 +1087,7 @@
</span><span class="cx">         newCodeBlock = 0;
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
</span><del>-        return throwTerminatedExecutionException(callFrame);
</del><ins>+        return throwTerminatedExecutionException(callFrame, throwScope);
</ins><span class="cx"> 
</span><span class="cx">     ProtoCallFrame protoCallFrame;
</span><span class="cx">     protoCallFrame.init(newCodeBlock, constructor, newTarget, argsCount, args.data());
</span><span class="lines">@@ -1095,6 +1114,7 @@
</span><span class="cx"> CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* functionExecutable, CallFrame* callFrame, ProtoCallFrame* protoCallFrame, JSFunction* function, int argumentCountIncludingThis, JSScope* scope, JSValue* args)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = *scope-&gt;vm();
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     ASSERT(!vm.exception());
</span><span class="cx">     
</span><span class="cx">     if (vm.isCollectorBusy())
</span><span class="lines">@@ -1104,7 +1124,7 @@
</span><span class="cx">     CodeBlock* newCodeBlock;
</span><span class="cx">     JSObject* error = functionExecutable-&gt;prepareForExecution&lt;FunctionExecutable&gt;(callFrame, function, scope, CodeForCall, newCodeBlock);
</span><span class="cx">     if (error) {
</span><del>-        callFrame-&gt;vm().throwException(callFrame, error);
</del><ins>+        throwException(callFrame, throwScope, error);
</ins><span class="cx">         return CallFrameClosure();
</span><span class="cx">     }
</span><span class="cx">     newCodeBlock-&gt;m_shouldAlwaysBeInlined = false;
</span><span class="lines">@@ -1120,7 +1140,8 @@
</span><span class="cx"> JSValue Interpreter::execute(CallFrameClosure&amp; closure) 
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = *closure.vm;
</span><del>-    
</del><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT(!vm.isCollectorBusy());
</span><span class="cx">     RELEASE_ASSERT(vm.currentThreadIsHoldingAPILock());
</span><span class="cx">     if (vm.isCollectorBusy())
</span><span class="lines">@@ -1129,7 +1150,7 @@
</span><span class="cx">     StackStats::CheckPoint stackCheckPoint;
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(vm.shouldTriggerTermination(closure.oldCallFrame)))
</span><del>-        return throwTerminatedExecutionException(closure.oldCallFrame);
</del><ins>+        return throwTerminatedExecutionException(closure.oldCallFrame, throwScope);
</ins><span class="cx"> 
</span><span class="cx">     // Execute the code:
</span><span class="cx">     JSValue result = closure.functionExecutable-&gt;generatedJITCodeForCall()-&gt;execute(&amp;vm, closure.protoCallFrame);
</span><span class="lines">@@ -1140,7 +1161,8 @@
</span><span class="cx"> JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSValue thisValue, JSScope* scope)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = *scope-&gt;vm();
</span><del>-    
</del><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT(scope-&gt;vm() == &amp;callFrame-&gt;vm());
</span><span class="cx">     ASSERT(!vm.exception());
</span><span class="cx">     ASSERT(!vm.isCollectorBusy());
</span><span class="lines">@@ -1150,7 +1172,7 @@
</span><span class="cx"> 
</span><span class="cx">     VMEntryScope entryScope(vm, scope-&gt;globalObject());
</span><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft()))
</span><del>-        return checkedReturn(throwStackOverflowError(callFrame));        
</del><ins>+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
</ins><span class="cx"> 
</span><span class="cx">     unsigned numVariables = eval-&gt;numVariables();
</span><span class="cx">     int numFunctions = eval-&gt;numberOfFunctionDecls();
</span><span class="lines">@@ -1181,7 +1203,7 @@
</span><span class="cx">         CodeBlock* tempCodeBlock;
</span><span class="cx">         JSObject* compileError = eval-&gt;prepareForExecution&lt;EvalExecutable&gt;(callFrame, nullptr, scope, CodeForCall, tempCodeBlock);
</span><span class="cx">         if (UNLIKELY(!!compileError))
</span><del>-            return checkedReturn(callFrame-&gt;vm().throwException(callFrame, compileError));
</del><ins>+            return checkedReturn(throwException(callFrame, throwScope, compileError));
</ins><span class="cx">         codeBlock = jsCast&lt;EvalCodeBlock*&gt;(tempCodeBlock);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1192,7 +1214,7 @@
</span><span class="cx">             const Identifier&amp; ident = codeBlock-&gt;variable(i);
</span><span class="cx">             PropertySlot slot(globalLexicalEnvironment, PropertySlot::InternalMethodType::VMInquiry);
</span><span class="cx">             if (JSGlobalLexicalEnvironment::getOwnPropertySlot(globalLexicalEnvironment, callFrame, ident, slot)) {
</span><del>-                return checkedReturn(throwTypeError(callFrame, makeString(&quot;Can't create duplicate global variable in eval: '&quot;, String(ident.impl()), &quot;'&quot;)));
</del><ins>+                return checkedReturn(throwTypeError(callFrame, throwScope, makeString(&quot;Can't create duplicate global variable in eval: '&quot;, String(ident.impl()), &quot;'&quot;)));
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -1200,7 +1222,7 @@
</span><span class="cx">             FunctionExecutable* function = codeBlock-&gt;functionDecl(i);
</span><span class="cx">             PropertySlot slot(globalLexicalEnvironment, PropertySlot::InternalMethodType::VMInquiry);
</span><span class="cx">             if (JSGlobalLexicalEnvironment::getOwnPropertySlot(globalLexicalEnvironment, callFrame, function-&gt;name(), slot)) {
</span><del>-                return checkedReturn(throwTypeError(callFrame, makeString(&quot;Can't create duplicate global variable in eval: '&quot;, String(function-&gt;name().impl()), &quot;'&quot;)));
</del><ins>+                return checkedReturn(throwTypeError(callFrame, throwScope, makeString(&quot;Can't create duplicate global variable in eval: '&quot;, String(function-&gt;name().impl()), &quot;'&quot;)));
</ins><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -1229,7 +1251,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
</span><del>-        return throwTerminatedExecutionException(callFrame);
</del><ins>+        return throwTerminatedExecutionException(callFrame, throwScope);
</ins><span class="cx"> 
</span><span class="cx">     ASSERT(codeBlock-&gt;numParameters() == 1); // 1 parameter for 'this'.
</span><span class="cx"> 
</span><span class="lines">@@ -1245,6 +1267,7 @@
</span><span class="cx"> JSValue Interpreter::execute(ModuleProgramExecutable* executable, CallFrame* callFrame, JSModuleEnvironment* scope)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = *scope-&gt;vm();
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     ASSERT(scope-&gt;vm() == &amp;callFrame-&gt;vm());
</span><span class="cx">     ASSERT(!vm.exception());
</span><span class="lines">@@ -1255,7 +1278,7 @@
</span><span class="cx"> 
</span><span class="cx">     VMEntryScope entryScope(vm, scope-&gt;globalObject());
</span><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft()))
</span><del>-        return checkedReturn(throwStackOverflowError(callFrame));
</del><ins>+        return checkedReturn(throwStackOverflowError(callFrame, throwScope));
</ins><span class="cx"> 
</span><span class="cx">     ModuleProgramCodeBlock* codeBlock;
</span><span class="cx">     {
</span><span class="lines">@@ -1262,12 +1285,12 @@
</span><span class="cx">         CodeBlock* tempCodeBlock;
</span><span class="cx">         JSObject* compileError = executable-&gt;prepareForExecution&lt;ModuleProgramExecutable&gt;(callFrame, nullptr, scope, CodeForCall, tempCodeBlock);
</span><span class="cx">         if (UNLIKELY(!!compileError))
</span><del>-            return checkedReturn(callFrame-&gt;vm().throwException(callFrame, compileError));
</del><ins>+            return checkedReturn(throwException(callFrame, throwScope, compileError));
</ins><span class="cx">         codeBlock = jsCast&lt;ModuleProgramCodeBlock*&gt;(tempCodeBlock);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(vm.shouldTriggerTermination(callFrame)))
</span><del>-        return throwTerminatedExecutionException(callFrame);
</del><ins>+        return throwTerminatedExecutionException(callFrame, throwScope);
</ins><span class="cx"> 
</span><span class="cx">     if (scope-&gt;structure()-&gt;isUncacheableDictionary())
</span><span class="cx">         scope-&gt;flattenDictionaryObject(vm);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCorejitJITOperationscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/jit/JITOperations.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/jit/JITOperations.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/jit/JITOperations.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -89,6 +89,7 @@
</span><span class="cx"> {
</span><span class="cx">     // We pass in our own code block, because the callframe hasn't been populated.
</span><span class="cx">     VM* vm = codeBlock-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx"> 
</span><span class="cx">     VMEntryFrame* vmEntryFrame = vm-&gt;topVMEntryFrame;
</span><span class="cx">     CallFrame* callerFrame = exec-&gt;callerFrame(vmEntryFrame);
</span><span class="lines">@@ -98,7 +99,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     NativeCallFrameTracerWithRestore tracer(vm, vmEntryFrame, callerFrame);
</span><del>-    throwStackOverflowError(callerFrame);
</del><ins>+    throwStackOverflowError(callerFrame, scope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="lines">@@ -105,23 +106,27 @@
</span><span class="cx"> void JIT_OPERATION operationThrowDivideError(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
</ins><span class="cx">     VMEntryFrame* vmEntryFrame = vm-&gt;topVMEntryFrame;
</span><span class="cx">     CallFrame* callerFrame = exec-&gt;callerFrame(vmEntryFrame);
</span><span class="cx"> 
</span><span class="cx">     NativeCallFrameTracerWithRestore tracer(vm, vmEntryFrame, callerFrame);
</span><span class="cx">     ErrorHandlingScope errorScope(*vm);
</span><del>-    vm-&gt;throwException(callerFrame, createError(callerFrame, ASCIILiteral(&quot;Division by zero or division overflow.&quot;)));
</del><ins>+    throwException(callerFrame, scope, createError(callerFrame, ASCIILiteral(&quot;Division by zero or division overflow.&quot;)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT_OPERATION operationThrowOutOfBoundsAccessError(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
</ins><span class="cx">     VMEntryFrame* vmEntryFrame = vm-&gt;topVMEntryFrame;
</span><span class="cx">     CallFrame* callerFrame = exec-&gt;callerFrame(vmEntryFrame);
</span><span class="cx"> 
</span><span class="cx">     NativeCallFrameTracerWithRestore tracer(vm, vmEntryFrame, callerFrame);
</span><span class="cx">     ErrorHandlingScope errorScope(*vm);
</span><del>-    vm-&gt;throwException(callerFrame, createError(callerFrame, ASCIILiteral(&quot;Out-of-bounds access.&quot;)));
</del><ins>+    throwException(callerFrame, scope, createError(callerFrame, ASCIILiteral(&quot;Out-of-bounds access.&quot;)));
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="lines">@@ -128,6 +133,7 @@
</span><span class="cx"> int32_t JIT_OPERATION operationCallArityCheck(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx"> 
</span><span class="cx">     int32_t missingArgCount = CommonSlowPaths::arityCheckFor(exec, *vm, CodeForCall);
</span><span class="cx">     if (missingArgCount &lt; 0) {
</span><span class="lines">@@ -134,7 +140,7 @@
</span><span class="cx">         VMEntryFrame* vmEntryFrame = vm-&gt;topVMEntryFrame;
</span><span class="cx">         CallFrame* callerFrame = exec-&gt;callerFrame(vmEntryFrame);
</span><span class="cx">         NativeCallFrameTracerWithRestore tracer(vm, vmEntryFrame, callerFrame);
</span><del>-        throwStackOverflowError(callerFrame);
</del><ins>+        throwStackOverflowError(callerFrame, scope);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return missingArgCount;
</span><span class="lines">@@ -143,6 +149,7 @@
</span><span class="cx"> int32_t JIT_OPERATION operationConstructArityCheck(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx"> 
</span><span class="cx">     int32_t missingArgCount = CommonSlowPaths::arityCheckFor(exec, *vm, CodeForConstruct);
</span><span class="cx">     if (missingArgCount &lt; 0) {
</span><span class="lines">@@ -149,7 +156,7 @@
</span><span class="cx">         VMEntryFrame* vmEntryFrame = vm-&gt;topVMEntryFrame;
</span><span class="cx">         CallFrame* callerFrame = exec-&gt;callerFrame(vmEntryFrame);
</span><span class="cx">         NativeCallFrameTracerWithRestore tracer(vm, vmEntryFrame, callerFrame);
</span><del>-        throwStackOverflowError(callerFrame);
</del><ins>+        throwStackOverflowError(callerFrame, scope);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return missingArgCount;
</span><span class="lines">@@ -254,9 +261,10 @@
</span><span class="cx">     
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><del>-    
</del><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
</ins><span class="cx">     if (!base-&gt;isObject()) {
</span><del>-        vm-&gt;throwException(exec, createInvalidInParameterError(exec, base));
</del><ins>+        throwException(exec, scope, createInvalidInParameterError(exec, base));
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -283,11 +291,12 @@
</span><span class="cx">     
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><del>-    
</del><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
</ins><span class="cx">     stubInfo-&gt;tookSlowPath = true;
</span><span class="cx"> 
</span><span class="cx">     if (!base-&gt;isObject()) {
</span><del>-        vm-&gt;throwException(exec, createInvalidInParameterError(exec, base));
</del><ins>+        throwException(exec, scope, createInvalidInParameterError(exec, base));
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -794,6 +803,7 @@
</span><span class="cx"> {
</span><span class="cx">     ExecState* exec = execCallee-&gt;callerFrame();
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx"> 
</span><span class="cx">     execCallee-&gt;setCodeBlock(0);
</span><span class="cx"> 
</span><span class="lines">@@ -819,7 +829,7 @@
</span><span class="cx">         }
</span><span class="cx">     
</span><span class="cx">         ASSERT(callType == CallType::None);
</span><del>-        exec-&gt;vm().throwException(exec, createNotAFunctionError(exec, callee));
</del><ins>+        throwException(exec, scope, createNotAFunctionError(exec, callee));
</ins><span class="cx">         return encodeResult(
</span><span class="cx">             vm-&gt;getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
</span><span class="cx">             reinterpret_cast&lt;void*&gt;(KeepTheFrame));
</span><span class="lines">@@ -846,7 +856,7 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     ASSERT(constructType == ConstructType::None);
</span><del>-    exec-&gt;vm().throwException(exec, createNotAConstructorError(exec, callee));
</del><ins>+    throwException(exec, scope, createNotAConstructorError(exec, callee));
</ins><span class="cx">     return encodeResult(
</span><span class="cx">         vm-&gt;getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
</span><span class="cx">         reinterpret_cast&lt;void*&gt;(KeepTheFrame));
</span><span class="lines">@@ -856,6 +866,8 @@
</span><span class="cx"> {
</span><span class="cx">     ExecState* exec = execCallee-&gt;callerFrame();
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(*vm);
+
</ins><span class="cx">     CodeSpecializationKind kind = callLinkInfo-&gt;specializationKind();
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><span class="cx">     
</span><span class="lines">@@ -865,6 +877,7 @@
</span><span class="cx">         // FIXME: We should cache these kinds of calls. They can be common and currently they are
</span><span class="cx">         // expensive.
</span><span class="cx">         // https://bugs.webkit.org/show_bug.cgi?id=144458
</span><ins>+        throwScope.release();
</ins><span class="cx">         return handleHostCall(execCallee, calleeAsValue, callLinkInfo);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -892,7 +905,7 @@
</span><span class="cx">         FunctionExecutable* functionExecutable = static_cast&lt;FunctionExecutable*&gt;(executable);
</span><span class="cx"> 
</span><span class="cx">         if (!isCall(kind) &amp;&amp; functionExecutable-&gt;constructAbility() == ConstructAbility::CannotConstruct) {
</span><del>-            exec-&gt;vm().throwException(exec, createNotAConstructorError(exec, callee));
</del><ins>+            throwException(exec, throwScope, createNotAConstructorError(exec, callee));
</ins><span class="cx">             return encodeResult(
</span><span class="cx">                 vm-&gt;getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
</span><span class="cx">                 reinterpret_cast&lt;void*&gt;(KeepTheFrame));
</span><span class="lines">@@ -900,8 +913,9 @@
</span><span class="cx"> 
</span><span class="cx">         CodeBlock** codeBlockSlot = execCallee-&gt;addressOfCodeBlock();
</span><span class="cx">         JSObject* error = functionExecutable-&gt;prepareForExecution&lt;FunctionExecutable&gt;(execCallee, callee, scope, kind, *codeBlockSlot);
</span><ins>+        ASSERT(throwScope.exception() == reinterpret_cast&lt;Exception*&gt;(error));
</ins><span class="cx">         if (error) {
</span><del>-            exec-&gt;vm().throwException(exec, error);
</del><ins>+            throwException(exec, throwScope, error);
</ins><span class="cx">             return encodeResult(
</span><span class="cx">                 vm-&gt;getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
</span><span class="cx">                 reinterpret_cast&lt;void*&gt;(KeepTheFrame));
</span><span class="lines">@@ -927,6 +941,8 @@
</span><span class="cx"> {
</span><span class="cx">     ExecState* exec = execCallee-&gt;callerFrame();
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(*vm);
+
</ins><span class="cx">     CodeSpecializationKind kind = callLinkInfo-&gt;specializationKind();
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><span class="cx"> 
</span><span class="lines">@@ -947,7 +963,7 @@
</span><span class="cx">             FunctionExecutable* functionExecutable = static_cast&lt;FunctionExecutable*&gt;(executable);
</span><span class="cx"> 
</span><span class="cx">             if (!isCall(kind) &amp;&amp; functionExecutable-&gt;constructAbility() == ConstructAbility::CannotConstruct) {
</span><del>-                exec-&gt;vm().throwException(exec, createNotAConstructorError(exec, function));
</del><ins>+                throwException(exec, throwScope, createNotAConstructorError(exec, function));
</ins><span class="cx">                 return encodeResult(
</span><span class="cx">                     vm-&gt;getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
</span><span class="cx">                     reinterpret_cast&lt;void*&gt;(KeepTheFrame));
</span><span class="lines">@@ -956,7 +972,7 @@
</span><span class="cx">             CodeBlock** codeBlockSlot = execCallee-&gt;addressOfCodeBlock();
</span><span class="cx">             JSObject* error = functionExecutable-&gt;prepareForExecution&lt;FunctionExecutable&gt;(execCallee, function, scope, kind, *codeBlockSlot);
</span><span class="cx">             if (error) {
</span><del>-                exec-&gt;vm().throwException(exec, error);
</del><ins>+                throwException(exec, throwScope, error);
</ins><span class="cx">                 return encodeResult(
</span><span class="cx">                     vm-&gt;getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
</span><span class="cx">                     reinterpret_cast&lt;void*&gt;(KeepTheFrame));
</span><span class="lines">@@ -964,7 +980,7 @@
</span><span class="cx">         } else {
</span><span class="cx"> #if ENABLE(WEBASSEMBLY)
</span><span class="cx">             if (!isCall(kind)) {
</span><del>-                exec-&gt;vm().throwException(exec, createNotAConstructorError(exec, function));
</del><ins>+                throwException(exec, throwScope, createNotAConstructorError(exec, function));
</ins><span class="cx">                 return encodeResult(
</span><span class="cx">                     vm-&gt;getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
</span><span class="cx">                     reinterpret_cast&lt;void*&gt;(KeepTheFrame));
</span><span class="lines">@@ -1139,9 +1155,11 @@
</span><span class="cx">     SuperSamplerScope superSamplerScope(false);
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RegExp* regexp = static_cast&lt;RegExp*&gt;(regexpPtr);
</span><span class="cx">     if (!regexp-&gt;isValid()) {
</span><del>-        vm.throwException(exec, createSyntaxError(exec, regexp-&gt;errorMessage()));
</del><ins>+        throwException(exec, scope, createSyntaxError(exec, regexp-&gt;errorMessage()));
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1156,9 +1174,10 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(vm.shouldTriggerTermination(exec)))
</span><del>-        vm.throwException(exec, createTerminatedExecutionException(&amp;vm));
</del><ins>+        throwException(exec, scope, createTerminatedExecutionException(&amp;vm));
</ins><span class="cx"> 
</span><span class="cx">     return nullptr;
</span><span class="cx"> }
</span><span class="lines">@@ -1167,13 +1186,15 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue errorMessageValue = JSValue::decode(encodedValue);
</span><span class="cx">     RELEASE_ASSERT(errorMessageValue.isString());
</span><span class="cx">     String errorMessage = asString(errorMessageValue)-&gt;value(exec);
</span><span class="cx">     if (referenceErrorFlag)
</span><del>-        vm.throwException(exec, createReferenceError(exec, errorMessage));
</del><ins>+        throwException(exec, scope, createReferenceError(exec, errorMessage));
</ins><span class="cx">     else
</span><del>-        throwTypeError(exec, errorMessage);
</del><ins>+        throwTypeError(exec, scope, errorMessage);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JIT_OPERATION operationDebug(ExecState* exec, int32_t debugHookID)
</span><span class="lines">@@ -1871,6 +1892,7 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSObject* baseObj = JSValue::decode(encodedBase).toObject(exec);
</span><span class="cx">     if (!baseObj)
</span><span class="lines">@@ -1877,7 +1899,7 @@
</span><span class="cx">         return false;
</span><span class="cx">     bool couldDelete = baseObj-&gt;methodTable(vm)-&gt;deleteProperty(baseObj, exec, Identifier::fromUid(&amp;vm, uid));
</span><span class="cx">     if (!couldDelete &amp;&amp; exec-&gt;codeBlock()-&gt;isStrictMode())
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Unable to delete property.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Unable to delete property.&quot;));
</ins><span class="cx">     return couldDelete;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1890,6 +1912,7 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSObject* baseObj = JSValue::decode(encodedBase).toObject(exec);
</span><span class="cx">     JSValue key = JSValue::decode(encodedKey);
</span><span class="lines">@@ -1909,7 +1932,7 @@
</span><span class="cx">         couldDelete = baseObj-&gt;methodTable(vm)-&gt;deleteProperty(baseObj, exec, property);
</span><span class="cx">     }
</span><span class="cx">     if (!couldDelete &amp;&amp; exec-&gt;codeBlock()-&gt;isStrictMode())
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Unable to delete property.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Unable to delete property.&quot;));
</ins><span class="cx">     return couldDelete;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -2026,6 +2049,8 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     CodeBlock* codeBlock = exec-&gt;codeBlock();
</span><span class="cx">     Instruction* pc = bytecodePC;
</span><span class="cx"> 
</span><span class="lines">@@ -2039,7 +2064,7 @@
</span><span class="cx">     return JSValue::encode(scope-&gt;getPropertySlot(exec, ident, [&amp;] (bool found, PropertySlot&amp; slot) -&gt; JSValue {
</span><span class="cx">         if (!found) {
</span><span class="cx">             if (getPutInfo.resolveMode() == ThrowIfNotFound)
</span><del>-                vm.throwException(exec, createUndefinedVariableError(exec, ident));
</del><ins>+                throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
</ins><span class="cx">             return jsUndefined();
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -2048,7 +2073,7 @@
</span><span class="cx">             // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
</span><span class="cx">             result = slot.getValue(exec, ident);
</span><span class="cx">             if (result == jsTDZValue()) {
</span><del>-                vm.throwException(exec, createTDZError(exec));
</del><ins>+                throwException(exec, throwScope, createTDZError(exec));
</ins><span class="cx">                 return jsUndefined();
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="lines">@@ -2065,6 +2090,8 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(&amp;vm, exec);
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Instruction* pc = bytecodePC;
</span><span class="cx"> 
</span><span class="cx">     CodeBlock* codeBlock = exec-&gt;codeBlock();
</span><span class="lines">@@ -2092,13 +2119,13 @@
</span><span class="cx">         PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
</span><span class="cx">         JSGlobalLexicalEnvironment::getOwnPropertySlot(scope, exec, ident, slot);
</span><span class="cx">         if (slot.getValue(exec, ident) == jsTDZValue()) {
</span><del>-            exec-&gt;vm().throwException(exec, createTDZError(exec));
</del><ins>+            throwException(exec, throwScope, createTDZError(exec));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (getPutInfo.resolveMode() == ThrowIfNotFound &amp;&amp; !hasProperty) {
</span><del>-        exec-&gt;vm().throwException(exec, createUndefinedVariableError(exec, ident));
</del><ins>+        throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -2105,7 +2132,7 @@
</span><span class="cx">     PutPropertySlot slot(scope, codeBlock-&gt;isStrictMode(), PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode()));
</span><span class="cx">     scope-&gt;methodTable()-&gt;put(scope, exec, ident, value, slot);
</span><span class="cx">     
</span><del>-    if (exec-&gt;vm().exception())
</del><ins>+    if (vm.exception())
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     CommonSlowPaths::tryCachePutToScopeGlobal(exec, codeBlock, pc, scope, getPutInfo, slot, ident);
</span><span class="lines">@@ -2115,9 +2142,10 @@
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx"> 
</span><span class="cx">     JSValue exceptionValue = JSValue::decode(encodedExceptionValue);
</span><del>-    vm-&gt;throwException(exec, exceptionValue);
</del><ins>+    throwException(exec, scope, exceptionValue);
</ins><span class="cx"> 
</span><span class="cx">     // Results stored out-of-band in vm.targetMachinePCForThrow &amp; vm.callFrameForCatch
</span><span class="cx">     genericUnwind(vm, exec);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/jsc.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/jsc.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/jsc.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -365,12 +365,15 @@
</span><span class="cx"> private:
</span><span class="cx">     static EncodedJSValue customGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
</span><span class="cx">     {
</span><ins>+        VM&amp; vm = exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">         CustomGetter* thisObject = jsDynamicCast&lt;CustomGetter*&gt;(JSValue::decode(thisValue));
</span><span class="cx">         if (!thisObject)
</span><del>-            return throwVMTypeError(exec);
</del><ins>+            return throwVMTypeError(exec, scope);
</ins><span class="cx">         bool shouldThrow = thisObject-&gt;get(exec, PropertyName(Identifier::fromString(exec, &quot;shouldThrow&quot;))).toBoolean(exec);
</span><span class="cx">         if (shouldThrow)
</span><del>-            return throwVMTypeError(exec);
</del><ins>+            return throwVMTypeError(exec, scope);
</ins><span class="cx">         return JSValue::encode(jsNumber(100));
</span><span class="cx">     }
</span><span class="cx"> };
</span><span class="lines">@@ -470,9 +473,12 @@
</span><span class="cx"> 
</span><span class="cx">     static EncodedJSValue lengthGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
</span><span class="cx">     {
</span><ins>+        VM&amp; vm = exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">         RuntimeArray* thisObject = jsDynamicCast&lt;RuntimeArray*&gt;(JSValue::decode(thisValue));
</span><span class="cx">         if (!thisObject)
</span><del>-            return throwVMTypeError(exec);
</del><ins>+            return throwVMTypeError(exec, scope);
</ins><span class="cx">         return JSValue::encode(jsNumber(thisObject-&gt;getLength()));
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1232,11 +1238,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionCreateElement(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSLockHolder lock(exec);
</span><span class="cx">     Root* root = jsDynamicCast&lt;Root*&gt;(exec-&gt;argument(0));
</span><span class="cx">     if (!root)
</span><del>-        return JSValue::encode(exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Cannot create Element without a Root.&quot;))));
-    return JSValue::encode(Element::create(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), root));
</del><ins>+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Cannot create Element without a Root.&quot;))));
+    return JSValue::encode(Element::create(vm, exec-&gt;lexicalGlobalObject(), root));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionGetElement(ExecState* exec)
</span><span class="lines">@@ -1416,20 +1425,23 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionRun(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String fileName = exec-&gt;argument(0).toWTFString(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     Vector&lt;char&gt; script;
</span><span class="cx">     if (!fetchScriptFromLocalFileSystem(fileName, script))
</span><del>-        return JSValue::encode(exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Could not open file.&quot;))));
</del><ins>+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Could not open file.&quot;))));
</ins><span class="cx"> 
</span><del>-    GlobalObject* globalObject = GlobalObject::create(exec-&gt;vm(), GlobalObject::createStructure(exec-&gt;vm(), jsNull()), Vector&lt;String&gt;());
</del><ins>+    GlobalObject* globalObject = GlobalObject::create(vm, GlobalObject::createStructure(vm, jsNull()), Vector&lt;String&gt;());
</ins><span class="cx"> 
</span><span class="cx">     JSArray* array = constructEmptyArray(globalObject-&gt;globalExec(), 0);
</span><span class="cx">     for (unsigned i = 1; i &lt; exec-&gt;argumentCount(); ++i)
</span><span class="cx">         array-&gt;putDirectIndex(globalObject-&gt;globalExec(), i - 1, exec-&gt;uncheckedArgument(i));
</span><span class="cx">     globalObject-&gt;putDirect(
</span><del>-        exec-&gt;vm(), Identifier::fromString(globalObject-&gt;globalExec(), &quot;arguments&quot;), array);
</del><ins>+        vm, Identifier::fromString(globalObject-&gt;globalExec(), &quot;arguments&quot;), array);
</ins><span class="cx"> 
</span><span class="cx">     NakedPtr&lt;Exception&gt; exception;
</span><span class="cx">     StopWatch stopWatch;
</span><span class="lines">@@ -1438,7 +1450,7 @@
</span><span class="cx">     stopWatch.stop();
</span><span class="cx"> 
</span><span class="cx">     if (exception) {
</span><del>-        exec-&gt;vm().throwException(globalObject-&gt;globalExec(), exception);
</del><ins>+        throwException(globalObject-&gt;globalExec(), scope, exception);
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -1447,23 +1459,26 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionRunString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String source = exec-&gt;argument(0).toWTFString(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><del>-    GlobalObject* globalObject = GlobalObject::create(exec-&gt;vm(), GlobalObject::createStructure(exec-&gt;vm(), jsNull()), Vector&lt;String&gt;());
</del><ins>+    GlobalObject* globalObject = GlobalObject::create(vm, GlobalObject::createStructure(vm, jsNull()), Vector&lt;String&gt;());
</ins><span class="cx"> 
</span><span class="cx">     JSArray* array = constructEmptyArray(globalObject-&gt;globalExec(), 0);
</span><span class="cx">     for (unsigned i = 1; i &lt; exec-&gt;argumentCount(); ++i)
</span><span class="cx">         array-&gt;putDirectIndex(globalObject-&gt;globalExec(), i - 1, exec-&gt;uncheckedArgument(i));
</span><span class="cx">     globalObject-&gt;putDirect(
</span><del>-        exec-&gt;vm(), Identifier::fromString(globalObject-&gt;globalExec(), &quot;arguments&quot;), array);
</del><ins>+        vm, Identifier::fromString(globalObject-&gt;globalExec(), &quot;arguments&quot;), array);
</ins><span class="cx"> 
</span><span class="cx">     NakedPtr&lt;Exception&gt; exception;
</span><span class="cx">     evaluate(globalObject-&gt;globalExec(), makeSource(source), JSValue(), exception);
</span><span class="cx"> 
</span><span class="cx">     if (exception) {
</span><del>-        exec-&gt;vm().throwException(globalObject-&gt;globalExec(), exception);
</del><ins>+        scope.throwException(globalObject-&gt;globalExec(), exception);
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -1472,12 +1487,15 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionLoad(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String fileName = exec-&gt;argument(0).toWTFString(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     Vector&lt;char&gt; script;
</span><span class="cx">     if (!fetchScriptFromLocalFileSystem(fileName, script))
</span><del>-        return JSValue::encode(exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Could not open file.&quot;))));
</del><ins>+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Could not open file.&quot;))));
</ins><span class="cx"> 
</span><span class="cx">     JSGlobalObject* globalObject = exec-&gt;lexicalGlobalObject();
</span><span class="cx">     
</span><span class="lines">@@ -1484,12 +1502,15 @@
</span><span class="cx">     NakedPtr&lt;Exception&gt; evaluationException;
</span><span class="cx">     JSValue result = evaluate(globalObject-&gt;globalExec(), jscSource(script, fileName), JSValue(), evaluationException);
</span><span class="cx">     if (evaluationException)
</span><del>-        exec-&gt;vm().throwException(exec, evaluationException);
</del><ins>+        throwException(exec, scope, evaluationException);
</ins><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionLoadString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String sourceCode = exec-&gt;argument(0).toWTFString(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1498,18 +1519,21 @@
</span><span class="cx">     NakedPtr&lt;Exception&gt; evaluationException;
</span><span class="cx">     JSValue result = evaluate(globalObject-&gt;globalExec(), makeSource(sourceCode), JSValue(), evaluationException);
</span><span class="cx">     if (evaluationException)
</span><del>-        exec-&gt;vm().throwException(exec, evaluationException);
</del><ins>+        throwException(exec, scope, evaluationException);
</ins><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionReadFile(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String fileName = exec-&gt;argument(0).toWTFString(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     Vector&lt;char&gt; script;
</span><span class="cx">     if (!fillBufferWithContentsOfFile(fileName, script))
</span><del>-        return JSValue::encode(exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Could not open file.&quot;))));
</del><ins>+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Could not open file.&quot;))));
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsString(exec, stringFromUTF(script)));
</span><span class="cx"> }
</span><span class="lines">@@ -1516,12 +1540,15 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionCheckSyntax(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String fileName = exec-&gt;argument(0).toWTFString(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     Vector&lt;char&gt; script;
</span><span class="cx">     if (!fetchScriptFromLocalFileSystem(fileName, script))
</span><del>-        return JSValue::encode(exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Could not open file.&quot;))));
</del><ins>+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Could not open file.&quot;))));
</ins><span class="cx"> 
</span><span class="cx">     JSGlobalObject* globalObject = exec-&gt;lexicalGlobalObject();
</span><span class="cx"> 
</span><span class="lines">@@ -1533,7 +1560,7 @@
</span><span class="cx">     stopWatch.stop();
</span><span class="cx"> 
</span><span class="cx">     if (!validSyntax)
</span><del>-        exec-&gt;vm().throwException(exec, syntaxException);
</del><ins>+        throwException(exec, scope, syntaxException);
</ins><span class="cx">     return JSValue::encode(jsNumber(stopWatch.getElapsedMS()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1638,12 +1665,15 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionTransferArrayBuffer(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (exec-&gt;argumentCount() &lt; 1)
</span><del>-        return JSValue::encode(exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Not enough arguments&quot;))));
</del><ins>+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Not enough arguments&quot;))));
</ins><span class="cx">     
</span><span class="cx">     JSArrayBuffer* buffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(exec-&gt;argument(0));
</span><span class="cx">     if (!buffer)
</span><del>-        return JSValue::encode(exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Expected an array buffer&quot;))));
</del><ins>+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Expected an array buffer&quot;))));
</ins><span class="cx">     
</span><span class="cx">     ArrayBufferContents dummyContents;
</span><span class="cx">     buffer-&gt;impl()-&gt;transfer(dummyContents);
</span><span class="lines">@@ -1810,12 +1840,15 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionLoadModule(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String fileName = exec-&gt;argument(0).toWTFString(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     Vector&lt;char&gt; script;
</span><span class="cx">     if (!fetchScriptFromLocalFileSystem(fileName, script))
</span><del>-        return JSValue::encode(exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Could not open file.&quot;))));
</del><ins>+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Could not open file.&quot;))));
</ins><span class="cx"> 
</span><span class="cx">     JSInternalPromise* promise = loadAndEvaluateModule(exec, fileName);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -1822,15 +1855,15 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><span class="cx">     JSValue error;
</span><del>-    JSFunction* errorHandler = JSNativeStdFunction::create(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), 1, String(), [&amp;](ExecState* exec) {
</del><ins>+    JSFunction* errorHandler = JSNativeStdFunction::create(vm, exec-&gt;lexicalGlobalObject(), 1, String(), [&amp;](ExecState* exec) {
</ins><span class="cx">         error = exec-&gt;argument(0);
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     });
</span><span class="cx"> 
</span><span class="cx">     promise-&gt;then(exec, nullptr, errorHandler);
</span><del>-    exec-&gt;vm().drainMicrotasks();
</del><ins>+    vm.drainMicrotasks();
</ins><span class="cx">     if (error)
</span><del>-        return JSValue::encode(exec-&gt;vm().throwException(exec, error));
</del><ins>+        return JSValue::encode(throwException(exec, scope, error));
</ins><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1858,6 +1891,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionCheckModuleSyntax(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String source = exec-&gt;argument(0).toWTFString(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1870,7 +1906,7 @@
</span><span class="cx">     stopWatch.stop();
</span><span class="cx"> 
</span><span class="cx">     if (!validSyntax)
</span><del>-        exec-&gt;vm().throwException(exec, jsNontrivialString(exec, toString(&quot;SyntaxError: &quot;, error.message(), &quot;:&quot;, error.line())));
</del><ins>+        throwException(exec, scope, jsNontrivialString(exec, toString(&quot;SyntaxError: &quot;, error.message(), &quot;:&quot;, error.line())));
</ins><span class="cx">     return JSValue::encode(jsNumber(stopWatch.getElapsedMS()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1907,10 +1943,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionSamplingProfilerStackTraces(ExecState* exec)
</span><span class="cx"> {
</span><del>-    if (!exec-&gt;vm().samplingProfiler())
-        return JSValue::encode(exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Sampling profiler was never started&quot;))));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><del>-    String jsonString = exec-&gt;vm().samplingProfiler()-&gt;stackTracesAsJSON();
</del><ins>+    if (!vm.samplingProfiler())
+        return JSValue::encode(throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Sampling profiler was never started&quot;))));
+
+    String jsonString = vm.samplingProfiler()-&gt;stackTracesAsJSON();
</ins><span class="cx">     EncodedJSValue result = JSValue::encode(JSONParse(exec, jsonString));
</span><span class="cx">     RELEASE_ASSERT(!exec-&gt;hadException());
</span><span class="cx">     return result;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -65,7 +65,8 @@
</span><span class="cx"> 
</span><span class="cx"> #define LLINT_BEGIN_NO_SET_PC() \
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();      \
</span><del>-    NativeCallFrameTracer tracer(&amp;vm, exec)
</del><ins>+    NativeCallFrameTracer tracer(&amp;vm, exec); \
+    auto throwScope = DECLARE_THROW_SCOPE(vm)
</ins><span class="cx"> 
</span><span class="cx"> #ifndef NDEBUG
</span><span class="cx"> #define LLINT_SET_PC_FOR_STUBS() do { \
</span><span class="lines">@@ -92,7 +93,7 @@
</span><span class="cx"> #define LLINT_END_IMPL() LLINT_RETURN_TWO(pc, 0)
</span><span class="cx"> 
</span><span class="cx"> #define LLINT_THROW(exceptionToThrow) do {                        \
</span><del>-        vm.throwException(exec, exceptionToThrow);                \
</del><ins>+        throwException(exec, throwScope, exceptionToThrow);       \
</ins><span class="cx">         pc = returnToThrow(exec);                                 \
</span><span class="cx">         LLINT_END_IMPL();                                         \
</span><span class="cx">     } while (false)
</span><span class="lines">@@ -99,7 +100,7 @@
</span><span class="cx"> 
</span><span class="cx"> #define LLINT_CHECK_EXCEPTION() do {                    \
</span><span class="cx">         doExceptionFuzzingIfEnabled(exec, &quot;LLIntSlowPaths&quot;, pc);    \
</span><del>-        if (UNLIKELY(vm.exception())) {                 \
</del><ins>+        if (UNLIKELY(throwScope.exception())) {         \
</ins><span class="cx">             pc = returnToThrow(exec);                   \
</span><span class="cx">             LLINT_END_IMPL();                           \
</span><span class="cx">         }                                               \
</span><span class="lines">@@ -152,7 +153,7 @@
</span><span class="cx"> 
</span><span class="cx"> #define LLINT_CALL_THROW(exec, exceptionToThrow) do {                   \
</span><span class="cx">         ExecState* __ct_exec = (exec);                                  \
</span><del>-        vm.throwException(__ct_exec, exceptionToThrow);                 \
</del><ins>+        throwException(__ct_exec, throwScope, exceptionToThrow);        \
</ins><span class="cx">         LLINT_CALL_END_IMPL(0, callToThrow(__ct_exec));                 \
</span><span class="cx">     } while (false)
</span><span class="cx"> 
</span><span class="lines">@@ -160,7 +161,7 @@
</span><span class="cx">         ExecState* __cce_exec = (exec);                                 \
</span><span class="cx">         ExecState* __cce_execCallee = (execCallee);                     \
</span><span class="cx">         doExceptionFuzzingIfEnabled(__cce_exec, &quot;LLIntSlowPaths/call&quot;, nullptr); \
</span><del>-        if (UNLIKELY(vm.exception()))                                   \
</del><ins>+        if (UNLIKELY(throwScope.exception()))                           \
</ins><span class="cx">             LLINT_CALL_END_IMPL(0, callToThrow(__cce_execCallee));      \
</span><span class="cx">     } while (false)
</span><span class="cx"> 
</span><span class="lines">@@ -466,6 +467,8 @@
</span><span class="cx"> LLINT_SLOW_PATH_DECL(stack_check)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     VMEntryFrame* vmEntryFrame = vm.topVMEntryFrame;
</span><span class="cx">     CallFrame* callerFrame = exec-&gt;callerFrame(vmEntryFrame);
</span><span class="cx">     if (!callerFrame) {
</span><span class="lines">@@ -482,9 +485,9 @@
</span><span class="cx">     dataLogF(&quot;Num callee registers = %u.\n&quot;, exec-&gt;codeBlock()-&gt;m_numCalleeLocals);
</span><span class="cx">     dataLogF(&quot;Num vars = %u.\n&quot;, exec-&gt;codeBlock()-&gt;m_numVars);
</span><span class="cx"> 
</span><del>-    dataLogF(&quot;Current OS stack end is at %p.\n&quot;, exec-&gt;vm().softStackLimit());
</del><ins>+    dataLogF(&quot;Current OS stack end is at %p.\n&quot;, vm.softStackLimit());
</ins><span class="cx"> #if !ENABLE(JIT)
</span><del>-    dataLogF(&quot;Current C Loop stack end is at %p.\n&quot;, exec-&gt;vm().cloopStackLimit());
</del><ins>+    dataLogF(&quot;Current C Loop stack end is at %p.\n&quot;, vm.cloopStackLimit());
</ins><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> #endif
</span><span class="lines">@@ -502,7 +505,7 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">     ErrorHandlingScope errorScope(vm);
</span><del>-    throwStackOverflowError(callerFrame);
</del><ins>+    throwStackOverflowError(callerFrame, throwScope);
</ins><span class="cx">     pc = returnToThrow(callerFrame);
</span><span class="cx">     LLINT_RETURN_TWO(pc, exec);
</span><span class="cx"> }
</span><span class="lines">@@ -784,10 +787,11 @@
</span><span class="cx">     LLINT_RETURN(jsBoolean(couldDelete));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript)
</del><ins>+static ALWAYS_INLINE JSValue getByVal(VM&amp; vm, ExecState* exec, JSValue baseValue, JSValue subscript)
</ins><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (LIKELY(baseValue.isCell() &amp;&amp; subscript.isString())) {
</span><del>-        VM&amp; vm = exec-&gt;vm();
</del><span class="cx">         Structure&amp; structure = *baseValue.asCell()-&gt;structure(vm);
</span><span class="cx">         if (JSCell::canUseFastGetOwnProperty(structure)) {
</span><span class="cx">             if (RefPtr&lt;AtomicStringImpl&gt; existingAtomicString = asString(subscript)-&gt;toExistingAtomicString(exec)) {
</span><span class="lines">@@ -806,10 +810,10 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     baseValue.requireObjectCoercible(exec);
</span><del>-    if (exec-&gt;hadException())
</del><ins>+    if (scope.exception())
</ins><span class="cx">         return jsUndefined();
</span><span class="cx">     auto property = subscript.toPropertyKey(exec);
</span><del>-    if (exec-&gt;hadException())
</del><ins>+    if (scope.exception())
</ins><span class="cx">         return jsUndefined();
</span><span class="cx">     return baseValue.get(exec, property);
</span><span class="cx"> }
</span><span class="lines">@@ -817,7 +821,7 @@
</span><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_get_by_val)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN();
</span><del>-    LLINT_RETURN_PROFILED(op_get_by_val, getByVal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue()));
</del><ins>+    LLINT_RETURN_PROFILED(op_get_by_val, getByVal(vm, exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_put_by_val)
</span><span class="lines">@@ -827,6 +831,7 @@
</span><span class="cx">     JSValue baseValue = LLINT_OP_C(1).jsValue();
</span><span class="cx">     JSValue subscript = LLINT_OP_C(2).jsValue();
</span><span class="cx">     JSValue value = LLINT_OP_C(3).jsValue();
</span><ins>+    bool isStrictMode = exec-&gt;codeBlock()-&gt;isStrictMode();
</ins><span class="cx">     
</span><span class="cx">     if (LIKELY(subscript.isUInt32())) {
</span><span class="cx">         uint32_t i = subscript.asUInt32();
</span><span class="lines">@@ -835,16 +840,16 @@
</span><span class="cx">             if (object-&gt;canSetIndexQuickly(i))
</span><span class="cx">                 object-&gt;setIndexQuickly(vm, i, value);
</span><span class="cx">             else
</span><del>-                object-&gt;methodTable()-&gt;putByIndex(object, exec, i, value, exec-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+                object-&gt;methodTable()-&gt;putByIndex(object, exec, i, value, isStrictMode);
</ins><span class="cx">             LLINT_END();
</span><span class="cx">         }
</span><del>-        baseValue.putByIndex(exec, i, value, exec-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+        baseValue.putByIndex(exec, i, value, isStrictMode);
</ins><span class="cx">         LLINT_END();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     auto property = subscript.toPropertyKey(exec);
</span><span class="cx">     LLINT_CHECK_EXCEPTION();
</span><del>-    PutPropertySlot slot(baseValue, exec-&gt;codeBlock()-&gt;isStrictMode());
</del><ins>+    PutPropertySlot slot(baseValue, isStrictMode);
</ins><span class="cx">     baseValue.put(exec, property, value, slot);
</span><span class="cx">     LLINT_END();
</span><span class="cx"> }
</span><span class="lines">@@ -1186,6 +1191,7 @@
</span><span class="cx">     
</span><span class="cx">     ExecState* exec = execCallee-&gt;callerFrame();
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     execCallee-&gt;setCodeBlock(0);
</span><span class="cx">     execCallee-&gt;clearReturnPC();
</span><span class="lines">@@ -1238,6 +1244,8 @@
</span><span class="cx"> inline SlowPathReturnType setUpCall(ExecState* execCallee, Instruction* pc, CodeSpecializationKind kind, JSValue calleeAsValue, LLIntCallLinkInfo* callLinkInfo = 0)
</span><span class="cx"> {
</span><span class="cx">     ExecState* exec = execCallee-&gt;callerFrame();
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx"> #if LLINT_SLOW_PATH_TRACING
</span><span class="cx">     dataLogF(&quot;Performing call with recorded PC = %p\n&quot;, exec-&gt;currentVPC());
</span><span class="lines">@@ -1244,12 +1252,12 @@
</span><span class="cx"> #endif
</span><span class="cx">     
</span><span class="cx">     JSCell* calleeAsFunctionCell = getJSFunction(calleeAsValue);
</span><del>-    if (!calleeAsFunctionCell)
</del><ins>+    if (!calleeAsFunctionCell) {
+        throwScope.release();
</ins><span class="cx">         return handleHostCall(execCallee, pc, calleeAsValue, kind);
</span><del>-    
</del><ins>+    }
</ins><span class="cx">     JSFunction* callee = jsCast&lt;JSFunction*&gt;(calleeAsFunctionCell);
</span><span class="cx">     JSScope* scope = callee-&gt;scopeUnchecked();
</span><del>-    VM&amp; vm = *scope-&gt;vm();
</del><span class="cx">     ExecutableBase* executable = callee-&gt;executable();
</span><span class="cx"> 
</span><span class="cx">     MacroAssemblerCodePtr codePtr;
</span><span class="lines">@@ -1335,6 +1343,7 @@
</span><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_call)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN_NO_SET_PC();
</span><ins>+    throwScope.release();
</ins><span class="cx">     return genericCall(exec, pc, CodeForCall);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1341,6 +1350,7 @@
</span><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_construct)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN_NO_SET_PC();
</span><ins>+    throwScope.release();
</ins><span class="cx">     return genericCall(exec, pc, CodeForConstruct);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1498,6 +1508,7 @@
</span><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_handle_exception)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN_NO_SET_PC();
</span><ins>+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     genericUnwind(&amp;vm, exec);
</span><span class="cx">     LLINT_END_IMPL();
</span><span class="cx"> }
</span><span class="lines">@@ -1505,7 +1516,6 @@
</span><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_get_from_scope)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN();
</span><del>-
</del><span class="cx">     const Identifier&amp; ident = exec-&gt;codeBlock()-&gt;identifier(pc[3].u.operand);
</span><span class="cx">     JSObject* scope = jsCast&lt;JSObject*&gt;(LLINT_OP(2).jsValue());
</span><span class="cx">     GetPutInfo getPutInfo(pc[4].u.operand);
</span><span class="lines">@@ -1516,7 +1526,7 @@
</span><span class="cx">     LLINT_RETURN(scope-&gt;getPropertySlot(exec, ident, [&amp;] (bool found, PropertySlot&amp; slot) -&gt; JSValue {
</span><span class="cx">         if (!found) {
</span><span class="cx">             if (getPutInfo.resolveMode() == ThrowIfNotFound)
</span><del>-                return exec-&gt;vm().throwException(exec, createUndefinedVariableError(exec, ident));
</del><ins>+                return throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
</ins><span class="cx">             return jsUndefined();
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -1525,7 +1535,7 @@
</span><span class="cx">             // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
</span><span class="cx">             result = slot.getValue(exec, ident);
</span><span class="cx">             if (result == jsTDZValue())
</span><del>-                return exec-&gt;vm().throwException(exec, createTDZError(exec));
</del><ins>+                return throwException(exec, throwScope, createTDZError(exec));
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         CommonSlowPaths::tryCacheGetFromScopeGlobal(exec, vm, pc, scope, slot, ident);
</span><span class="lines">@@ -1582,9 +1592,9 @@
</span><span class="cx"> LLINT_SLOW_PATH_DECL(slow_path_check_if_exception_is_uncatchable_and_notify_profiler)
</span><span class="cx"> {
</span><span class="cx">     LLINT_BEGIN();
</span><del>-    RELEASE_ASSERT(!!vm.exception());
</del><ins>+    RELEASE_ASSERT(!!throwScope.exception());
</ins><span class="cx"> 
</span><del>-    if (isTerminatedExecutionException(vm.exception()))
</del><ins>+    if (isTerminatedExecutionException(throwScope.exception()))
</ins><span class="cx">         LLINT_RETURN_TWO(pc, bitwise_cast&lt;void*&gt;(static_cast&lt;uintptr_t&gt;(1)));
</span><span class="cx">     LLINT_RETURN_TWO(pc, 0);
</span><span class="cx"> }
</span><span class="lines">@@ -1619,9 +1629,11 @@
</span><span class="cx"> extern &quot;C&quot; SlowPathReturnType llint_throw_stack_overflow_error(VM* vm, ProtoCallFrame* protoFrame)
</span><span class="cx"> {
</span><span class="cx">     ExecState* exec = vm-&gt;topCallFrame;
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
</ins><span class="cx">     if (!exec)
</span><span class="cx">         exec = protoFrame-&gt;callee()-&gt;globalObject()-&gt;globalExec();
</span><del>-    throwStackOverflowError(exec);
</del><ins>+    throwStackOverflowError(exec, scope);
</ins><span class="cx">     return encodeResult(0, 0);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeArrayConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2003, 2007, 2008, 2011 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2003, 2007-2008, 2011, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
</span><span class="cx">  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
</span><span class="cx">  *
</span><span class="lines">@@ -73,18 +73,20 @@
</span><span class="cx"> 
</span><span class="cx"> // ------------------------------ Functions ---------------------------
</span><span class="cx"> 
</span><del>-JSObject* constructArrayWithSizeQuirk(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, JSValue length, JSValue newTarget)
</del><ins>+JSValue constructArrayWithSizeQuirk(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, JSValue length, JSValue newTarget)
</ins><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (!length.isNumber())
</span><span class="cx">         return constructArrayNegativeIndexed(exec, profile, globalObject, &amp;length, 1, newTarget);
</span><span class="cx">     
</span><span class="cx">     uint32_t n = length.toUInt32(exec);
</span><span class="cx">     if (n != length.toNumber(exec))
</span><del>-        return exec-&gt;vm().throwException(exec, createRangeError(exec, ASCIILiteral(&quot;Array size is not a small enough positive integer.&quot;)));
</del><ins>+        return throwException(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Array size is not a small enough positive integer.&quot;)));
</ins><span class="cx">     return constructEmptyArray(exec, profile, globalObject, n, newTarget);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList&amp; args, JSValue newTarget)
</del><ins>+static inline JSValue constructArrayWithSizeQuirk(ExecState* exec, const ArgList&amp; args, JSValue newTarget)
</ins><span class="cx"> {
</span><span class="cx">     JSGlobalObject* globalObject = asInternalFunction(exec-&gt;callee())-&gt;globalObject();
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeArrayConstructorh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayConstructor.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayConstructor.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayConstructor.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2007, 2008, 2011 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2007-2008, 2011, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -23,6 +23,7 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;InternalFunction.h&quot;
</span><span class="cx"> #include &quot;ProxyObject.h&quot;
</span><ins>+#include &quot;ThrowScope.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="lines">@@ -60,7 +61,7 @@
</span><span class="cx">     static CallType getCallData(JSCell*, CallData&amp;);
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-JSObject* constructArrayWithSizeQuirk(ExecState*, ArrayAllocationProfile*, JSGlobalObject*, JSValue length, JSValue prototype = JSValue());
</del><ins>+JSValue constructArrayWithSizeQuirk(ExecState*, ArrayAllocationProfile*, JSGlobalObject*, JSValue length, JSValue prototype = JSValue());
</ins><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayConstructorPrivateFuncIsArrayConstructor(ExecState*);
</span><span class="cx"> 
</span><span class="lines">@@ -68,6 +69,9 @@
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-isarray
</span><span class="cx"> inline bool isArray(ExecState* exec, JSValue argumentValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!argumentValue.isObject())
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -81,7 +85,7 @@
</span><span class="cx"> 
</span><span class="cx">         ProxyObject* proxy = jsCast&lt;ProxyObject*&gt;(argument);
</span><span class="cx">         if (proxy-&gt;isRevoked()) {
</span><del>-            throwTypeError(exec, ASCIILiteral(&quot;Array.isArray cannot be called on a Proxy that has been revoked&quot;));
</del><ins>+            throwTypeError(exec, scope, ASCIILiteral(&quot;Array.isArray cannot be called on a Proxy that has been revoked&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         argument = proxy-&gt;target();
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeArrayPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ArrayPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -265,6 +265,9 @@
</span><span class="cx"> template&lt;JSArray::ShiftCountMode shiftCountMode&gt;
</span><span class="cx"> void shift(ExecState* exec, JSObject* thisObj, unsigned header, unsigned currentCount, unsigned resultCount, unsigned length)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RELEASE_ASSERT(currentCount &gt; resultCount);
</span><span class="cx">     unsigned count = currentCount - resultCount;
</span><span class="cx"> 
</span><span class="lines">@@ -286,14 +289,14 @@
</span><span class="cx">             thisObj-&gt;putByIndexInline(exec, to, value, true);
</span><span class="cx">             if (exec-&gt;hadException())
</span><span class="cx">                 return;
</span><del>-        } else if (!thisObj-&gt;methodTable(exec-&gt;vm())-&gt;deletePropertyByIndex(thisObj, exec, to)) {
-            throwTypeError(exec, ASCIILiteral(&quot;Unable to delete property.&quot;));
</del><ins>+        } else if (!thisObj-&gt;methodTable(vm)-&gt;deletePropertyByIndex(thisObj, exec, to)) {
+            throwTypeError(exec, scope, ASCIILiteral(&quot;Unable to delete property.&quot;));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx">     for (unsigned k = length; k &gt; length - count; --k) {
</span><del>-        if (!thisObj-&gt;methodTable(exec-&gt;vm())-&gt;deletePropertyByIndex(thisObj, exec, k - 1)) {
-            throwTypeError(exec, ASCIILiteral(&quot;Unable to delete property.&quot;));
</del><ins>+        if (!thisObj-&gt;methodTable(vm)-&gt;deletePropertyByIndex(thisObj, exec, k - 1)) {
+            throwTypeError(exec, scope, ASCIILiteral(&quot;Unable to delete property.&quot;));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -302,6 +305,9 @@
</span><span class="cx"> template&lt;JSArray::ShiftCountMode shiftCountMode&gt;
</span><span class="cx"> void unshift(ExecState* exec, JSObject* thisObj, unsigned header, unsigned currentCount, unsigned resultCount, unsigned length)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RELEASE_ASSERT(resultCount &gt; currentCount);
</span><span class="cx">     unsigned count = resultCount - currentCount;
</span><span class="cx"> 
</span><span class="lines">@@ -310,7 +316,7 @@
</span><span class="cx"> 
</span><span class="cx">     // Guard against overflow.
</span><span class="cx">     if (count &gt; (UINT_MAX - length)) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -327,8 +333,8 @@
</span><span class="cx">             if (exec-&gt;hadException())
</span><span class="cx">                 return;
</span><span class="cx">             thisObj-&gt;putByIndexInline(exec, to, value, true);
</span><del>-        } else if (!thisObj-&gt;methodTable(exec-&gt;vm())-&gt;deletePropertyByIndex(thisObj, exec, to)) {
-            throwTypeError(exec, ASCIILiteral(&quot;Unable to delete property.&quot;));
</del><ins>+        } else if (!thisObj-&gt;methodTable(vm)-&gt;deletePropertyByIndex(thisObj, exec, to)) {
+            throwTypeError(exec, scope, ASCIILiteral(&quot;Unable to delete property.&quot;));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         if (exec-&gt;hadException())
</span><span class="lines">@@ -361,7 +367,7 @@
</span><span class="cx">         customJoinCase = true;
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(customJoinCase))
</span><del>-        return JSValue::encode(jsMakeNontrivialString(exec, &quot;[object &quot;, thisObject-&gt;methodTable(exec-&gt;vm())-&gt;className(thisObject), &quot;]&quot;));
</del><ins>+        return JSValue::encode(jsMakeNontrivialString(exec, &quot;[object &quot;, thisObject-&gt;methodTable(vm)-&gt;className(thisObject), &quot;]&quot;));
</ins><span class="cx"> 
</span><span class="cx">     // 4. Return the result of calling the [[Call]] internal method of func providing array as the this value and an empty arguments list.
</span><span class="cx">     if (!isJSArray(thisObject) || callType != CallType::Host || callData.native.function != arrayProtoFuncJoin)
</span><span class="lines">@@ -674,6 +680,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue().toThis(exec, StrictMode);
</span><span class="cx"> 
</span><span class="cx">     if (isJSArray(thisValue))
</span><span class="lines">@@ -694,8 +703,8 @@
</span><span class="cx">         result = thisObj-&gt;get(exec, length - 1);
</span><span class="cx">         if (exec-&gt;hadException())
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><del>-        if (!thisObj-&gt;methodTable(exec-&gt;vm())-&gt;deletePropertyByIndex(thisObj, exec, length - 1)) {
-            throwTypeError(exec, ASCIILiteral(&quot;Unable to delete property.&quot;));
</del><ins>+        if (!thisObj-&gt;methodTable(vm)-&gt;deletePropertyByIndex(thisObj, exec, length - 1)) {
+            throwTypeError(exec, scope, ASCIILiteral(&quot;Unable to delete property.&quot;));
</ins><span class="cx">             return JSValue::encode(jsUndefined());
</span><span class="cx">         }
</span><span class="cx">         putLength(exec, thisObj, jsNumber(length - 1));
</span><span class="lines">@@ -740,11 +749,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSObject* thisObject = exec-&gt;thisValue().toThis(exec, StrictMode).toObject(exec);
</span><span class="cx">     if (!thisObject)
</span><span class="cx">         return JSValue::encode(JSValue());
</span><span class="cx"> 
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     unsigned length = getLength(exec, thisObject);
</span><span class="cx">     if (vm.exception())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -812,7 +823,7 @@
</span><span class="cx">                 return JSValue::encode(JSValue());
</span><span class="cx">         } else if (!thisObject-&gt;methodTable(vm)-&gt;deletePropertyByIndex(thisObject, exec, lower)) {
</span><span class="cx">             if (!vm.exception())
</span><del>-                throwTypeError(exec, ASCIILiteral(&quot;Unable to delete property.&quot;));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(&quot;Unable to delete property.&quot;));
</ins><span class="cx">             return JSValue::encode(JSValue());
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -822,7 +833,7 @@
</span><span class="cx">                 return JSValue::encode(JSValue());
</span><span class="cx">         } else if (!thisObject-&gt;methodTable(vm)-&gt;deletePropertyByIndex(thisObject, exec, upper)) {
</span><span class="cx">             if (!vm.exception())
</span><del>-                throwTypeError(exec, ASCIILiteral(&quot;Unable to delete property.&quot;));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(&quot;Unable to delete property.&quot;));
</ins><span class="cx">             return JSValue::encode(JSValue());
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -902,6 +913,7 @@
</span><span class="cx">     // 15.4.4.12
</span><span class="cx"> 
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSObject* thisObj = exec-&gt;thisValue().toThis(exec, StrictMode).toObject(exec);
</span><span class="cx">     if (!thisObj)
</span><span class="lines">@@ -966,7 +978,7 @@
</span><span class="cx">         } else {
</span><span class="cx">             result = JSArray::tryCreateUninitialized(vm, exec-&gt;lexicalGlobalObject()-&gt;arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), deleteCount);
</span><span class="cx">             if (!result)
</span><del>-                return JSValue::encode(throwOutOfMemoryError(exec));
</del><ins>+                return JSValue::encode(throwOutOfMemoryError(exec, scope));
</ins><span class="cx">             
</span><span class="cx">             for (unsigned k = 0; k &lt; deleteCount; ++k) {
</span><span class="cx">                 JSValue v = getProperty(exec, thisObj, k + begin);
</span><span class="lines">@@ -1123,6 +1135,8 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue concatAppendOne(ExecState* exec, VM&amp; vm, JSArray* first, JSValue second)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT(!isJSArray(second));
</span><span class="cx">     ASSERT(!shouldUseSlowPut(first-&gt;indexingType()));
</span><span class="cx">     Butterfly* firstButterfly = first-&gt;butterfly();
</span><span class="lines">@@ -1135,7 +1149,7 @@
</span><span class="cx">     Structure* resultStructure = exec-&gt;lexicalGlobalObject()-&gt;arrayStructureForIndexingTypeDuringAllocation(type);
</span><span class="cx">     JSArray* result = JSArray::create(vm, resultStructure, firstArraySize + 1);
</span><span class="cx">     if (!result)
</span><del>-        return JSValue::encode(throwOutOfMemoryError(exec));
</del><ins>+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
</ins><span class="cx"> 
</span><span class="cx">     if (!result-&gt;appendMemcpy(exec, vm, 0, first)) {
</span><span class="cx">         if (!moveElements(exec, vm, result, 0, first, firstArraySize)) {
</span><span class="lines">@@ -1154,6 +1168,7 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(exec-&gt;argumentCount() == 2);
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSArray* firstArray = jsCast&lt;JSArray*&gt;(exec-&gt;uncheckedArgument(0));
</span><span class="cx"> 
</span><span class="lines">@@ -1197,7 +1212,7 @@
</span><span class="cx">     Structure* resultStructure = exec-&gt;lexicalGlobalObject()-&gt;arrayStructureForIndexingTypeDuringAllocation(type);
</span><span class="cx">     JSArray* result = JSArray::tryCreateUninitialized(vm, resultStructure, firstArraySize + secondArraySize);
</span><span class="cx">     if (!result)
</span><del>-        return JSValue::encode(throwOutOfMemoryError(exec));
</del><ins>+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
</ins><span class="cx"> 
</span><span class="cx">     if (type == ArrayWithDouble) {
</span><span class="cx">         double* buffer = result-&gt;butterfly()-&gt;contiguousDouble().data();
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeBooleanPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/BooleanPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/BooleanPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/BooleanPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2003, 2008, 2011 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2003, 2008, 2011, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -68,6 +68,7 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (thisValue == jsBoolean(false))
</span><span class="cx">         return JSValue::encode(vm-&gt;smallStrings.falseString());
</span><span class="lines">@@ -76,7 +77,7 @@
</span><span class="cx">         return JSValue::encode(vm-&gt;smallStrings.trueString());
</span><span class="cx"> 
</span><span class="cx">     if (!thisValue.inherits(BooleanObject::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     if (asBooleanObject(thisValue)-&gt;internalValue() == jsBoolean(false))
</span><span class="cx">         return JSValue::encode(vm-&gt;smallStrings.falseString());
</span><span class="lines">@@ -87,12 +88,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (thisValue.isBoolean())
</span><span class="cx">         return JSValue::encode(thisValue);
</span><span class="cx"> 
</span><span class="cx">     if (!thisValue.inherits(BooleanObject::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(asBooleanObject(thisValue)-&gt;internalValue());
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeCommonSlowPathscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -91,7 +91,8 @@
</span><span class="cx"> #define END_IMPL() RETURN_TWO(pc, exec)
</span><span class="cx"> 
</span><span class="cx"> #define THROW(exceptionToThrow) do {                        \
</span><del>-        vm.throwException(exec, exceptionToThrow);          \
</del><ins>+        auto scope = DECLARE_THROW_SCOPE(vm);               \
+        throwException(exec, scope, exceptionToThrow);      \
</ins><span class="cx">         RETURN_TO_THROW(exec, pc);                          \
</span><span class="cx">         END_IMPL();                                         \
</span><span class="cx">     } while (false)
</span><span class="lines">@@ -140,13 +141,6 @@
</span><span class="cx"> 
</span><span class="cx"> #define CALL_END_IMPL(exec, callTarget) RETURN_TWO((callTarget), (exec))
</span><span class="cx"> 
</span><del>-#define CALL_THROW(exec, pc, exceptionToThrow) do {                     \
-        ExecState* ctExec = (exec);                                     \
-        Instruction* ctPC = (pc);                                       \
-        vm.throwException(exec, exceptionToThrow);                      \
-        CALL_END_IMPL(ctExec, LLInt::callToThrow(ctExec));              \
-    } while (false)
-
</del><span class="cx"> #define CALL_CHECK_EXCEPTION(exec, pc) do {                          \
</span><span class="cx">         ExecState* cceExec = (exec);                                 \
</span><span class="cx">         Instruction* ccePC = (pc);                                   \
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeCommonSlowPathsh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPaths.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPaths.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPaths.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -73,8 +73,10 @@
</span><span class="cx"> 
</span><span class="cx"> inline bool opIn(ExecState* exec, JSValue propName, JSValue baseVal)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (!baseVal.isObject()) {
</span><del>-        exec-&gt;vm().throwException(exec, createInvalidInParameterError(exec, baseVal));
</del><ins>+        throwException(exec, scope, createInvalidInParameterError(exec, baseVal));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -85,7 +87,7 @@
</span><span class="cx">         return baseObj-&gt;hasProperty(exec, i);
</span><span class="cx"> 
</span><span class="cx">     auto property = propName.toPropertyKey(exec);
</span><del>-    if (exec-&gt;vm().exception())
</del><ins>+    if (vm.exception())
</ins><span class="cx">         return false;
</span><span class="cx">     return baseObj-&gt;hasProperty(exec, property);
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeCommonSlowPathsExceptionscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,7 +38,9 @@
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><span class="cx">     NativeCallFrameTracer tracer(vm, exec);
</span><del>-    vm-&gt;throwException(exec, error);
</del><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
+
+    throwException(exec, scope, error);
</ins><span class="cx"> #if LLINT_SLOW_PATH_TRACING
</span><span class="cx">     dataLog(&quot;Throwing exception &quot;, vm-&gt;exception(), &quot;.\n&quot;);
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeConstructDatacpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ConstructData.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ConstructData.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ConstructData.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2008, 2016 Apple Inc. All Rights Reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -37,10 +37,13 @@
</span><span class="cx"> 
</span><span class="cx"> JSObject* construct(ExecState* exec, JSValue constructorObject, const ArgList&amp; args, const char* errorMessage)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ConstructData constructData;
</span><span class="cx">     ConstructType constructType = getConstructData(constructorObject, constructData);
</span><span class="cx">     if (constructType == ConstructType::None)
</span><del>-        return throwTypeError(exec, errorMessage);
</del><ins>+        return throwTypeError(exec, scope, errorMessage);
</ins><span class="cx"> 
</span><span class="cx">     return construct(exec, constructorObject, constructType, constructData, args, constructorObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeDatePrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/DatePrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/DatePrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/DatePrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2004-2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *  Copyright (C) 2008, 2009 Torch Mobile, Inc. All rights reserved.
</span><span class="cx">  *  Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
</span><span class="cx">  *
</span><span class="lines">@@ -320,9 +320,10 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue formateDateInstance(ExecState* exec, DateTimeFormat format, bool asUTCVariant)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue);
</span><span class="cx"> 
</span><span class="lines">@@ -522,13 +523,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx">     if (!std::isfinite(thisDateObj-&gt;internalNumber()))
</span><del>-        return throwVMError(exec, createRangeError(exec, ASCIILiteral(&quot;Invalid Date&quot;)));
</del><ins>+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Invalid Date&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     const GregorianDateTime* gregorianDateTime = thisDateObj-&gt;gregorianDateTimeUTC(exec);
</span><span class="cx">     if (!gregorianDateTime)
</span><span class="lines">@@ -568,9 +570,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx">     return JSValue::encode(formatLocaleDate(exec, thisDateObj, thisDateObj-&gt;internalNumber(), LocaleDateAndTime));
</span><span class="lines">@@ -578,9 +581,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx">     return JSValue::encode(formatLocaleDate(exec, thisDateObj, thisDateObj-&gt;internalNumber(), LocaleDate));
</span><span class="lines">@@ -588,9 +592,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx">     return JSValue::encode(formatLocaleDate(exec, thisDateObj, thisDateObj-&gt;internalNumber(), LocaleTime));
</span><span class="lines">@@ -598,13 +603,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToPrimitiveSymbol(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, &quot;Date.prototype[Symbol.toPrimitive] expected |this| to be an object.&quot;);
</del><ins>+        return throwVMTypeError(exec, scope, &quot;Date.prototype[Symbol.toPrimitive] expected |this| to be an object.&quot;);
</ins><span class="cx">     JSObject* thisObject = jsCast&lt;JSObject*&gt;(thisValue);
</span><span class="cx"> 
</span><span class="cx">     if (!exec-&gt;argumentCount())
</span><del>-        return throwVMTypeError(exec, &quot;Date.prototype[Symbol.toPrimitive] expected a first argument.&quot;);
</del><ins>+        return throwVMTypeError(exec, scope, &quot;Date.prototype[Symbol.toPrimitive] expected a first argument.&quot;);
</ins><span class="cx"> 
</span><span class="cx">     JSValue hintValue = exec-&gt;uncheckedArgument(0);
</span><span class="cx">     PreferredPrimitiveType type = toPreferredPrimitiveType(exec, hintValue);
</span><span class="lines">@@ -619,9 +625,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(asDateInstance(thisValue)-&gt;internalValue());
</span><span class="cx"> }
</span><span class="lines">@@ -628,9 +635,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -642,9 +650,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -656,9 +665,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -670,9 +680,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -684,9 +695,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -698,9 +710,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -712,9 +725,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -726,9 +740,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -740,9 +755,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -754,9 +770,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -768,9 +785,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -782,9 +800,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -796,9 +815,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -810,9 +830,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -824,9 +845,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx">     double milli = thisDateObj-&gt;internalNumber();
</span><span class="lines">@@ -840,9 +862,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx">     double milli = thisDateObj-&gt;internalNumber();
</span><span class="lines">@@ -856,9 +879,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -870,9 +894,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -884,9 +909,10 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue setNewValueFromTimeArgs(ExecState* exec, int numArgsToUse, WTF::TimeType inputTimeType)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue);
</span><span class="cx">     double milli = thisDateObj-&gt;internalNumber();
</span><span class="lines">@@ -923,9 +949,10 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue setNewValueFromDateArgs(ExecState* exec, int numArgsToUse, WTF::TimeType inputTimeType)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue);
</span><span class="cx">     if (!exec-&gt;argumentCount()) {
</span><span class="lines">@@ -1035,9 +1062,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue);
</span><span class="lines">@@ -1078,9 +1106,10 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(DateInstance::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     DateInstance* thisDateObj = asDateInstance(thisValue); 
</span><span class="cx"> 
</span><span class="lines">@@ -1094,6 +1123,7 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     JSObject* object = jsCast&lt;JSObject*&gt;(thisValue.toThis(exec, NotStrictMode));
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -1112,13 +1142,13 @@
</span><span class="cx">     CallData callData;
</span><span class="cx">     CallType callType = getCallData(toISOValue, callData);
</span><span class="cx">     if (callType == CallType::None)
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;toISOString is not a function&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;toISOString is not a function&quot;));
</ins><span class="cx"> 
</span><span class="cx">     JSValue result = call(exec, asObject(toISOValue), callType, callData, object, exec-&gt;emptyList());
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsNull());
</span><span class="cx">     if (result.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;toISOString did not return a primitive value&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;toISOString did not return a primitive value&quot;));
</ins><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeErrorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Error.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Error.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Error.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -198,34 +198,34 @@
</span><span class="cx">         || error-&gt;hasProperty(exec, Identifier::fromString(exec, sourceURLPropertyName));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState* exec, const char* constructorName)
</del><ins>+JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState* exec, ThrowScope&amp; scope, const char* constructorName)
</ins><span class="cx"> {
</span><del>-    return throwTypeError(exec, makeString(&quot;calling &quot;, constructorName, &quot; constructor without new is invalid&quot;));
</del><ins>+    return throwTypeError(exec, scope, makeString(&quot;calling &quot;, constructorName, &quot; constructor without new is invalid&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* throwTypeError(ExecState* exec)
</del><ins>+JSObject* throwTypeError(ExecState* exec, ThrowScope&amp; scope)
</ins><span class="cx"> {
</span><del>-    return exec-&gt;vm().throwException(exec, createTypeError(exec));
</del><ins>+    return throwException(exec, scope, createTypeError(exec));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* throwTypeError(ExecState* exec, ASCIILiteral errorMessage)
</del><ins>+JSObject* throwTypeError(ExecState* exec, ThrowScope&amp; scope, ASCIILiteral errorMessage)
</ins><span class="cx"> {
</span><del>-    return throwTypeError(exec, String(errorMessage));
</del><ins>+    return throwTypeError(exec, scope, String(errorMessage));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* throwTypeError(ExecState* exec, const String&amp; message)
</del><ins>+JSObject* throwTypeError(ExecState* exec, ThrowScope&amp; scope, const String&amp; message)
</ins><span class="cx"> {
</span><del>-    return exec-&gt;vm().throwException(exec, createTypeError(exec, message));
</del><ins>+    return throwException(exec, scope, createTypeError(exec, message));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* throwSyntaxError(ExecState* exec)
</del><ins>+JSObject* throwSyntaxError(ExecState* exec, ThrowScope&amp; scope)
</ins><span class="cx"> {
</span><del>-    return exec-&gt;vm().throwException(exec, createSyntaxError(exec, ASCIILiteral(&quot;Syntax error&quot;)));
</del><ins>+    return throwException(exec, scope, createSyntaxError(exec, ASCIILiteral(&quot;Syntax error&quot;)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* throwSyntaxError(ExecState* exec, const String&amp; message)
</del><ins>+JSObject* throwSyntaxError(ExecState* exec, ThrowScope&amp; scope, const String&amp; message)
</ins><span class="cx"> {
</span><del>-    return exec-&gt;vm().throwException(exec, createSyntaxError(exec, message));
</del><ins>+    return throwException(exec, scope, createSyntaxError(exec, message));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSObject* createError(ExecState* exec, const String&amp; message)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeErrorh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Error.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Error.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Error.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -27,6 +27,7 @@
</span><span class="cx"> #include &quot;InternalFunction.h&quot;
</span><span class="cx"> #include &quot;Interpreter.h&quot;
</span><span class="cx"> #include &quot;JSObject.h&quot;
</span><ins>+#include &quot;ThrowScope.h&quot;
</ins><span class="cx"> #include &lt;stdint.h&gt;
</span><span class="cx"> 
</span><span class="cx"> 
</span><span class="lines">@@ -71,21 +72,21 @@
</span><span class="cx"> // Methods to throw Errors.
</span><span class="cx"> 
</span><span class="cx"> // Convenience wrappers, create an throw an exception with a default message.
</span><del>-JS_EXPORT_PRIVATE JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState*, const char* constructorName);
-JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*);
-JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ASCIILiteral errorMessage);
-JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, const String&amp; errorMessage);
-JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*);
-JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*, const String&amp; errorMessage);
-inline JSObject* throwRangeError(ExecState* state, const String&amp; errorMessage) { return state-&gt;vm().throwException(state, createRangeError(state, errorMessage)); }
</del><ins>+JS_EXPORT_PRIVATE JSObject* throwConstructorCannotBeCalledAsFunctionTypeError(ExecState*, ThrowScope&amp;, const char* constructorName);
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&amp;);
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&amp;, ASCIILiteral errorMessage);
+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&amp;, const String&amp; errorMessage);
+JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*, ThrowScope&amp;);
+JS_EXPORT_PRIVATE JSObject* throwSyntaxError(ExecState*, ThrowScope&amp;, const String&amp; errorMessage);
+inline JSObject* throwRangeError(ExecState* state, ThrowScope&amp; scope, const String&amp; errorMessage) { return throwException(state, scope, createRangeError(state, errorMessage)); }
</ins><span class="cx"> 
</span><span class="cx"> // Convenience wrappers, wrap result as an EncodedJSValue.
</span><del>-inline void throwVMError(ExecState* exec, Exception* exception) { exec-&gt;vm().throwException(exec, exception); }
-inline EncodedJSValue throwVMError(ExecState* exec, JSValue error) { return JSValue::encode(exec-&gt;vm().throwException(exec, error)); }
-inline EncodedJSValue throwVMTypeError(ExecState* exec) { return JSValue::encode(throwTypeError(exec)); }
-inline EncodedJSValue throwVMTypeError(ExecState* exec, ASCIILiteral errorMessage) { return JSValue::encode(throwTypeError(exec, errorMessage)); }
-inline EncodedJSValue throwVMTypeError(ExecState* exec, const String&amp; errorMessage) { return JSValue::encode(throwTypeError(exec, errorMessage)); }
-inline EncodedJSValue throwVMRangeError(ExecState* state, const String&amp; errorMessage) { return JSValue::encode(throwRangeError(state, errorMessage)); }
</del><ins>+inline void throwVMError(ExecState* exec, ThrowScope&amp; scope, Exception* exception) { throwException(exec, scope, exception); }
+inline EncodedJSValue throwVMError(ExecState* exec, ThrowScope&amp; scope, JSValue error) { return JSValue::encode(throwException(exec, scope, error)); }
+inline EncodedJSValue throwVMTypeError(ExecState* exec, ThrowScope&amp; scope) { return JSValue::encode(throwTypeError(exec, scope)); }
+inline EncodedJSValue throwVMTypeError(ExecState* exec, ThrowScope&amp; scope, ASCIILiteral errorMessage) { return JSValue::encode(throwTypeError(exec, scope, errorMessage)); }
+inline EncodedJSValue throwVMTypeError(ExecState* exec, ThrowScope&amp; scope, const String&amp; errorMessage) { return JSValue::encode(throwTypeError(exec, scope, errorMessage)); }
+inline EncodedJSValue throwVMRangeError(ExecState* state, ThrowScope&amp; scope, const String&amp; errorMessage) { return JSValue::encode(throwRangeError(state, scope, errorMessage)); }
</ins><span class="cx"> 
</span><span class="cx"> class StrictModeTypeErrorFunction : public InternalFunction {
</span><span class="cx"> private:
</span><span class="lines">@@ -109,7 +110,9 @@
</span><span class="cx"> 
</span><span class="cx">     static EncodedJSValue JSC_HOST_CALL constructThrowTypeError(ExecState* exec)
</span><span class="cx">     {
</span><del>-        throwTypeError(exec, static_cast&lt;StrictModeTypeErrorFunction*&gt;(exec-&gt;callee())-&gt;m_message);
</del><ins>+        VM&amp; vm = exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        throwTypeError(exec, scope, static_cast&lt;StrictModeTypeErrorFunction*&gt;(exec-&gt;callee())-&gt;m_message);
</ins><span class="cx">         return JSValue::encode(jsNull());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -121,7 +124,9 @@
</span><span class="cx"> 
</span><span class="cx">     static EncodedJSValue JSC_HOST_CALL callThrowTypeError(ExecState* exec)
</span><span class="cx">     {
</span><del>-        throwTypeError(exec, static_cast&lt;StrictModeTypeErrorFunction*&gt;(exec-&gt;callee())-&gt;m_message);
</del><ins>+        VM&amp; vm = exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        throwTypeError(exec, scope, static_cast&lt;StrictModeTypeErrorFunction*&gt;(exec-&gt;callee())-&gt;m_message);
</ins><span class="cx">         return JSValue::encode(jsNull());
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeErrorPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ErrorPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ErrorPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ErrorPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -67,12 +67,15 @@
</span><span class="cx"> // ECMA-262 5.1, 15.11.4.4
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 1. Let O be the this value.
</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx"> 
</span><span class="cx">     // 2. If Type(O) is not Object, throw a TypeError exception.
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSObject* thisObj = asObject(thisValue);
</span><span class="cx"> 
</span><span class="cx">     // Guard against recursion!
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeExceptionFuzzcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionFuzz.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionFuzz.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionFuzz.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -38,9 +38,11 @@
</span><span class="cx"> // Call this only if you know that exception fuzzing is enabled.
</span><span class="cx"> void doExceptionFuzzing(ExecState* exec, const char* where, void* returnPC)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     ASSERT(Options::useExceptionFuzz());
</span><span class="cx"> 
</span><del>-    DeferGCForAWhile deferGC(exec-&gt;vm().heap);
</del><ins>+    DeferGCForAWhile deferGC(vm.heap);
</ins><span class="cx">     
</span><span class="cx">     s_numberOfExceptionFuzzChecks++;
</span><span class="cx">     
</span><span class="lines">@@ -47,8 +49,7 @@
</span><span class="cx">     unsigned fireTarget = Options::fireExceptionFuzzAt();
</span><span class="cx">     if (fireTarget == s_numberOfExceptionFuzzChecks) {
</span><span class="cx">         printf(&quot;JSC EXCEPTION FUZZ: Throwing fuzz exception with call frame %p, seen in %s and return address %p.\n&quot;, exec, where, returnPC);
</span><del>-        exec-&gt;vm().throwException(
-            exec, createError(exec, ASCIILiteral(&quot;Exception Fuzz&quot;)));
</del><ins>+        throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Exception Fuzz&quot;)));
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeExceptionHelperscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionHelpers.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008-2009, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -289,23 +289,23 @@
</span><span class="cx">     return createReferenceError(exec, &quot;Cannot access uninitialized variable.&quot;);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* throwOutOfMemoryError(ExecState* exec)
</del><ins>+JSObject* throwOutOfMemoryError(ExecState* exec, ThrowScope&amp; scope)
</ins><span class="cx"> {
</span><del>-    return exec-&gt;vm().throwException(exec, createOutOfMemoryError(exec));
</del><ins>+    return throwException(exec, scope, createOutOfMemoryError(exec));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* throwStackOverflowError(ExecState* exec)
</del><ins>+JSObject* throwStackOverflowError(ExecState* exec, ThrowScope&amp; scope)
</ins><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     ErrorHandlingScope errorScope(vm);
</span><del>-    return vm.throwException(exec, createStackOverflowError(exec));
</del><ins>+    return throwException(exec, scope, createStackOverflowError(exec));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* throwTerminatedExecutionException(ExecState* exec)
</del><ins>+JSObject* throwTerminatedExecutionException(ExecState* exec, ThrowScope&amp; scope)
</ins><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     ErrorHandlingScope errorScope(vm);
</span><del>-    return vm.throwException(exec, createTerminatedExecutionException(&amp;vm));
</del><ins>+    return throwException(exec, scope, createTerminatedExecutionException(&amp;vm));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeExceptionHelpersh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionHelpers.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionHelpers.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ExceptionHelpers.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -31,6 +31,7 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;ErrorInstance.h&quot;
</span><span class="cx"> #include &quot;JSObject.h&quot;
</span><ins>+#include &quot;ThrowScope.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><span class="lines">@@ -52,9 +53,9 @@
</span><span class="cx"> JSObject* createErrorForInvalidGlobalAssignment(ExecState*, const String&amp;);
</span><span class="cx"> JSString* errorDescriptionForValue(ExecState*, JSValue);
</span><span class="cx"> 
</span><del>-JS_EXPORT_PRIVATE JSObject* throwOutOfMemoryError(ExecState*);
-JS_EXPORT_PRIVATE JSObject* throwStackOverflowError(ExecState*);
-JS_EXPORT_PRIVATE JSObject* throwTerminatedExecutionException(ExecState*);
</del><ins>+JS_EXPORT_PRIVATE JSObject* throwOutOfMemoryError(ExecState*, ThrowScope&amp;);
+JS_EXPORT_PRIVATE JSObject* throwStackOverflowError(ExecState*, ThrowScope&amp;);
+JS_EXPORT_PRIVATE JSObject* throwTerminatedExecutionException(ExecState*, ThrowScope&amp;);
</ins><span class="cx"> 
</span><span class="cx"> 
</span><span class="cx"> class TerminatedExecutionError final : public JSNonFinalObject {
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeExecutablecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Executable.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Executable.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Executable.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -268,6 +268,7 @@
</span><span class="cx">     CodeSpecializationKind kind, JSFunction* function, JSScope* scope, JSObject*&amp; exception)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = scope-&gt;vm();
</span><ins>+    auto throwScope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx"> 
</span><span class="cx">     ASSERT(vm-&gt;heap.isDeferred());
</span><span class="cx">     ASSERT(startColumn() != UINT_MAX);
</span><span class="lines">@@ -319,8 +320,8 @@
</span><span class="cx">         executable-&gt;m_unlinkedExecutable-&gt;hasCapturedVariables(), firstLine(), 
</span><span class="cx">         lastLine(), startColumn(), endColumn()); 
</span><span class="cx">     if (!unlinkedCodeBlock) {
</span><del>-        exception = vm-&gt;throwException(
-            globalObject-&gt;globalExec(),
</del><ins>+        exception = throwException(
+            globalObject-&gt;globalExec(), throwScope,
</ins><span class="cx">             error.toErrorObject(globalObject, executable-&gt;m_source));
</span><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="lines">@@ -429,20 +430,23 @@
</span><span class="cx"> 
</span><span class="cx"> EvalExecutable* EvalExecutable::create(ExecState* exec, const SourceCode&amp; source, bool isInStrictContext, DerivedContextType derivedContextType, bool isArrowFunctionContext, EvalContextType evalContextType, const VariableEnvironment* variablesUnderTDZ)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSGlobalObject* globalObject = exec-&gt;lexicalGlobalObject();
</span><span class="cx">     if (!globalObject-&gt;evalEnabled()) {
</span><del>-        exec-&gt;vm().throwException(exec, createEvalError(exec, globalObject-&gt;evalDisabledErrorMessage()));
</del><ins>+        throwException(exec, scope, createEvalError(exec, globalObject-&gt;evalDisabledErrorMessage()));
</ins><span class="cx">         return 0;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     EvalExecutable* executable = new (NotNull, allocateCell&lt;EvalExecutable&gt;(*exec-&gt;heap())) EvalExecutable(exec, source, isInStrictContext, derivedContextType, isArrowFunctionContext, evalContextType);
</span><del>-    executable-&gt;finishCreation(exec-&gt;vm());
</del><ins>+    executable-&gt;finishCreation(vm);
</ins><span class="cx"> 
</span><span class="cx">     UnlinkedEvalCodeBlock* unlinkedEvalCode = globalObject-&gt;createEvalCodeBlock(exec, executable, variablesUnderTDZ);
</span><span class="cx">     if (!unlinkedEvalCode)
</span><span class="cx">         return 0;
</span><span class="cx"> 
</span><del>-    executable-&gt;m_unlinkedEvalCodeBlock.set(exec-&gt;vm(), executable, unlinkedEvalCode);
</del><ins>+    executable-&gt;m_unlinkedEvalCodeBlock.set(vm, executable, unlinkedEvalCode);
</ins><span class="cx"> 
</span><span class="cx">     return executable;
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeFunctionConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/FunctionConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/FunctionConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/FunctionConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2013 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2003-2008, 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -76,8 +76,11 @@
</span><span class="cx"> // ECMA 15.3.2 The Function Constructor
</span><span class="cx"> JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList&amp; args, const Identifier&amp; functionName, const String&amp; sourceURL, const TextPosition&amp; position, FunctionConstructionMode functionConstructionMode, JSValue newTarget)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!globalObject-&gt;evalEnabled())
</span><del>-        return exec-&gt;vm().throwException(exec, createEvalError(exec, globalObject-&gt;evalDisabledErrorMessage()));
</del><ins>+        return throwException(exec, scope, createEvalError(exec, globalObject-&gt;evalDisabledErrorMessage()));
</ins><span class="cx">     return constructFunctionSkippingEvalEnabledCheck(exec, globalObject, args, functionName, sourceURL, position, -1, functionConstructionMode, newTarget);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -86,6 +89,9 @@
</span><span class="cx">     const Identifier&amp; functionName, const String&amp; sourceURL, 
</span><span class="cx">     const TextPosition&amp; position, int overrideLineNumber, FunctionConstructionMode functionConstructionMode, JSValue newTarget)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // How we stringify functions is sometimes important for web compatibility.
</span><span class="cx">     // See https://bugs.webkit.org/show_bug.cgi?id=24350.
</span><span class="cx">     String program;
</span><span class="lines">@@ -116,7 +122,7 @@
</span><span class="cx">     FunctionExecutable* function = FunctionExecutable::fromGlobalCode(functionName, *exec, source, exception, overrideLineNumber);
</span><span class="cx">     if (!function) {
</span><span class="cx">         ASSERT(exception);
</span><del>-        return exec-&gt;vm().throwException(exec, exception);
</del><ins>+        return throwException(exec, scope, exception);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     Structure* subclassStructure = InternalFunction::createSubclassStructure(exec, newTarget, globalObject-&gt;functionStructure());
</span><span class="lines">@@ -123,7 +129,7 @@
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return nullptr;
</span><span class="cx"> 
</span><del>-    return JSFunction::create(exec-&gt;vm(), function, globalObject-&gt;globalScope(), subclassStructure);
</del><ins>+    return JSFunction::create(vm, function, globalObject-&gt;globalScope(), subclassStructure);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // ECMA 15.3.2 The Function Constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeFunctionPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/FunctionPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/FunctionPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/FunctionPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -83,6 +83,8 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (thisValue.inherits(JSFunction::info())) {
</span><span class="cx">         JSFunction* function = jsCast&lt;JSFunction*&gt;(thisValue);
</span><span class="lines">@@ -112,7 +114,7 @@
</span><span class="cx">         JSObject* object = asObject(thisValue);
</span><span class="cx">         if (object-&gt;inlineTypeFlags() &amp; TypeOfShouldCallGetCallData) {
</span><span class="cx">             CallData callData;
</span><del>-            if (object-&gt;methodTable(exec-&gt;vm())-&gt;getCallData(object, callData) != CallType::None) {
</del><ins>+            if (object-&gt;methodTable(vm)-&gt;getCallData(object, callData) != CallType::None) {
</ins><span class="cx">                 if (auto* classInfo = object-&gt;classInfo())
</span><span class="cx">                     return JSValue::encode(jsMakeNontrivialString(exec, &quot;function &quot;, classInfo-&gt;className, &quot;() {\n    [native code]\n}&quot;));
</span><span class="cx">             }
</span><span class="lines">@@ -119,12 +121,14 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return throwVMTypeError(exec);
</del><ins>+    return throwVMTypeError(exec, scope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // 15.3.4.5 Function.prototype.bind (thisArg [, arg1 [, arg2, ...]])
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL functionProtoFuncBind(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSGlobalObject* globalObject = exec-&gt;callee()-&gt;globalObject();
</span><span class="cx"> 
</span><span class="cx">     // Let Target be the this value.
</span><span class="lines">@@ -134,11 +138,10 @@
</span><span class="cx">     CallData callData;
</span><span class="cx">     CallType callType = getCallData(target, callData);
</span><span class="cx">     if (callType == CallType::None)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     // Primitive values are not callable.
</span><span class="cx">     ASSERT(target.isObject());
</span><span class="cx">     JSObject* targetObject = asObject(target);
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx"> 
</span><span class="cx">     // Let A be a new (possibly empty) internal list of all of the argument values provided after thisArg (arg1, arg2 etc), in order.
</span><span class="cx">     size_t numBoundArgs = exec-&gt;argumentCount() &gt; 1 ? exec-&gt;argumentCount() - 1 : 0;
</span><span class="lines">@@ -146,7 +149,7 @@
</span><span class="cx">     if (numBoundArgs) {
</span><span class="cx">         boundArgs = JSArray::tryCreateUninitialized(vm, globalObject-&gt;arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous), numBoundArgs);
</span><span class="cx">         if (!boundArgs)
</span><del>-            return JSValue::encode(throwOutOfMemoryError(exec));
</del><ins>+            return JSValue::encode(throwOutOfMemoryError(exec, scope));
</ins><span class="cx">         
</span><span class="cx">         for (size_t i = 0; i &lt; numBoundArgs; ++i)
</span><span class="cx">             boundArgs-&gt;initializeIndex(vm, i, exec-&gt;argument(i + 1));
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeGetterSettercpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/GetterSetter.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/GetterSetter.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/GetterSetter.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
</span><span class="cx">  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
</span><del>- *  Copyright (C) 2004, 2007, 2008, 2009, 2014 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2004, 2007-2009, 2014, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -87,11 +87,14 @@
</span><span class="cx"> 
</span><span class="cx"> bool callSetter(ExecState* exec, JSValue base, JSValue getterSetter, JSValue value, ECMAMode ecmaMode)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     GetterSetter* getterSetterObj = jsCast&lt;GetterSetter*&gt;(getterSetter);
</span><span class="cx"> 
</span><span class="cx">     if (getterSetterObj-&gt;isSetterNull()) {
</span><span class="cx">         if (ecmaMode == StrictMode)
</span><del>-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -101,7 +104,7 @@
</span><span class="cx">     args.append(value);
</span><span class="cx"> 
</span><span class="cx">     CallData callData;
</span><del>-    CallType callType = setter-&gt;methodTable(exec-&gt;vm())-&gt;getCallData(setter, callData);
</del><ins>+    CallType callType = setter-&gt;methodTable(vm)-&gt;getCallData(setter, callData);
</ins><span class="cx">     call(exec, setter, callType, callData, base, args);
</span><span class="cx">     return true;
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlCollatorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlCollator.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlCollator.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlCollator.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -367,11 +367,14 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue IntlCollator::compareStrings(ExecState&amp; state, StringView x, StringView y)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 10.3.4 CompareStrings abstract operation (ECMA-402 2.0)
</span><span class="cx">     if (!m_collator) {
</span><span class="cx">         createCollator(state);
</span><span class="cx">         if (!m_collator)
</span><del>-            return state.vm().throwException(&amp;state, createError(&amp;state, ASCIILiteral(&quot;Failed to compare strings.&quot;)));
</del><ins>+            return throwException(&amp;state, scope, createError(&amp;state, ASCIILiteral(&quot;Failed to compare strings.&quot;)));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     UErrorCode status = U_ZERO_ERROR;
</span><span class="lines">@@ -379,7 +382,7 @@
</span><span class="cx">     UCharIterator iteratorY = createIterator(y);
</span><span class="cx">     auto result = ucol_strcollIter(m_collator.get(), &amp;iteratorX, &amp;iteratorY, &amp;status);
</span><span class="cx">     if (U_FAILURE(status))
</span><del>-        return state.vm().throwException(&amp;state, createError(&amp;state, ASCIILiteral(&quot;Failed to compare strings.&quot;)));
</del><ins>+        return throwException(&amp;state, scope, createError(&amp;state, ASCIILiteral(&quot;Failed to compare strings.&quot;)));
</ins><span class="cx">     return jsNumber(result);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlCollatorPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -106,16 +106,18 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL IntlCollatorPrototypeGetterCompare(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 10.3.3 Intl.Collator.prototype.compare (ECMA-402 2.0)
</span><span class="cx">     // 1. Let collator be this Collator object.
</span><span class="cx">     IntlCollator* collator = jsDynamicCast&lt;IntlCollator*&gt;(state-&gt;thisValue());
</span><span class="cx">     if (!collator)
</span><del>-        return JSValue::encode(throwTypeError(state, ASCIILiteral(&quot;Intl.Collator.prototype.compare called on value that's not an object initialized as a Collator&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral(&quot;Intl.Collator.prototype.compare called on value that's not an object initialized as a Collator&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     JSBoundFunction* boundCompare = collator-&gt;boundCompare();
</span><span class="cx">     // 2. If collator.[[boundCompare]] is undefined,
</span><span class="cx">     if (!boundCompare) {
</span><del>-        VM&amp; vm = state-&gt;vm();
</del><span class="cx">         JSGlobalObject* globalObject = collator-&gt;globalObject();
</span><span class="cx">         // a. Let F be a new built-in function object as defined in 11.3.4.
</span><span class="cx">         // b. The value of F’s length property is 2.
</span><span class="lines">@@ -134,10 +136,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL IntlCollatorPrototypeFuncResolvedOptions(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 10.3.5 Intl.Collator.prototype.resolvedOptions() (ECMA-402 2.0)
</span><span class="cx">     IntlCollator* collator = jsDynamicCast&lt;IntlCollator*&gt;(state-&gt;thisValue());
</span><span class="cx">     if (!collator)
</span><del>-        return JSValue::encode(throwTypeError(state, ASCIILiteral(&quot;Intl.Collator.prototype.resolvedOptions called on value that's not an object initialized as a Collator&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral(&quot;Intl.Collator.prototype.resolvedOptions called on value that's not an object initialized as a Collator&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(collator-&gt;resolvedOptions(*state));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlDateTimeFormatcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -420,6 +420,9 @@
</span><span class="cx"> 
</span><span class="cx"> void IntlDateTimeFormat::initializeDateTimeFormat(ExecState&amp; exec, JSValue locales, JSValue originalOptions)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 12.1.1 InitializeDateTimeFormat (dateTimeFormat, locales, options) (ECMA-402 2.0)
</span><span class="cx">     // 1. If dateTimeFormat.[[initializedIntlObject]] is true, throw a TypeError exception.
</span><span class="cx">     // 2. Set dateTimeFormat.[[initializedIntlObject]] to true.
</span><span class="lines">@@ -440,7 +443,6 @@
</span><span class="cx">     HashMap&lt;String, String&gt; localeOpt;
</span><span class="cx"> 
</span><span class="cx">     // 8. Let matcher be GetOption(options, &quot;localeMatcher&quot;, &quot;string&quot;, Â«&quot;lookup&quot;, &quot;best fit&quot;», &quot;best fit&quot;).
</span><del>-    VM&amp; vm = exec.vm();
</del><span class="cx">     String localeMatcher = intlStringOption(exec, options, vm.propertyNames-&gt;localeMatcher, { &quot;lookup&quot;, &quot;best fit&quot; }, &quot;localeMatcher must be either \&quot;lookup\&quot; or \&quot;best fit\&quot;&quot;, &quot;best fit&quot;);
</span><span class="cx">     // 9. ReturnIfAbrupt(matcher).
</span><span class="cx">     if (exec.hadException())
</span><span class="lines">@@ -487,7 +489,7 @@
</span><span class="cx">         // d. Let tz be CanonicalizeTimeZoneName(tz).
</span><span class="cx">         tz = canonicalizeTimeZoneName(originalTz);
</span><span class="cx">         if (tz.isNull()) {
</span><del>-            throwRangeError(&amp;exec, String::format(&quot;invalid time zone: %s&quot;, originalTz.utf8().data()));
</del><ins>+            throwRangeError(&amp;exec, scope, String::format(&quot;invalid time zone: %s&quot;, originalTz.utf8().data()));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     } else {
</span><span class="lines">@@ -647,7 +649,7 @@
</span><span class="cx">     UErrorCode status = U_ZERO_ERROR;
</span><span class="cx">     UDateTimePatternGenerator* generator = udatpg_open(dataLocale.utf8().data(), &amp;status);
</span><span class="cx">     if (U_FAILURE(status)) {
</span><del>-        throwTypeError(&amp;exec, ASCIILiteral(&quot;failed to initialize DateTimeFormat&quot;));
</del><ins>+        throwTypeError(&amp;exec, scope, ASCIILiteral(&quot;failed to initialize DateTimeFormat&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -663,7 +665,7 @@
</span><span class="cx">     }
</span><span class="cx">     udatpg_close(generator);
</span><span class="cx">     if (U_FAILURE(status)) {
</span><del>-        throwTypeError(&amp;exec, ASCIILiteral(&quot;failed to initialize DateTimeFormat&quot;));
</del><ins>+        throwTypeError(&amp;exec, scope, ASCIILiteral(&quot;failed to initialize DateTimeFormat&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -674,7 +676,7 @@
</span><span class="cx">     StringView timeZoneView(m_timeZone);
</span><span class="cx">     m_dateFormat = std::unique_ptr&lt;UDateFormat, UDateFormatDeleter&gt;(udat_open(UDAT_PATTERN, UDAT_PATTERN, m_locale.utf8().data(), timeZoneView.upconvertedCharacters(), timeZoneView.length(), pattern.upconvertedCharacters(), pattern.length(), &amp;status));
</span><span class="cx">     if (U_FAILURE(status)) {
</span><del>-        throwTypeError(&amp;exec, ASCIILiteral(&quot;failed to initialize DateTimeFormat&quot;));
</del><ins>+        throwTypeError(&amp;exec, scope, ASCIILiteral(&quot;failed to initialize DateTimeFormat&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -883,6 +885,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue IntlDateTimeFormat::format(ExecState&amp; exec, double value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 12.3.4 FormatDateTime abstract operation (ECMA-402 2.0)
</span><span class="cx">     if (!m_initializedDateTimeFormat) {
</span><span class="cx">         initializeDateTimeFormat(exec, jsUndefined(), jsUndefined());
</span><span class="lines">@@ -891,7 +896,7 @@
</span><span class="cx"> 
</span><span class="cx">     // 1. If x is not a finite Number, then throw a RangeError exception.
</span><span class="cx">     if (!std::isfinite(value))
</span><del>-        return throwRangeError(&amp;exec, ASCIILiteral(&quot;date value is not finite in DateTimeFormat format()&quot;));
</del><ins>+        return throwRangeError(&amp;exec, scope, ASCIILiteral(&quot;date value is not finite in DateTimeFormat format()&quot;));
</ins><span class="cx"> 
</span><span class="cx">     // Delegate remaining steps to ICU.
</span><span class="cx">     UErrorCode status = U_ZERO_ERROR;
</span><span class="lines">@@ -903,7 +908,7 @@
</span><span class="cx">         udat_format(m_dateFormat.get(), value, result.data(), resultLength, nullptr, &amp;status);
</span><span class="cx">     }
</span><span class="cx">     if (U_FAILURE(status))
</span><del>-        return throwTypeError(&amp;exec, ASCIILiteral(&quot;failed to format date value&quot;));
</del><ins>+        return throwTypeError(&amp;exec, scope, ASCIILiteral(&quot;failed to format date value&quot;));
</ins><span class="cx"> 
</span><span class="cx">     return jsString(&amp;exec, String(result.data(), resultLength));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -110,6 +111,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatPrototypeGetterFormat(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 12.3.3 Intl.DateTimeFormat.prototype.format (ECMA-402 2.0)
</span><span class="cx">     // 1. Let dtf be this DateTimeFormat object.
</span><span class="cx">     IntlDateTimeFormat* dtf = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(state-&gt;thisValue());
</span><span class="lines">@@ -117,16 +121,15 @@
</span><span class="cx">     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=153679
</span><span class="cx">     if (!dtf)
</span><del>-        dtf = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(state-&gt;thisValue().get(state, state-&gt;vm().propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName()));
</del><ins>+        dtf = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(state-&gt;thisValue().get(state, vm.propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName()));
</ins><span class="cx"> 
</span><span class="cx">     // 2. ReturnIfAbrupt(dtf).
</span><span class="cx">     if (!dtf)
</span><del>-        return JSValue::encode(throwTypeError(state, ASCIILiteral(&quot;Intl.DateTimeFormat.prototype.format called on value that's not an object initialized as a DateTimeFormat&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral(&quot;Intl.DateTimeFormat.prototype.format called on value that's not an object initialized as a DateTimeFormat&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     JSBoundFunction* boundFormat = dtf-&gt;boundFormat();
</span><span class="cx">     // 3. If the [[boundFormat]] internal slot of this DateTimeFormat object is undefined,
</span><span class="cx">     if (!boundFormat) {
</span><del>-        VM&amp; vm = state-&gt;vm();
</del><span class="cx">         JSGlobalObject* globalObject = dtf-&gt;globalObject();
</span><span class="cx">         // a. Let F be a new built-in function object as defined in 12.3.4.
</span><span class="cx">         // b. The value of F’s length property is 1. (Note: F’s length property was 0 in ECMA-402 1.0)
</span><span class="lines">@@ -133,7 +136,7 @@
</span><span class="cx">         JSFunction* targetObject = JSFunction::create(vm, globalObject, 1, ASCIILiteral(&quot;format&quot;), IntlDateTimeFormatFuncFormatDateTime, NoIntrinsic);
</span><span class="cx">         JSArray* boundArgs = JSArray::tryCreateUninitialized(vm, globalObject-&gt;arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), 0);
</span><span class="cx">         if (!boundArgs)
</span><del>-            return JSValue::encode(throwOutOfMemoryError(state));
</del><ins>+            return JSValue::encode(throwOutOfMemoryError(state, scope));
</ins><span class="cx"> 
</span><span class="cx">         // c. Let bf be BoundFunctionCreate(F, Â«this value»).
</span><span class="cx">         boundFormat = JSBoundFunction::create(vm, state, globalObject, targetObject, dtf, boundArgs, 1, ASCIILiteral(&quot;format&quot;));
</span><span class="lines">@@ -148,6 +151,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatPrototypeFuncResolvedOptions(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 12.3.5 Intl.DateTimeFormat.prototype.resolvedOptions() (ECMA-402 2.0)
</span><span class="cx">     IntlDateTimeFormat* dateTimeFormat = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(state-&gt;thisValue());
</span><span class="cx"> 
</span><span class="lines">@@ -154,10 +160,10 @@
</span><span class="cx">     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=153679
</span><span class="cx">     if (!dateTimeFormat)
</span><del>-        dateTimeFormat = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(state-&gt;thisValue().get(state, state-&gt;vm().propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName()));
</del><ins>+        dateTimeFormat = jsDynamicCast&lt;IntlDateTimeFormat*&gt;(state-&gt;thisValue().get(state, vm.propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName()));
</ins><span class="cx"> 
</span><span class="cx">     if (!dateTimeFormat)
</span><del>-        return JSValue::encode(throwTypeError(state, ASCIILiteral(&quot;Intl.DateTimeFormat.prototype.resolvedOptions called on value that's not an object initialized as a DateTimeFormat&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral(&quot;Intl.DateTimeFormat.prototype.resolvedOptions called on value that's not an object initialized as a DateTimeFormat&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(dateTimeFormat-&gt;resolvedOptions(*state));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlNumberFormatcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlNumberFormat.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2015 Andy VanWagoner (thetalecrafter@gmail.com)
</span><span class="cx">  * Copyright (C) 2016 Sukolsak Sakshuwong (sukolsak@gmail.com)
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -159,6 +160,7 @@
</span><span class="cx"> {
</span><span class="cx">     // 11.1.1 InitializeNumberFormat (numberFormat, locales, options) (ECMA-402 2.0)
</span><span class="cx">     VM&amp; vm = state.vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     // 1. If numberFormat has an [[initializedIntlObject]] internal slot with value true, throw a TypeError exception.
</span><span class="cx">     // 2. Set numberFormat.[[initializedIntlObject]] to true.
</span><span class="lines">@@ -186,7 +188,7 @@
</span><span class="cx">     HashMap&lt;String, String&gt; opt;
</span><span class="cx"> 
</span><span class="cx">     // 8. Let matcher be GetOption(options, &quot;localeMatcher&quot;, &quot;string&quot;, Â«&quot;lookup&quot;, &quot;best fit&quot;», &quot;best fit&quot;).
</span><del>-    String matcher = intlStringOption(state, options, state.vm().propertyNames-&gt;localeMatcher, { &quot;lookup&quot;, &quot;best fit&quot; }, &quot;localeMatcher must be either \&quot;lookup\&quot; or \&quot;best fit\&quot;&quot;, &quot;best fit&quot;);
</del><ins>+    String matcher = intlStringOption(state, options, vm.propertyNames-&gt;localeMatcher, { &quot;lookup&quot;, &quot;best fit&quot; }, &quot;localeMatcher must be either \&quot;lookup\&quot; or \&quot;best fit\&quot;&quot;, &quot;best fit&quot;);
</ins><span class="cx">     // 9. ReturnIfAbrupt(matcher).
</span><span class="cx">     if (state.hadException())
</span><span class="cx">         return;
</span><span class="lines">@@ -230,7 +232,7 @@
</span><span class="cx">     if (!currency.isNull()) {
</span><span class="cx">         // a. If the result of IsWellFormedCurrencyCode(c), is false, then throw a RangeError exception.
</span><span class="cx">         if (currency.length() != 3 || !currency.isAllSpecialCharacters&lt;isASCIIAlpha&gt;()) {
</span><del>-            state.vm().throwException(&amp;state, createRangeError(&amp;state, ASCIILiteral(&quot;currency is not a well-formed currency code&quot;)));
</del><ins>+            throwException(&amp;state, scope, createRangeError(&amp;state, ASCIILiteral(&quot;currency is not a well-formed currency code&quot;)));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -239,7 +241,7 @@
</span><span class="cx">     if (m_style == Style::Currency) {
</span><span class="cx">         // 22. If s is &quot;currency&quot; and c is undefined, throw a TypeError exception.
</span><span class="cx">         if (currency.isNull()) {
</span><del>-            throwTypeError(&amp;state, ASCIILiteral(&quot;currency must be a string&quot;));
</del><ins>+            throwTypeError(&amp;state, scope, ASCIILiteral(&quot;currency must be a string&quot;));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -423,11 +425,14 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue IntlNumberFormat::formatNumber(ExecState&amp; state, double number)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 11.3.4 FormatNumber abstract operation (ECMA-402 2.0)
</span><span class="cx">     if (!m_numberFormat) {
</span><span class="cx">         createNumberFormat(state);
</span><span class="cx">         if (!m_numberFormat)
</span><del>-            return state.vm().throwException(&amp;state, createError(&amp;state, ASCIILiteral(&quot;Failed to format a number.&quot;)));
</del><ins>+            return throwException(&amp;state, scope, createError(&amp;state, ASCIILiteral(&quot;Failed to format a number.&quot;)));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Map negative zero to positive zero.
</span><span class="lines">@@ -443,7 +448,7 @@
</span><span class="cx">         unum_formatDouble(m_numberFormat.get(), number, buffer.data(), length, nullptr, &amp;status);
</span><span class="cx">     }
</span><span class="cx">     if (U_FAILURE(status))
</span><del>-        return state.vm().throwException(&amp;state, createError(&amp;state, ASCIILiteral(&quot;Failed to format a number.&quot;)));
</del><ins>+        return throwException(&amp;state, scope, createError(&amp;state, ASCIILiteral(&quot;Failed to format a number.&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     return jsString(&amp;state, String(buffer.data(), length));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlNumberFormatPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -100,6 +100,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL IntlNumberFormatPrototypeGetterFormat(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 11.3.3 Intl.NumberFormat.prototype.format (ECMA-402 2.0)
</span><span class="cx">     // 1. Let nf be this NumberFormat object.
</span><span class="cx">     IntlNumberFormat* nf = jsDynamicCast&lt;IntlNumberFormat*&gt;(state-&gt;thisValue());
</span><span class="lines">@@ -107,15 +110,14 @@
</span><span class="cx">     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=153679
</span><span class="cx">     if (!nf)
</span><del>-        nf = jsDynamicCast&lt;IntlNumberFormat*&gt;(state-&gt;thisValue().get(state, state-&gt;vm().propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName()));
</del><ins>+        nf = jsDynamicCast&lt;IntlNumberFormat*&gt;(state-&gt;thisValue().get(state, vm.propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName()));
</ins><span class="cx"> 
</span><span class="cx">     if (!nf)
</span><del>-        return JSValue::encode(throwTypeError(state, ASCIILiteral(&quot;Intl.NumberFormat.prototype.format called on value that's not an object initialized as a NumberFormat&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral(&quot;Intl.NumberFormat.prototype.format called on value that's not an object initialized as a NumberFormat&quot;)));
</ins><span class="cx">     
</span><span class="cx">     JSBoundFunction* boundFormat = nf-&gt;boundFormat();
</span><span class="cx">     // 2. If nf.[[boundFormat]] is undefined,
</span><span class="cx">     if (!boundFormat) {
</span><del>-        VM&amp; vm = state-&gt;vm();
</del><span class="cx">         JSGlobalObject* globalObject = nf-&gt;globalObject();
</span><span class="cx">         // a. Let F be a new built-in function object as defined in 11.3.4.
</span><span class="cx">         // b. The value of F’s length property is 1.
</span><span class="lines">@@ -122,7 +124,7 @@
</span><span class="cx">         JSFunction* targetObject = JSFunction::create(vm, globalObject, 1, ASCIILiteral(&quot;format&quot;), IntlNumberFormatFuncFormatNumber, NoIntrinsic);
</span><span class="cx">         JSArray* boundArgs = JSArray::tryCreateUninitialized(vm, globalObject-&gt;arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), 0);
</span><span class="cx">         if (!boundArgs)
</span><del>-            return JSValue::encode(throwOutOfMemoryError(state));
</del><ins>+            return JSValue::encode(throwOutOfMemoryError(state, scope));
</ins><span class="cx"> 
</span><span class="cx">         // c. Let bf be BoundFunctionCreate(F, Â«this value»).
</span><span class="cx">         boundFormat = JSBoundFunction::create(vm, state, globalObject, targetObject, nf, boundArgs, 1, ASCIILiteral(&quot;format&quot;));
</span><span class="lines">@@ -137,6 +139,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL IntlNumberFormatPrototypeFuncResolvedOptions(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 11.3.5 Intl.NumberFormat.prototype.resolvedOptions() (ECMA-402 2.0)
</span><span class="cx">     IntlNumberFormat* numberFormat = jsDynamicCast&lt;IntlNumberFormat*&gt;(state-&gt;thisValue());
</span><span class="cx"> 
</span><span class="lines">@@ -143,10 +148,10 @@
</span><span class="cx">     // FIXME: Workaround to provide compatibility with ECMA-402 1.0 call/apply patterns.
</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=153679
</span><span class="cx">     if (!numberFormat)
</span><del>-        numberFormat = jsDynamicCast&lt;IntlNumberFormat*&gt;(state-&gt;thisValue().get(state, state-&gt;vm().propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName()));
</del><ins>+        numberFormat = jsDynamicCast&lt;IntlNumberFormat*&gt;(state-&gt;thisValue().get(state, vm.propertyNames-&gt;builtinNames().intlSubstituteValuePrivateName()));
</ins><span class="cx"> 
</span><span class="cx">     if (!numberFormat)
</span><del>-        return JSValue::encode(throwTypeError(state, ASCIILiteral(&quot;Intl.NumberFormat.prototype.resolvedOptions called on value that's not an object initialized as a NumberFormat&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(state, scope, ASCIILiteral(&quot;Intl.NumberFormat.prototype.resolvedOptions called on value that's not an object initialized as a NumberFormat&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(numberFormat-&gt;resolvedOptions(*state));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIntlObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IntlObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -162,6 +162,9 @@
</span><span class="cx"> 
</span><span class="cx"> String intlStringOption(ExecState&amp; state, JSValue options, PropertyName property, std::initializer_list&lt;const char*&gt; values, const char* notFound, const char* fallback)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 9.2.9 GetOption (options, property, type, values, fallback)
</span><span class="cx">     // For type=&quot;string&quot;.
</span><span class="cx"> 
</span><span class="lines">@@ -195,7 +198,7 @@
</span><span class="cx">         // d. If values is not undefined, then
</span><span class="cx">         // i. If values does not contain an element equal to value, throw a RangeError exception.
</span><span class="cx">         if (values.size() &amp;&amp; std::find(values.begin(), values.end(), stringValue) == values.end()) {
</span><del>-            state.vm().throwException(&amp;state, createRangeError(&amp;state, notFound));
</del><ins>+            throwException(&amp;state, scope, createRangeError(&amp;state, notFound));
</ins><span class="cx">             return { };
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -209,6 +212,9 @@
</span><span class="cx"> 
</span><span class="cx"> unsigned intlNumberOption(ExecState&amp; state, JSValue options, PropertyName property, unsigned minimum, unsigned maximum, unsigned fallback)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 9.2.9 GetNumberOption (options, property, minimum, maximum, fallback) (ECMA-402 2.0)
</span><span class="cx">     // 1. Let opts be ToObject(options).
</span><span class="cx">     JSObject* opts = options.toObject(&amp;state);
</span><span class="lines">@@ -233,7 +239,7 @@
</span><span class="cx">             return 0;
</span><span class="cx">         // 1. If value is NaN or less than minimum or greater than maximum, throw a RangeError exception.
</span><span class="cx">         if (!(doubleValue &gt;= minimum &amp;&amp; doubleValue &lt;= maximum)) {
</span><del>-            state.vm().throwException(&amp;state, createRangeError(&amp;state, *property.publicName() + &quot; is out of range&quot;));
</del><ins>+            throwException(&amp;state, scope, createRangeError(&amp;state, *property.publicName() + &quot; is out of range&quot;));
</ins><span class="cx">             return 0;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -524,6 +530,8 @@
</span><span class="cx"> {
</span><span class="cx">     // 9.2.1 CanonicalizeLocaleList (locales)
</span><span class="cx">     VM&amp; vm = state.vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSGlobalObject* globalObject = state.callee()-&gt;globalObject();
</span><span class="cx">     Vector&lt;String&gt; seen;
</span><span class="cx"> 
</span><span class="lines">@@ -587,7 +595,7 @@
</span><span class="cx"> 
</span><span class="cx">             // iii. If Type(kValue) is not String or Object, throw a TypeError exception.
</span><span class="cx">             if (!kValue.isString() &amp;&amp; !kValue.isObject()) {
</span><del>-                throwTypeError(&amp;state, ASCIILiteral(&quot;locale value must be a string or object&quot;));
</del><ins>+                throwTypeError(&amp;state, scope, ASCIILiteral(&quot;locale value must be a string or object&quot;));
</ins><span class="cx">                 return Vector&lt;String&gt;();
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="lines">@@ -602,7 +610,7 @@
</span><span class="cx">             // vii. Let canonicalizedTag be CanonicalizeLanguageTag(tag).
</span><span class="cx">             String canonicalizedTag = canonicalizeLanguageTag(tag-&gt;value(&amp;state));
</span><span class="cx">             if (canonicalizedTag.isNull()) {
</span><del>-                state.vm().throwException(&amp;state, createRangeError(&amp;state, String::format(&quot;invalid language tag: %s&quot;, tag-&gt;value(&amp;state).utf8().data())));
</del><ins>+                throwException(&amp;state, scope, createRangeError(&amp;state, String::format(&quot;invalid language tag: %s&quot;, tag-&gt;value(&amp;state).utf8().data())));
</ins><span class="cx">                 return Vector&lt;String&gt;();
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="lines">@@ -870,6 +878,9 @@
</span><span class="cx"> 
</span><span class="cx"> static JSArray* lookupSupportedLocales(ExecState&amp; state, const HashSet&lt;String&gt;&amp; availableLocales, const Vector&lt;String&gt;&amp; requestedLocales)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 9.2.6 LookupSupportedLocales (availableLocales, requestedLocales)
</span><span class="cx"> 
</span><span class="cx">     // 1. Let rLocales be CreateArrayFromList(requestedLocales).
</span><span class="lines">@@ -879,11 +890,10 @@
</span><span class="cx">     size_t len = requestedLocales.size();
</span><span class="cx"> 
</span><span class="cx">     // 3. Let subset be an empty List.
</span><del>-    VM&amp; vm = state.vm();
</del><span class="cx">     JSGlobalObject* globalObject = state.callee()-&gt;globalObject();
</span><span class="cx">     JSArray* subset = JSArray::tryCreateUninitialized(vm, globalObject-&gt;arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), 0);
</span><span class="cx">     if (!subset) {
</span><del>-        throwOutOfMemoryError(&amp;state);
</del><ins>+        throwOutOfMemoryError(&amp;state, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeIteratorOperationscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IteratorOperations.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IteratorOperations.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/IteratorOperations.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2015 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -36,7 +37,10 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue iteratorNext(ExecState* exec, JSValue iterator, JSValue value)
</span><span class="cx"> {
</span><del>-    JSValue nextFunction = iterator.get(exec, exec-&gt;vm().propertyNames-&gt;next);
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
+    JSValue nextFunction = iterator.get(exec, vm.propertyNames-&gt;next);
</ins><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return jsUndefined();
</span><span class="cx"> 
</span><span class="lines">@@ -43,7 +47,7 @@
</span><span class="cx">     CallData nextFunctionCallData;
</span><span class="cx">     CallType nextFunctionCallType = getCallData(nextFunction, nextFunctionCallData);
</span><span class="cx">     if (nextFunctionCallType == CallType::None)
</span><del>-        return throwTypeError(exec);
</del><ins>+        return throwTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     MarkedArgumentBuffer nextFunctionArguments;
</span><span class="cx">     if (!value.isEmpty())
</span><span class="lines">@@ -53,7 +57,7 @@
</span><span class="cx">         return jsUndefined();
</span><span class="cx"> 
</span><span class="cx">     if (!result.isObject())
</span><del>-        return throwTypeError(exec, ASCIILiteral(&quot;Iterator result interface is not an object.&quot;));
</del><ins>+        return throwTypeError(exec, scope, ASCIILiteral(&quot;Iterator result interface is not an object.&quot;));
</ins><span class="cx"> 
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="lines">@@ -89,18 +93,21 @@
</span><span class="cx"> 
</span><span class="cx"> void iteratorClose(ExecState* exec, JSValue iterator)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Exception* exception = nullptr;
</span><span class="cx">     if (exec-&gt;hadException()) {
</span><span class="cx">         exception = exec-&gt;exception();
</span><span class="cx">         exec-&gt;clearException();
</span><span class="cx">     }
</span><del>-    JSValue returnFunction = iterator.get(exec, exec-&gt;vm().propertyNames-&gt;returnKeyword);
</del><ins>+    JSValue returnFunction = iterator.get(exec, vm.propertyNames-&gt;returnKeyword);
</ins><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     if (returnFunction.isUndefined()) {
</span><span class="cx">         if (exception)
</span><del>-            exec-&gt;vm().throwException(exec, exception);
</del><ins>+            throwException(exec, scope, exception);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -108,9 +115,9 @@
</span><span class="cx">     CallType returnFunctionCallType = getCallData(returnFunction, returnFunctionCallData);
</span><span class="cx">     if (returnFunctionCallType == CallType::None) {
</span><span class="cx">         if (exception)
</span><del>-            exec-&gt;vm().throwException(exec, exception);
</del><ins>+            throwException(exec, scope, exception);
</ins><span class="cx">         else
</span><del>-            throwTypeError(exec);
</del><ins>+            throwTypeError(exec, scope);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -118,7 +125,7 @@
</span><span class="cx">     JSValue innerResult = call(exec, returnFunction, returnFunctionCallType, returnFunctionCallData, iterator, returnFunctionArguments);
</span><span class="cx"> 
</span><span class="cx">     if (exception) {
</span><del>-        exec-&gt;vm().throwException(exec, exception);
</del><ins>+        throwException(exec, scope, exception);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -126,7 +133,7 @@
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     if (!innerResult.isObject()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Iterator result interface is not an object.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Iterator result interface is not an object.&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -147,14 +154,18 @@
</span><span class="cx"> 
</span><span class="cx"> JSObject* createIteratorResultObject(ExecState* exec, JSValue value, bool done)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
</ins><span class="cx">     JSObject* resultObject = constructEmptyObject(exec, exec-&gt;lexicalGlobalObject()-&gt;iteratorResultObjectStructure());
</span><del>-    resultObject-&gt;putDirect(exec-&gt;vm(), donePropertyOffset, jsBoolean(done));
-    resultObject-&gt;putDirect(exec-&gt;vm(), valuePropertyOffset, value);
</del><ins>+    resultObject-&gt;putDirect(vm, donePropertyOffset, jsBoolean(done));
+    resultObject-&gt;putDirect(vm, valuePropertyOffset, value);
</ins><span class="cx">     return resultObject;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSValue iteratorForIterable(ExecState* state, JSValue iterable)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
</ins><span class="cx">     JSValue iteratorFunction = iterable.get(state, state-&gt;propertyNames().iteratorSymbol);
</span><span class="cx">     if (state-&gt;hadException())
</span><span class="cx">         return JSValue();
</span><span class="lines">@@ -162,7 +173,7 @@
</span><span class="cx">     CallData iteratorFunctionCallData;
</span><span class="cx">     CallType iteratorFunctionCallType = getCallData(iteratorFunction, iteratorFunctionCallData);
</span><span class="cx">     if (iteratorFunctionCallType == CallType::None) {
</span><del>-        throwTypeError(state);
</del><ins>+        throwTypeError(state, scope);
</ins><span class="cx">         return JSValue();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -172,7 +183,7 @@
</span><span class="cx">         return JSValue();
</span><span class="cx"> 
</span><span class="cx">     if (!iterator.isObject()) {
</span><del>-        throwTypeError(state);
</del><ins>+        throwTypeError(state, scope);
</ins><span class="cx">         return JSValue();
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSArraycpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArray.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArray.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArray.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2003, 2007, 2008, 2009, 2012, 2013, 2015-2016 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2003, 2007-2009, 2012-2013, 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
</span><span class="cx">  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
</span><span class="cx">  *
</span><span class="lines">@@ -75,6 +75,9 @@
</span><span class="cx"> // Defined in ES5.1 15.4.5.1
</span><span class="cx"> bool JSArray::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor&amp; descriptor, bool throwException)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSArray* array = jsCast&lt;JSArray*&gt;(object);
</span><span class="cx"> 
</span><span class="cx">     // 3. If P is &quot;length&quot;, then
</span><span class="lines">@@ -106,7 +109,7 @@
</span><span class="cx">         unsigned newLen = descriptor.value().toUInt32(exec);
</span><span class="cx">         // d. If newLen is not equal to ToNumber( Desc.[[Value]]), throw a RangeError exception.
</span><span class="cx">         if (newLen != descriptor.value().toNumber(exec)) {
</span><del>-            exec-&gt;vm().throwException(exec, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</del><ins>+            JSC::throwException(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -191,6 +194,9 @@
</span><span class="cx"> // ECMA 15.4.5.1
</span><span class="cx"> bool JSArray::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSArray* thisObject = jsCast&lt;JSArray*&gt;(cell);
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
</span><span class="lines">@@ -199,7 +205,7 @@
</span><span class="cx">     if (propertyName == exec-&gt;propertyNames().length) {
</span><span class="cx">         unsigned newLength = value.toUInt32(exec);
</span><span class="cx">         if (value.toNumber(exec) != static_cast&lt;double&gt;(newLength)) {
</span><del>-            exec-&gt;vm().throwException(exec, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</del><ins>+            throwException(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         return thisObject-&gt;setLength(exec, newLength, slot.isStrictMode());
</span><span class="lines">@@ -393,6 +399,8 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSArray::appendMemcpy(ExecState* exec, VM&amp; vm, unsigned startIndex, JSC::JSArray* otherArray)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!canFastCopy(vm, otherArray))
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -418,7 +426,7 @@
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     if (!ensureLength(vm, newLength)) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     ASSERT(copyType == indexingType());
</span><span class="lines">@@ -433,6 +441,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSArray::setLength(ExecState* exec, unsigned newLength, bool throwException)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Butterfly* butterfly = m_butterfly.get();
</span><span class="cx">     switch (indexingType()) {
</span><span class="cx">     case ArrayClass:
</span><span class="lines">@@ -441,9 +452,9 @@
</span><span class="cx">         if (newLength &gt;= MIN_SPARSE_ARRAY_INDEX) {
</span><span class="cx">             return setLengthWithArrayStorage(
</span><span class="cx">                 exec, newLength, throwException,
</span><del>-                ensureArrayStorage(exec-&gt;vm()));
</del><ins>+                ensureArrayStorage(vm));
</ins><span class="cx">         }
</span><del>-        createInitialUndecided(exec-&gt;vm(), newLength);
</del><ins>+        createInitialUndecided(vm, newLength);
</ins><span class="cx">         return true;
</span><span class="cx">         
</span><span class="cx">     case ArrayWithUndecided:
</span><span class="lines">@@ -457,11 +468,11 @@
</span><span class="cx">                 &amp;&amp; !isDenseEnoughForVector(newLength, countElements()))) {
</span><span class="cx">             return setLengthWithArrayStorage(
</span><span class="cx">                 exec, newLength, throwException,
</span><del>-                ensureArrayStorage(exec-&gt;vm()));
</del><ins>+                ensureArrayStorage(vm));
</ins><span class="cx">         }
</span><span class="cx">         if (newLength &gt; butterfly-&gt;publicLength()) {
</span><del>-            if (!ensureLength(exec-&gt;vm(), newLength)) {
-                throwOutOfMemoryError(exec);
</del><ins>+            if (!ensureLength(vm, newLength)) {
+                throwOutOfMemoryError(exec, scope);
</ins><span class="cx">                 return false;
</span><span class="cx">             }
</span><span class="cx">             return true;
</span><span class="lines">@@ -470,7 +481,7 @@
</span><span class="cx">         unsigned lengthToClear = butterfly-&gt;publicLength() - newLength;
</span><span class="cx">         unsigned costToAllocateNewButterfly = 64; // a heuristic.
</span><span class="cx">         if (lengthToClear &gt; newLength &amp;&amp; lengthToClear &gt; costToAllocateNewButterfly) {
</span><del>-            reallocateAndShrinkButterfly(exec-&gt;vm(), newLength);
</del><ins>+            reallocateAndShrinkButterfly(vm, newLength);
</ins><span class="cx">             return true;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -497,6 +508,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSArray::pop(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Butterfly* butterfly = m_butterfly.get();
</span><span class="cx">     
</span><span class="cx">     switch (indexingType()) {
</span><span class="lines">@@ -548,7 +562,7 @@
</span><span class="cx">         unsigned length = storage-&gt;length();
</span><span class="cx">         if (!length) {
</span><span class="cx">             if (!isLengthWritable())
</span><del>-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+                throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">             return jsUndefined();
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -580,7 +594,7 @@
</span><span class="cx">         return jsUndefined();
</span><span class="cx">     // Call the [[Delete]] internal method of O with arguments indx and true.
</span><span class="cx">     if (!deletePropertyByIndex(this, exec, index)) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Unable to delete property.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Unable to delete property.&quot;));
</ins><span class="cx">         return jsUndefined();
</span><span class="cx">     }
</span><span class="cx">     // Call the [[Put]] internal method of O with arguments &quot;length&quot;, indx, and true.
</span><span class="lines">@@ -594,16 +608,19 @@
</span><span class="cx"> //  - pushing to an array of length 2^32-1 stores the property, but throws a range error.
</span><span class="cx"> void JSArray::push(ExecState* exec, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Butterfly* butterfly = m_butterfly.get();
</span><span class="cx">     
</span><span class="cx">     switch (indexingType()) {
</span><span class="cx">     case ArrayClass: {
</span><del>-        createInitialUndecided(exec-&gt;vm(), 0);
</del><ins>+        createInitialUndecided(vm, 0);
</ins><span class="cx">         FALLTHROUGH;
</span><span class="cx">     }
</span><span class="cx">         
</span><span class="cx">     case ArrayWithUndecided: {
</span><del>-        convertUndecidedForValue(exec-&gt;vm(), value);
</del><ins>+        convertUndecidedForValue(vm, value);
</ins><span class="cx">         push(exec, value);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="lines">@@ -610,7 +627,7 @@
</span><span class="cx">         
</span><span class="cx">     case ArrayWithInt32: {
</span><span class="cx">         if (!value.isInt32()) {
</span><del>-            convertInt32ForValue(exec-&gt;vm(), value);
</del><ins>+            convertInt32ForValue(vm, value);
</ins><span class="cx">             push(exec, value);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -624,9 +641,9 @@
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         if (length &gt; MAX_ARRAY_INDEX) {
</span><del>-            methodTable(exec-&gt;vm())-&gt;putByIndex(this, exec, length, value, true);
</del><ins>+            methodTable(vm)-&gt;putByIndex(this, exec, length, value, true);
</ins><span class="cx">             if (!exec-&gt;hadException())
</span><del>-                exec-&gt;vm().throwException(exec, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</del><ins>+                throwException(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="lines">@@ -638,15 +655,15 @@
</span><span class="cx">         unsigned length = butterfly-&gt;publicLength();
</span><span class="cx">         ASSERT(length &lt;= butterfly-&gt;vectorLength());
</span><span class="cx">         if (length &lt; butterfly-&gt;vectorLength()) {
</span><del>-            butterfly-&gt;contiguous()[length].set(exec-&gt;vm(), this, value);
</del><ins>+            butterfly-&gt;contiguous()[length].set(vm, this, value);
</ins><span class="cx">             butterfly-&gt;setPublicLength(length + 1);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         if (length &gt; MAX_ARRAY_INDEX) {
</span><del>-            methodTable(exec-&gt;vm())-&gt;putByIndex(this, exec, length, value, true);
</del><ins>+            methodTable(vm)-&gt;putByIndex(this, exec, length, value, true);
</ins><span class="cx">             if (!exec-&gt;hadException())
</span><del>-                exec-&gt;vm().throwException(exec, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</del><ins>+                throwException(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="lines">@@ -656,13 +673,13 @@
</span><span class="cx">         
</span><span class="cx">     case ArrayWithDouble: {
</span><span class="cx">         if (!value.isNumber()) {
</span><del>-            convertDoubleToContiguous(exec-&gt;vm());
</del><ins>+            convertDoubleToContiguous(vm);
</ins><span class="cx">             push(exec, value);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         double valueAsDouble = value.asNumber();
</span><span class="cx">         if (valueAsDouble != valueAsDouble) {
</span><del>-            convertDoubleToContiguous(exec-&gt;vm());
</del><ins>+            convertDoubleToContiguous(vm);
</ins><span class="cx">             push(exec, value);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><span class="lines">@@ -676,9 +693,9 @@
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="cx">         if (length &gt; MAX_ARRAY_INDEX) {
</span><del>-            methodTable(exec-&gt;vm())-&gt;putByIndex(this, exec, length, value, true);
</del><ins>+            methodTable(vm)-&gt;putByIndex(this, exec, length, value, true);
</ins><span class="cx">             if (!exec-&gt;hadException())
</span><del>-                exec-&gt;vm().throwException(exec, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</del><ins>+                throwException(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         
</span><span class="lines">@@ -703,7 +720,7 @@
</span><span class="cx">         // Fast case - push within vector, always update m_length &amp; m_numValuesInVector.
</span><span class="cx">         unsigned length = storage-&gt;length();
</span><span class="cx">         if (length &lt; storage-&gt;vectorLength()) {
</span><del>-            storage-&gt;m_vector[length].set(exec-&gt;vm(), this, value);
</del><ins>+            storage-&gt;m_vector[length].set(vm, this, value);
</ins><span class="cx">             storage-&gt;setLength(length + 1);
</span><span class="cx">             ++storage-&gt;m_numValuesInVector;
</span><span class="cx">             return;
</span><span class="lines">@@ -711,10 +728,10 @@
</span><span class="cx"> 
</span><span class="cx">         // Pushing to an array of invalid length (2^31-1) stores the property, but throws a range error.
</span><span class="cx">         if (storage-&gt;length() &gt; MAX_ARRAY_INDEX) {
</span><del>-            methodTable(exec-&gt;vm())-&gt;putByIndex(this, exec, storage-&gt;length(), value, true);
</del><ins>+            methodTable(vm)-&gt;putByIndex(this, exec, storage-&gt;length(), value, true);
</ins><span class="cx">             // Per ES5.1 15.4.4.7 step 6 &amp; 15.4.5.1 step 3.d.
</span><span class="cx">             if (!exec-&gt;hadException())
</span><del>-                exec-&gt;vm().throwException(exec, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</del><ins>+                throwException(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Invalid array length&quot;)));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -963,6 +980,9 @@
</span><span class="cx"> // Returns true if the unshift can be handled, false to fallback.    
</span><span class="cx"> bool JSArray::unshiftCountWithArrayStorage(ExecState* exec, unsigned startIndex, unsigned count, ArrayStorage* storage)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     unsigned length = storage-&gt;length();
</span><span class="cx"> 
</span><span class="cx">     RELEASE_ASSERT(startIndex &lt;= length);
</span><span class="lines">@@ -981,13 +1001,13 @@
</span><span class="cx">         storage = newButterfly-&gt;arrayStorage();
</span><span class="cx">         storage-&gt;m_indexBias -= count;
</span><span class="cx">         storage-&gt;setVectorLength(vectorLength + count);
</span><del>-        setButterflyWithoutChangingStructure(exec-&gt;vm(), newButterfly);
</del><ins>+        setButterflyWithoutChangingStructure(vm, newButterfly);
</ins><span class="cx">     } else if (!moveFront &amp;&amp; vectorLength - length &gt;= count)
</span><span class="cx">         storage = storage-&gt;butterfly()-&gt;arrayStorage();
</span><del>-    else if (unshiftCountSlowCase(exec-&gt;vm(), moveFront, count))
</del><ins>+    else if (unshiftCountSlowCase(vm, moveFront, count))
</ins><span class="cx">         storage = arrayStorage();
</span><span class="cx">     else {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1007,6 +1027,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSArray::unshiftCountWithAnyIndexingType(ExecState* exec, unsigned startIndex, unsigned count)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Butterfly* butterfly = m_butterfly.get();
</span><span class="cx">     
</span><span class="cx">     switch (indexingType()) {
</span><span class="lines">@@ -1022,10 +1045,10 @@
</span><span class="cx">         // We may have to walk the entire array to do the unshift. We're willing to do so
</span><span class="cx">         // only if it's not horribly slow.
</span><span class="cx">         if (oldLength - startIndex &gt;= MIN_SPARSE_ARRAY_INDEX)
</span><del>-            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec-&gt;vm()));
</del><ins>+            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
</ins><span class="cx">         
</span><del>-        if (!ensureLength(exec-&gt;vm(), oldLength + count)) {
-            throwOutOfMemoryError(exec);
</del><ins>+        if (!ensureLength(vm, oldLength + count)) {
+            throwOutOfMemoryError(exec, scope);
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         butterfly = m_butterfly.get();
</span><span class="lines">@@ -1035,7 +1058,7 @@
</span><span class="cx">         for (unsigned i = oldLength; i-- &gt; startIndex;) {
</span><span class="cx">             JSValue v = butterfly-&gt;contiguous()[i].get();
</span><span class="cx">             if (UNLIKELY(!v))
</span><del>-                return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec-&gt;vm()));
</del><ins>+                return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         for (unsigned i = oldLength; i-- &gt; startIndex;) {
</span><span class="lines">@@ -1058,10 +1081,10 @@
</span><span class="cx">         // We may have to walk the entire array to do the unshift. We're willing to do so
</span><span class="cx">         // only if it's not horribly slow.
</span><span class="cx">         if (oldLength - startIndex &gt;= MIN_SPARSE_ARRAY_INDEX)
</span><del>-            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec-&gt;vm()));
</del><ins>+            return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
</ins><span class="cx">         
</span><del>-        if (!ensureLength(exec-&gt;vm(), oldLength + count)) {
-            throwOutOfMemoryError(exec);
</del><ins>+        if (!ensureLength(vm, oldLength + count)) {
+            throwOutOfMemoryError(exec, scope);
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         butterfly = m_butterfly.get();
</span><span class="lines">@@ -1071,7 +1094,7 @@
</span><span class="cx">         for (unsigned i = oldLength; i-- &gt; startIndex;) {
</span><span class="cx">             double v = butterfly-&gt;contiguousDouble()[i];
</span><span class="cx">             if (UNLIKELY(v != v))
</span><del>-                return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(exec-&gt;vm()));
</del><ins>+                return unshiftCountWithArrayStorage(exec, startIndex, count, ensureArrayStorage(vm));
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         for (unsigned i = oldLength; i-- &gt; startIndex;) {
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSArrayBufferConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -79,6 +79,9 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructArrayBuffer(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSArrayBufferConstructor* constructor =
</span><span class="cx">         jsCast&lt;JSArrayBufferConstructor*&gt;(exec-&gt;callee());
</span><span class="cx">     
</span><span class="lines">@@ -96,12 +99,12 @@
</span><span class="cx">     
</span><span class="cx">     auto buffer = ArrayBuffer::tryCreate(length, 1);
</span><span class="cx">     if (!buffer)
</span><del>-        return JSValue::encode(throwOutOfMemoryError(exec));
</del><ins>+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
</ins><span class="cx"> 
</span><span class="cx">     Structure* arrayBufferStructure = InternalFunction::createSubclassStructure(exec, exec-&gt;newTarget(), constructor-&gt;globalObject()-&gt;arrayBufferStructure());
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(JSValue());
</span><del>-    JSArrayBuffer* result = JSArrayBuffer::create(exec-&gt;vm(), arrayBufferStructure, WTFMove(buffer));
</del><ins>+    JSArrayBuffer* result = JSArrayBuffer::create(vm, arrayBufferStructure, WTFMove(buffer));
</ins><span class="cx">     
</span><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="lines">@@ -108,7 +111,9 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callArrayBuffer(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, &quot;ArrayBuffer&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, &quot;ArrayBuffer&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ConstructType JSArrayBufferConstructor::getConstructData(
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSArrayBufferPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSArrayBufferPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -37,14 +37,17 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL arrayBufferProtoFuncSlice(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSFunction* callee = jsCast&lt;JSFunction*&gt;(exec-&gt;callee());
</span><span class="cx">     
</span><span class="cx">     JSArrayBuffer* thisObject = jsDynamicCast&lt;JSArrayBuffer*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (!thisObject)
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver of slice must be an array buffer.&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver of slice must be an array buffer.&quot;));
</ins><span class="cx">     
</span><span class="cx">     if (!exec-&gt;argumentCount())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Slice requires at least one argument.&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Slice requires at least one argument.&quot;));
</ins><span class="cx">     
</span><span class="cx">     int32_t begin = exec-&gt;argument(0).toInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -60,11 +63,11 @@
</span><span class="cx">     
</span><span class="cx">     RefPtr&lt;ArrayBuffer&gt; newBuffer = thisObject-&gt;impl()-&gt;slice(begin, end);
</span><span class="cx">     if (!newBuffer)
</span><del>-        return JSValue::encode(throwOutOfMemoryError(exec));
</del><ins>+        return JSValue::encode(throwOutOfMemoryError(exec, scope));
</ins><span class="cx">     
</span><span class="cx">     Structure* structure = callee-&gt;globalObject()-&gt;arrayBufferStructure();
</span><span class="cx">     
</span><del>-    JSArrayBuffer* result = JSArrayBuffer::create(exec-&gt;vm(), structure, newBuffer);
</del><ins>+    JSArrayBuffer* result = JSArrayBuffer::create(vm, structure, newBuffer);
</ins><span class="cx">     
</span><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSCInlinesh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCInlines.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCInlines.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCInlines.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -51,6 +51,7 @@
</span><span class="cx"> #include &quot;Operations.h&quot;
</span><span class="cx"> #include &quot;SlotVisitorInlines.h&quot;
</span><span class="cx"> #include &quot;StructureInlines.h&quot;
</span><ins>+#include &quot;ThrowScope.h&quot;
</ins><span class="cx"> #include &quot;WeakGCMapInlines.h&quot;
</span><span class="cx"> 
</span><span class="cx"> #endif // JSCInlines_h
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSCJSValuecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCJSValue.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCJSValue.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCJSValue.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><span class="cx">  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
</span><del>- *  Copyright (C) 2003, 2007, 2008, 2012 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2003, 2007-2008, 2012, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -94,6 +94,8 @@
</span><span class="cx"> 
</span><span class="cx"> JSObject* JSValue::toObjectSlowCase(ExecState* exec, JSGlobalObject* globalObject) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     ASSERT(!isCell());
</span><span class="cx"> 
</span><span class="cx">     if (isInt32() || isDouble())
</span><span class="lines">@@ -102,8 +104,7 @@
</span><span class="cx">         return constructBooleanFromImmediateBoolean(exec, globalObject, asValue());
</span><span class="cx"> 
</span><span class="cx">     ASSERT(isUndefinedOrNull());
</span><del>-    VM&amp; vm = exec-&gt;vm();
-    vm.throwException(exec, createNotAnObjectError(exec, *this));
</del><ins>+    throwException(exec, scope, createNotAnObjectError(exec, *this));
</ins><span class="cx">     return nullptr;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -124,6 +125,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSObject* JSValue::synthesizePrototype(ExecState* exec) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (isCell()) {
</span><span class="cx">         if (isString())
</span><span class="cx">             return exec-&gt;lexicalGlobalObject()-&gt;stringPrototype();
</span><span class="lines">@@ -137,8 +141,7 @@
</span><span class="cx">         return exec-&gt;lexicalGlobalObject()-&gt;booleanPrototype();
</span><span class="cx"> 
</span><span class="cx">     ASSERT(isUndefinedOrNull());
</span><del>-    VM&amp; vm = exec-&gt;vm();
-    vm.throwException(exec, createNotAnObjectError(exec, *this));
</del><ins>+    throwException(exec, scope, createNotAnObjectError(exec, *this));
</ins><span class="cx">     return nullptr;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -146,6 +149,7 @@
</span><span class="cx"> bool JSValue::putToPrimitive(ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     if (Optional&lt;uint32_t&gt; index = parseIndex(propertyName))
</span><span class="cx">         return putToPrimitiveByIndex(exec, index.value(), value, slot.isStrictMode());
</span><span class="lines">@@ -160,7 +164,7 @@
</span><span class="cx">             prototype = obj-&gt;getPrototypeDirect();
</span><span class="cx">             if (prototype.isNull()) {
</span><span class="cx">                 if (slot.isStrictMode())
</span><del>-                    throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+                    throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">                 return false;
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="lines">@@ -172,7 +176,7 @@
</span><span class="cx">         if (offset != invalidOffset) {
</span><span class="cx">             if (attributes &amp; ReadOnly) {
</span><span class="cx">                 if (slot.isStrictMode())
</span><del>-                    throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+                    throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">                 return false;
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="lines">@@ -196,12 +200,15 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     if (slot.isStrictMode())
</span><del>-        throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+        throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSValue::putToPrimitiveByIndex(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (propertyName &gt; MAX_ARRAY_INDEX) {
</span><span class="cx">         PutPropertySlot slot(*this, shouldThrow);
</span><span class="cx">         return putToPrimitive(exec, Identifier::from(exec, propertyName), value, slot);
</span><span class="lines">@@ -217,7 +224,7 @@
</span><span class="cx">         return putResult;
</span><span class="cx">     
</span><span class="cx">     if (shouldThrow)
</span><del>-        throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+        throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -338,6 +345,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSString* JSValue::toStringSlowCase(ExecState* exec, bool returnEmptyStringOnError) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto errorValue = [&amp;] () -&gt; JSString* {
</span><span class="cx">         if (returnEmptyStringOnError)
</span><span class="cx">             return jsEmptyString(exec);
</span><span class="lines">@@ -344,7 +354,6 @@
</span><span class="cx">         return nullptr;
</span><span class="cx">     };
</span><span class="cx">     
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     ASSERT(!isString());
</span><span class="cx">     if (isInt32()) {
</span><span class="cx">         auto integer = asInt32();
</span><span class="lines">@@ -363,7 +372,7 @@
</span><span class="cx">     if (isUndefined())
</span><span class="cx">         return vm.smallStrings.undefinedString();
</span><span class="cx">     if (isSymbol()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Cannot convert a symbol to a string&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Cannot convert a symbol to a string&quot;));
</ins><span class="cx">         return errorValue();
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSCJSValueInlinesh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCJSValueInlines.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCJSValueInlines.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSCJSValueInlines.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011-2012, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -633,8 +633,11 @@
</span><span class="cx"> 
</span><span class="cx"> inline PreferredPrimitiveType toPreferredPrimitiveType(ExecState* exec, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isString()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Primitive hint is not a string.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Primitive hint is not a string.&quot;));
</ins><span class="cx">         return NoPreference;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -649,7 +652,7 @@
</span><span class="cx">     if (WTF::equal(hintString, &quot;string&quot;))
</span><span class="cx">         return PreferString;
</span><span class="cx"> 
</span><del>-    throwTypeError(exec, ASCIILiteral(&quot;Expected primitive hint to match one of 'default', 'number', 'string'.&quot;));
</del><ins>+    throwTypeError(exec, scope, ASCIILiteral(&quot;Expected primitive hint to match one of 'default', 'number', 'string'.&quot;));
</ins><span class="cx">     return NoPreference;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1031,9 +1034,12 @@
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE bool JSValue::requireObjectCoercible(ExecState* exec) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!isUndefinedOrNull())
</span><span class="cx">         return true;
</span><del>-    exec-&gt;vm().throwException(exec, createNotAnObjectError(exec, *this));
</del><ins>+    throwException(exec, scope, createNotAnObjectError(exec, *this));
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSDataViewcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSDataView.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSDataView.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSDataView.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -47,16 +47,18 @@
</span><span class="cx">     ExecState* exec, Structure* structure, PassRefPtr&lt;ArrayBuffer&gt; passedBuffer,
</span><span class="cx">     unsigned byteOffset, unsigned byteLength)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RefPtr&lt;ArrayBuffer&gt; buffer = passedBuffer;
</span><span class="cx">     if (!ArrayBufferView::verifySubRangeLength(buffer, byteOffset, byteLength, sizeof(uint8_t))) {
</span><del>-        throwVMError(exec, createRangeError(exec, ASCIILiteral(&quot;Length out of range of buffer&quot;)));
</del><ins>+        throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Length out of range of buffer&quot;)));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     if (!ArrayBufferView::verifyByteOffsetAlignment(byteOffset, sizeof(uint8_t))) {
</span><del>-        exec-&gt;vm().throwException(exec, createRangeError(exec, ASCIILiteral(&quot;Byte offset is not aligned&quot;)));
</del><ins>+        throwException(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Byte offset is not aligned&quot;)));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     ConstructionContext context(
</span><span class="cx">         structure, buffer, byteOffset, byteLength, ConstructionContext::DataView);
</span><span class="cx">     ASSERT(context);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSDataViewPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -122,12 +122,15 @@
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="cx"> EncodedJSValue getData(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSDataView* dataView = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (!dataView)
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver of DataView method must be a DataView&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver of DataView method must be a DataView&quot;));
</ins><span class="cx">     
</span><span class="cx">     if (!exec-&gt;argumentCount())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Need at least one argument (the byteOffset)&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Need at least one argument (the byteOffset)&quot;));
</ins><span class="cx">     
</span><span class="cx">     unsigned byteOffset = exec-&gt;uncheckedArgument(0).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -143,7 +146,7 @@
</span><span class="cx">     
</span><span class="cx">     unsigned byteLength = dataView-&gt;length();
</span><span class="cx">     if (elementSize &gt; byteLength || byteOffset &gt; byteLength - elementSize)
</span><del>-        return throwVMError(exec, createRangeError(exec, ASCIILiteral(&quot;Out of bounds access&quot;)));
</del><ins>+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Out of bounds access&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     const unsigned dataSize = sizeof(typename Adaptor::Type);
</span><span class="cx">     union {
</span><span class="lines">@@ -167,12 +170,15 @@
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="cx"> EncodedJSValue setData(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSDataView* dataView = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (!dataView)
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver of DataView method must be a DataView&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver of DataView method must be a DataView&quot;));
</ins><span class="cx">     
</span><span class="cx">     if (exec-&gt;argumentCount() &lt; 2)
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Need at least two argument (the byteOffset and value)&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Need at least two argument (the byteOffset and value)&quot;));
</ins><span class="cx">     
</span><span class="cx">     unsigned byteOffset = exec-&gt;uncheckedArgument(0).toUInt32(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -198,7 +204,7 @@
</span><span class="cx">     
</span><span class="cx">     unsigned byteLength = dataView-&gt;length();
</span><span class="cx">     if (elementSize &gt; byteLength || byteOffset &gt; byteLength - elementSize)
</span><del>-        return throwVMError(exec, createRangeError(exec, ASCIILiteral(&quot;Out of bounds access&quot;)));
</del><ins>+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Out of bounds access&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     uint8_t* dataPtr = static_cast&lt;uint8_t*&gt;(dataView-&gt;vector()) + byteOffset;
</span><span class="cx"> 
</span><span class="lines">@@ -220,9 +226,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dataViewProtoGetterBuffer(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (!view)
</span><del>-        return throwVMTypeError(exec, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);
</del><ins>+        return throwVMTypeError(exec, scope, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(view-&gt;jsBuffer(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -229,9 +238,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteLength(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (!view)
</span><del>-        return throwVMTypeError(exec, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);
</del><ins>+        return throwVMTypeError(exec, scope, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsNumber(view-&gt;length()));
</span><span class="cx"> }
</span><span class="lines">@@ -238,9 +250,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dataViewProtoGetterByteOffset(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSDataView* view = jsDynamicCast&lt;JSDataView*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (!view)
</span><del>-        return throwVMTypeError(exec, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);
</del><ins>+        return throwVMTypeError(exec, scope, &quot;DataView.prototype.buffer expects |this| to be a DataView object&quot;);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsNumber(view-&gt;byteOffset()));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSFunctioncpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSFunction.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSFunction.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSFunction.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -50,7 +50,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL callHostFunctionAsConstructor(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return throwVMError(exec, createNotAConstructorError(exec, exec-&gt;callee()));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMError(exec, scope, createNotAConstructorError(exec, exec-&gt;callee()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> const ClassInfo JSFunction::s_info = { &quot;Function&quot;, &amp;Base::s_info, 0, CREATE_METHOD_TABLE(JSFunction) };
</span><span class="lines">@@ -321,6 +323,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSFunction::callerGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSFunction* thisObj = jsCast&lt;JSFunction*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     ASSERT(!thisObj-&gt;isHostFunction());
</span><span class="cx">     JSValue caller = retrieveCallerFunction(exec, thisObj);
</span><span class="lines">@@ -335,7 +340,7 @@
</span><span class="cx">     JSFunction* function = jsCast&lt;JSFunction*&gt;(caller);
</span><span class="cx">     if (function-&gt;isHostOrBuiltinFunction() || !function-&gt;jsExecutable()-&gt;isStrictMode())
</span><span class="cx">         return JSValue::encode(caller);
</span><del>-    return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Function.caller used to retrieve strict caller&quot;)));
</del><ins>+    return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Function.caller used to retrieve strict caller&quot;)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSFunction::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="lines">@@ -423,6 +428,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSFunction::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSFunction* thisObject = jsCast&lt;JSFunction*&gt;(cell);
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
</span><span class="lines">@@ -437,11 +445,12 @@
</span><span class="cx">         // Make sure prototype has been reified, such that it can only be overwritten
</span><span class="cx">         // following the rules set out in ECMA-262 8.12.9.
</span><span class="cx">         PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
</span><del>-        thisObject-&gt;methodTable(exec-&gt;vm())-&gt;getOwnPropertySlot(thisObject, exec, propertyName, slot);
</del><ins>+        thisObject-&gt;methodTable(vm)-&gt;getOwnPropertySlot(thisObject, exec, propertyName, slot);
</ins><span class="cx">         if (thisObject-&gt;m_rareData)
</span><span class="cx">             thisObject-&gt;m_rareData-&gt;clear(&quot;Store to prototype property of a function&quot;);
</span><span class="cx">         // Don't allow this to be cached, since a [[Put]] must clear m_rareData.
</span><span class="cx">         PutPropertySlot dontCache(thisObject);
</span><ins>+        scope.release();
</ins><span class="cx">         return Base::put(thisObject, exec, propertyName, value, dontCache);
</span><span class="cx">     }
</span><span class="cx">     if (thisObject-&gt;jsExecutable()-&gt;isStrictMode() &amp;&amp; (propertyName == exec-&gt;propertyNames().arguments || propertyName == exec-&gt;propertyNames().caller)) {
</span><span class="lines">@@ -448,14 +457,16 @@
</span><span class="cx">         // This will trigger the property to be reified, if this is not already the case!
</span><span class="cx">         bool okay = thisObject-&gt;hasProperty(exec, propertyName);
</span><span class="cx">         ASSERT_UNUSED(okay, okay);
</span><ins>+        scope.release();
</ins><span class="cx">         return Base::put(thisObject, exec, propertyName, value, slot);
</span><span class="cx">     }
</span><span class="cx">     if (propertyName == exec-&gt;propertyNames().arguments || propertyName == exec-&gt;propertyNames().caller) {
</span><span class="cx">         if (slot.isStrictMode())
</span><del>-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     thisObject-&gt;reifyLazyPropertyIfNeeded(exec, propertyName);
</span><ins>+    scope.release();
</ins><span class="cx">     return Base::put(thisObject, exec, propertyName, value, slot);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -480,6 +491,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSFunction::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor&amp; descriptor, bool throwException)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSFunction* thisObject = jsCast&lt;JSFunction*&gt;(object);
</span><span class="cx">     if (thisObject-&gt;isHostOrBuiltinFunction()) {
</span><span class="cx">         thisObject-&gt;reifyBoundNameIfNeeded(exec, propertyName);
</span><span class="lines">@@ -490,7 +504,7 @@
</span><span class="cx">         // Make sure prototype has been reified, such that it can only be overwritten
</span><span class="cx">         // following the rules set out in ECMA-262 8.12.9.
</span><span class="cx">         PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
</span><del>-        thisObject-&gt;methodTable(exec-&gt;vm())-&gt;getOwnPropertySlot(thisObject, exec, propertyName, slot);
</del><ins>+        thisObject-&gt;methodTable(vm)-&gt;getOwnPropertySlot(thisObject, exec, propertyName, slot);
</ins><span class="cx">         if (thisObject-&gt;m_rareData)
</span><span class="cx">             thisObject-&gt;m_rareData-&gt;clear(&quot;Store to prototype property of a function&quot;);
</span><span class="cx">         return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
</span><span class="lines">@@ -520,27 +534,27 @@
</span><span class="cx">      
</span><span class="cx">     if (descriptor.configurablePresent() &amp;&amp; descriptor.configurable()) {
</span><span class="cx">         if (throwException)
</span><del>-            throwTypeError(exec, ASCIILiteral(&quot;Attempting to change configurable attribute of unconfigurable property.&quot;));
</del><ins>+            throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to change configurable attribute of unconfigurable property.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     if (descriptor.enumerablePresent() &amp;&amp; descriptor.enumerable()) {
</span><span class="cx">         if (throwException)
</span><del>-            throwTypeError(exec, ASCIILiteral(&quot;Attempting to change enumerable attribute of unconfigurable property.&quot;));
</del><ins>+            throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to change enumerable attribute of unconfigurable property.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     if (descriptor.isAccessorDescriptor()) {
</span><span class="cx">         if (throwException)
</span><del>-            throwTypeError(exec, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
</del><ins>+            throwTypeError(exec, scope, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     if (descriptor.writablePresent() &amp;&amp; descriptor.writable()) {
</span><span class="cx">         if (throwException)
</span><del>-            throwTypeError(exec, ASCIILiteral(&quot;Attempting to change writable attribute of unconfigurable property.&quot;));
</del><ins>+            throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to change writable attribute of unconfigurable property.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     if (!valueCheck) {
</span><span class="cx">         if (throwException)
</span><del>-            throwTypeError(exec, ASCIILiteral(&quot;Attempting to change value of a readonly property.&quot;));
</del><ins>+            throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to change value of a readonly property.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     return true;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGenericTypedArrayViewh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayView.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -27,6 +27,7 @@
</span><span class="cx"> #define JSGenericTypedArrayView_h
</span><span class="cx"> 
</span><span class="cx"> #include &quot;JSArrayBufferView.h&quot;
</span><ins>+#include &quot;ThrowScope.h&quot;
</ins><span class="cx"> #include &quot;ToNativeFromValue.h&quot;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -168,12 +169,15 @@
</span><span class="cx">     
</span><span class="cx">     bool setIndex(ExecState* exec, unsigned i, JSValue jsValue)
</span><span class="cx">     {
</span><ins>+        VM&amp; vm = exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">         typename Adaptor::Type value = toNativeFromValue&lt;Adaptor&gt;(exec, jsValue);
</span><span class="cx">         if (exec-&gt;hadException())
</span><span class="cx">             return false;
</span><span class="cx"> 
</span><span class="cx">         if (isNeutered()) {
</span><del>-            throwTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+            throwTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorInlinesh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -80,8 +80,11 @@
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><span class="cx"> inline JSObject* constructGenericTypedArrayViewFromIterator(ExecState* exec, Structure* structure, JSValue iterator)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!iterator.isObject())
</span><del>-        return throwTypeError(exec, ASCIILiteral(&quot;Symbol.Iterator for the first argument did not return an object.&quot;));
</del><ins>+        return throwTypeError(exec, scope, ASCIILiteral(&quot;Symbol.Iterator for the first argument did not return an object.&quot;));
</ins><span class="cx"> 
</span><span class="cx">     MarkedArgumentBuffer storage;
</span><span class="cx">     while (true) {
</span><span class="lines">@@ -118,9 +121,11 @@
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><span class="cx"> inline JSObject* constructGenericTypedArrayViewWithArguments(ExecState* exec, Structure* structure, EncodedJSValue firstArgument, unsigned offset, Optional&lt;unsigned&gt; lengthOpt)
</span><span class="cx"> {
</span><del>-    JSValue firstValue = JSValue::decode(firstArgument);
</del><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><ins>+    JSValue firstValue = JSValue::decode(firstArgument);
+
</ins><span class="cx">     if (JSArrayBuffer* jsBuffer = jsDynamicCast&lt;JSArrayBuffer*&gt;(firstValue)) {
</span><span class="cx">         RefPtr&lt;ArrayBuffer&gt; buffer = jsBuffer-&gt;impl();
</span><span class="cx">         unsigned length = 0;
</span><span class="lines">@@ -129,7 +134,7 @@
</span><span class="cx">             length = lengthOpt.value();
</span><span class="cx">         else {
</span><span class="cx">             if ((buffer-&gt;byteLength() - offset) % ViewClass::elementSize)
</span><del>-                return throwRangeError(exec, &quot;ArrayBuffer length minus the byteOffset is not a multiple of the element size&quot;);
</del><ins>+                return throwRangeError(exec, scope, &quot;ArrayBuffer length minus the byteOffset is not a multiple of the element size&quot;);
</ins><span class="cx">             length = (buffer-&gt;byteLength() - offset) / ViewClass::elementSize;
</span><span class="cx"> 
</span><span class="cx">         }
</span><span class="lines">@@ -139,7 +144,7 @@
</span><span class="cx">     ASSERT(!offset &amp;&amp; !lengthOpt);
</span><span class="cx">     
</span><span class="cx">     if (ViewClass::TypedArrayStorageType == TypeDataView)
</span><del>-        return throwTypeError(exec, ASCIILiteral(&quot;Expected ArrayBuffer for the first argument.&quot;));
</del><ins>+        return throwTypeError(exec, scope, ASCIILiteral(&quot;Expected ArrayBuffer for the first argument.&quot;));
</ins><span class="cx">     
</span><span class="cx">     // For everything but DataView, we allow construction with any of:
</span><span class="cx">     // - Another array. This creates a copy of the of that array.
</span><span class="lines">@@ -174,7 +179,7 @@
</span><span class="cx">                     CallData callData;
</span><span class="cx">                     CallType callType = getCallData(iteratorFunc, callData);
</span><span class="cx">                     if (callType == CallType::None)
</span><del>-                        return throwTypeError(exec, ASCIILiteral(&quot;Symbol.Iterator for the first argument cannot be called.&quot;));
</del><ins>+                        return throwTypeError(exec, scope, ASCIILiteral(&quot;Symbol.Iterator for the first argument cannot be called.&quot;));
</ins><span class="cx"> 
</span><span class="cx">                     ArgList arguments;
</span><span class="cx">                     JSValue iterator = call(exec, iteratorFunc, callType, callData, object, arguments);
</span><span class="lines">@@ -206,15 +211,15 @@
</span><span class="cx">     if (firstValue.isInt32())
</span><span class="cx">         length = firstValue.asInt32();
</span><span class="cx">     else if (!firstValue.isNumber())
</span><del>-        return throwTypeError(exec, ASCIILiteral(&quot;Invalid array length argument&quot;));
</del><ins>+        return throwTypeError(exec, scope, ASCIILiteral(&quot;Invalid array length argument&quot;));
</ins><span class="cx">     else {
</span><span class="cx">         length = static_cast&lt;int&gt;(firstValue.asNumber());
</span><span class="cx">         if (length != firstValue.asNumber())
</span><del>-            return throwTypeError(exec, ASCIILiteral(&quot;Invalid array length argument (fractional lengths not allowed)&quot;));
</del><ins>+            return throwTypeError(exec, scope, ASCIILiteral(&quot;Invalid array length argument (fractional lengths not allowed)&quot;));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (length &lt; 0)
</span><del>-        return throwRangeError(exec, &quot;Requested length is negative&quot;);
</del><ins>+        return throwRangeError(exec, scope, &quot;Requested length is negative&quot;);
</ins><span class="cx">     return ViewClass::create(exec, structure, length);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -224,6 +229,9 @@
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL constructGenericTypedArrayView(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     InternalFunction* function = asInternalFunction(exec-&gt;callee());
</span><span class="cx">     Structure* parentStructure = function-&gt;globalObject()-&gt;typedArrayStructure(ViewClass::TypedArrayStorageType);
</span><span class="cx">     Structure* structure = InternalFunction::createSubclassStructure(exec, exec-&gt;newTarget(), parentStructure);
</span><span class="lines">@@ -234,7 +242,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (!argCount) {
</span><span class="cx">         if (ViewClass::TypedArrayStorageType == TypeDataView)
</span><del>-            return throwVMTypeError(exec, ASCIILiteral(&quot;DataView constructor requires at least one argument.&quot;));
</del><ins>+            return throwVMTypeError(exec, scope, ASCIILiteral(&quot;DataView constructor requires at least one argument.&quot;));
</ins><span class="cx"> 
</span><span class="cx">         return JSValue::encode(ViewClass::create(exec, structure, 0));
</span><span class="cx">     }
</span><span class="lines">@@ -268,7 +276,9 @@
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callGenericTypedArrayView(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, ViewClass::info()-&gt;className));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, ViewClass::info()-&gt;className));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGenericTypedArrayViewInlinesh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewInlines.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -48,15 +48,17 @@
</span><span class="cx"> JSGenericTypedArrayView&lt;Adaptor&gt;* JSGenericTypedArrayView&lt;Adaptor&gt;::create(
</span><span class="cx">     ExecState* exec, Structure* structure, unsigned length)
</span><span class="cx"> {
</span><del>-    ConstructionContext context(exec-&gt;vm(), structure, length, sizeof(typename Adaptor::Type));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    ConstructionContext context(vm, structure, length, sizeof(typename Adaptor::Type));
</ins><span class="cx">     if (!context) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     JSGenericTypedArrayView* result =
</span><del>-        new (NotNull, allocateCell&lt;JSGenericTypedArrayView&gt;(exec-&gt;vm().heap))
-        JSGenericTypedArrayView(exec-&gt;vm(), context);
-    result-&gt;finishCreation(exec-&gt;vm());
</del><ins>+        new (NotNull, allocateCell&lt;JSGenericTypedArrayView&gt;(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result-&gt;finishCreation(vm);
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -64,17 +66,19 @@
</span><span class="cx"> JSGenericTypedArrayView&lt;Adaptor&gt;* JSGenericTypedArrayView&lt;Adaptor&gt;::createUninitialized(
</span><span class="cx">     ExecState* exec, Structure* structure, unsigned length)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     ConstructionContext context(
</span><del>-        exec-&gt;vm(), structure, length, sizeof(typename Adaptor::Type),
</del><ins>+        vm, structure, length, sizeof(typename Adaptor::Type),
</ins><span class="cx">         ConstructionContext::DontInitialize);
</span><span class="cx">     if (!context) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     JSGenericTypedArrayView* result =
</span><del>-        new (NotNull, allocateCell&lt;JSGenericTypedArrayView&gt;(exec-&gt;vm().heap))
-        JSGenericTypedArrayView(exec-&gt;vm(), context);
-    result-&gt;finishCreation(exec-&gt;vm());
</del><ins>+        new (NotNull, allocateCell&lt;JSGenericTypedArrayView&gt;(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result-&gt;finishCreation(vm);
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -83,22 +87,24 @@
</span><span class="cx">     ExecState* exec, Structure* structure, PassRefPtr&lt;ArrayBuffer&gt; passedBuffer,
</span><span class="cx">     unsigned byteOffset, unsigned length)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     RefPtr&lt;ArrayBuffer&gt; buffer = passedBuffer;
</span><span class="cx">     size_t size = sizeof(typename Adaptor::Type);
</span><span class="cx">     if (!ArrayBufferView::verifySubRangeLength(buffer, byteOffset, length, size)) {
</span><del>-        exec-&gt;vm().throwException(exec, createRangeError(exec, &quot;Length out of range of buffer&quot;));
</del><ins>+        throwException(exec, scope, createRangeError(exec, &quot;Length out of range of buffer&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     if (!ArrayBufferView::verifyByteOffsetAlignment(byteOffset, size)) {
</span><del>-        exec-&gt;vm().throwException(exec, createRangeError(exec, &quot;Byte offset is not aligned&quot;));
</del><ins>+        throwException(exec, scope, createRangeError(exec, &quot;Byte offset is not aligned&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><del>-    ConstructionContext context(exec-&gt;vm(), structure, buffer, byteOffset, length);
</del><ins>+    ConstructionContext context(vm, structure, buffer, byteOffset, length);
</ins><span class="cx">     ASSERT(context);
</span><span class="cx">     JSGenericTypedArrayView* result =
</span><del>-        new (NotNull, allocateCell&lt;JSGenericTypedArrayView&gt;(exec-&gt;vm().heap))
-        JSGenericTypedArrayView(exec-&gt;vm(), context);
-    result-&gt;finishCreation(exec-&gt;vm());
</del><ins>+        new (NotNull, allocateCell&lt;JSGenericTypedArrayView&gt;(vm.heap))
+        JSGenericTypedArrayView(vm, context);
+    result-&gt;finishCreation(vm);
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -128,10 +134,12 @@
</span><span class="cx"> bool JSGenericTypedArrayView&lt;Adaptor&gt;::validateRange(
</span><span class="cx">     ExecState* exec, unsigned offset, unsigned length)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (canAccessRangeQuickly(offset, length))
</span><span class="cx">         return true;
</span><span class="cx">     
</span><del>-    exec-&gt;vm().throwException(exec, createRangeError(exec, &quot;Range consisting of offset and length are out of bounds&quot;));
</del><ins>+    throwException(exec, scope, createRangeError(exec, &quot;Range consisting of offset and length are out of bounds&quot;));
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -290,8 +298,10 @@
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="cx"> EncodedJSValue JSGenericTypedArrayView&lt;Adaptor&gt;::throwNeuteredTypedArrayTypeError(ExecState* exec, EncodedJSValue object, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     ASSERT_UNUSED(object, jsCast&lt;JSGenericTypedArrayView*&gt;(JSValue::decode(object))-&gt;isNeutered());
</span><del>-    return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+    return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename Adaptor&gt;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGenericTypedArrayViewPrototypeFunctionsh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -47,6 +47,9 @@
</span><span class="cx"> template&lt;typename Functor&gt;
</span><span class="cx"> inline JSArrayBufferView* speciesConstruct(ExecState* exec, JSObject* exemplar, MarkedArgumentBuffer&amp; args, const Functor&amp; defaultConstructor)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue constructor = exemplar-&gt;get(exec, exec-&gt;propertyNames().constructor);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return nullptr;
</span><span class="lines">@@ -54,7 +57,7 @@
</span><span class="cx">     if (constructor.isUndefined())
</span><span class="cx">         return defaultConstructor();
</span><span class="cx">     if (!constructor.isObject()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;constructor Property should not be null&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;constructor Property should not be null&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -73,11 +76,11 @@
</span><span class="cx">         if (!view-&gt;isNeutered())
</span><span class="cx">             return view;
</span><span class="cx"> 
</span><del>-        throwTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        throwTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    throwTypeError(exec, ASCIILiteral(&quot;species constructor did not return a TypedArray View&quot;));
</del><ins>+    throwTypeError(exec, scope, ASCIILiteral(&quot;species constructor did not return a TypedArray View&quot;));
</ins><span class="cx">     return nullptr;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -96,43 +99,45 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncSet(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncSet(VM&amp; vm, ExecState* exec)
</ins><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 22.2.3.22
</span><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="cx"> 
</span><del>-    if (!exec-&gt;argumentCount())
-        return throwVMTypeError(exec, ASCIILiteral(&quot;Expected at least one argument&quot;));
</del><ins>+    if (UNLIKELY(!exec-&gt;argumentCount()))
+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Expected at least one argument&quot;));
</ins><span class="cx"> 
</span><span class="cx">     unsigned offset;
</span><span class="cx">     if (exec-&gt;argumentCount() &gt;= 2) {
</span><span class="cx">         double offsetNumber = exec-&gt;uncheckedArgument(1).toInteger(exec);
</span><del>-        if (exec-&gt;hadException())
</del><ins>+        if (UNLIKELY(scope.exception()))
</ins><span class="cx">             return JSValue::encode(jsUndefined());
</span><del>-        if (offsetNumber &lt; 0)
-            return throwVMRangeError(exec, &quot;Offset should not be negative&quot;);
</del><ins>+        if (UNLIKELY(offsetNumber &lt; 0))
+            return throwVMRangeError(exec, scope, &quot;Offset should not be negative&quot;);
</ins><span class="cx">         offset = static_cast&lt;unsigned&gt;(std::min(offsetNumber, static_cast&lt;double&gt;(std::numeric_limits&lt;unsigned&gt;::max())));
</span><span class="cx">     } else
</span><span class="cx">         offset = 0;
</span><span class="cx"> 
</span><del>-    if (thisObject-&gt;isNeutered())
-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+    if (UNLIKELY(thisObject-&gt;isNeutered()))
+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     JSObject* sourceArray = jsDynamicCast&lt;JSObject*&gt;(exec-&gt;uncheckedArgument(0));
</span><del>-    if (!sourceArray)
-        return throwVMTypeError(exec, ASCIILiteral(&quot;First argument should be an object&quot;));
</del><ins>+    if (UNLIKELY(!sourceArray))
+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;First argument should be an object&quot;));
</ins><span class="cx"> 
</span><span class="cx">     unsigned length;
</span><span class="cx">     if (isTypedView(sourceArray-&gt;classInfo()-&gt;typedArrayStorageType)) {
</span><span class="cx">         JSArrayBufferView* sourceView = jsCast&lt;JSArrayBufferView*&gt;(sourceArray);
</span><del>-        if (sourceView-&gt;isNeutered())
-            return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        if (UNLIKELY(sourceView-&gt;isNeutered()))
+            return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">         length = jsCast&lt;JSArrayBufferView*&gt;(sourceArray)-&gt;length();
</span><span class="cx">     } else
</span><del>-        length = sourceArray-&gt;get(exec, exec-&gt;vm().propertyNames-&gt;length).toUInt32(exec);
</del><ins>+        length = sourceArray-&gt;get(exec, vm.propertyNames-&gt;length).toUInt32(exec);
</ins><span class="cx"> 
</span><del>-    if (exec-&gt;hadException())
</del><ins>+    if (UNLIKELY(scope.exception()))
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><span class="cx">     thisObject-&gt;set(exec, offset, sourceArray, 0, length, CopyType::Unobservable);
</span><span class="lines">@@ -140,13 +145,15 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncCopyWithin(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncCopyWithin(VM&amp; vm, ExecState* exec)
</ins><span class="cx"> {
</span><ins>+//    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 22.2.3.5
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     long length = thisObject-&gt;length();
</span><span class="cx">     long to = argumentClampedIndexFromStartOrEnd(exec, 0, length);
</span><span class="lines">@@ -165,7 +172,7 @@
</span><span class="cx">     long count = std::min(length - std::max(to, from), final - from);
</span><span class="cx"> 
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     typename ViewClass::ElementType* array = thisObject-&gt;typedVector();
</span><span class="cx">     memmove(array + to, array + from, count * thisObject-&gt;elementSize);
</span><span class="lines">@@ -174,12 +181,14 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIncludes(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIncludes(VM&amp; vm, ExecState* exec)
</ins><span class="cx"> {
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><ins>+//    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     unsigned length = thisObject-&gt;length();
</span><span class="cx"> 
</span><span class="lines">@@ -193,7 +202,7 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     typename ViewClass::ElementType* array = thisObject-&gt;typedVector();
</span><span class="cx">     auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
</span><span class="lines">@@ -219,16 +228,18 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIndexOf(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncIndexOf(VM&amp; vm, ExecState* exec)
</ins><span class="cx"> {
</span><ins>+//    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 22.2.3.13
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     if (!exec-&gt;argumentCount())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Expected at least one argument&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Expected at least one argument&quot;));
</ins><span class="cx"> 
</span><span class="cx">     unsigned length = thisObject-&gt;length();
</span><span class="cx"> 
</span><span class="lines">@@ -238,7 +249,7 @@
</span><span class="cx">         return encodedJSValue();
</span><span class="cx"> 
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     typename ViewClass::ElementType* array = thisObject-&gt;typedVector();
</span><span class="cx">     auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
</span><span class="lines">@@ -256,11 +267,14 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncJoin(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncJoin(VM&amp; vm, ExecState* exec)
</ins><span class="cx"> {
</span><ins>+//    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     // 22.2.3.14
</span><span class="cx">     auto joinWithSeparator = [&amp;] (StringView separator) -&gt; EncodedJSValue {
</span><span class="lines">@@ -289,21 +303,23 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx">     return joinWithSeparator(separatorString-&gt;view(exec).get());
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncLastIndexOf(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncLastIndexOf(VM&amp; vm, ExecState* exec)
</ins><span class="cx"> {
</span><ins>+//    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 22.2.3.16
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     if (!exec-&gt;argumentCount())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Expected at least one argument&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Expected at least one argument&quot;));
</ins><span class="cx"> 
</span><span class="cx">     unsigned length = thisObject-&gt;length();
</span><span class="cx"> 
</span><span class="lines">@@ -326,7 +342,7 @@
</span><span class="cx">         return JSValue::encode(JSValue());
</span><span class="cx"> 
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     auto targetOption = ViewClass::toAdaptorNativeFromValueWithoutCoercion(valueToFind);
</span><span class="cx">     if (!targetOption)
</span><span class="lines">@@ -345,7 +361,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncBuffer(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncBuffer(VM&amp;, ExecState* exec)
</ins><span class="cx"> {
</span><span class="cx">     // 22.2.3.3
</span><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="lines">@@ -354,7 +370,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncLength(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncLength(VM&amp;, ExecState* exec)
</ins><span class="cx"> {
</span><span class="cx">     // 22.2.3.17
</span><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="lines">@@ -363,7 +379,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncByteLength(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncByteLength(VM&amp;, ExecState* exec)
</ins><span class="cx"> {
</span><span class="cx">     // 22.2.3.2
</span><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="lines">@@ -372,7 +388,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncByteOffset(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoGetterFuncByteOffset(VM&amp;, ExecState* exec)
</ins><span class="cx"> {
</span><span class="cx">     // 22.2.3.3
</span><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="lines">@@ -381,12 +397,15 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncReverse(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncReverse(VM&amp; vm, ExecState* exec)
</ins><span class="cx"> {
</span><ins>+//    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 22.2.3.21
</span><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     typename ViewClass::ElementType* array = thisObject-&gt;typedVector();
</span><span class="cx">     std::reverse(array, array + thisObject-&gt;length());
</span><span class="lines">@@ -395,12 +414,15 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewPrivateFuncSort(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewPrivateFuncSort(VM&amp; vm, ExecState* exec)
</ins><span class="cx"> {
</span><ins>+//    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 22.2.3.25
</span><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;argument(0));
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     thisObject-&gt;sort();
</span><span class="cx"> 
</span><span class="lines">@@ -408,15 +430,17 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncSlice(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewProtoFuncSlice(VM&amp; vm, ExecState* exec)
</ins><span class="cx"> {
</span><ins>+//    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 22.2.3.26
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     JSFunction* callee = jsCast&lt;JSFunction*&gt;(exec-&gt;callee());
</span><span class="cx"> 
</span><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     unsigned thisLength = thisObject-&gt;length();
</span><span class="cx"> 
</span><span class="lines">@@ -428,7 +452,7 @@
</span><span class="cx">         return encodedJSValue();
</span><span class="cx"> 
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     // Clamp end to begin.
</span><span class="cx">     end = std::max(begin, end);
</span><span class="lines">@@ -448,7 +472,7 @@
</span><span class="cx"> 
</span><span class="cx">     ASSERT(!result-&gt;isNeutered());
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     // We return early here since we don't allocate a backing store if length is 0 and memmove does not like nullptrs
</span><span class="cx">     if (!length)
</span><span class="lines">@@ -492,15 +516,17 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename ViewClass&gt;
</span><del>-EncodedJSValue JSC_HOST_CALL genericTypedArrayViewPrivateFuncSubarrayCreate(ExecState* exec)
</del><ins>+EncodedJSValue JSC_HOST_CALL genericTypedArrayViewPrivateFuncSubarrayCreate(VM&amp;vm, ExecState* exec)
</ins><span class="cx"> {
</span><ins>+//    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 22.2.3.23
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     JSFunction* callee = jsCast&lt;JSFunction*&gt;(exec-&gt;callee());
</span><span class="cx"> 
</span><span class="cx">     ViewClass* thisObject = jsCast&lt;ViewClass*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, typedArrayBufferHasBeenDetachedErrorMessage);
</del><ins>+        return throwVMTypeError(exec, scope, typedArrayBufferHasBeenDetachedErrorMessage);
</ins><span class="cx"> 
</span><span class="cx">     // Get the length here; later assert that the length didn't change.
</span><span class="cx">     unsigned thisLength = thisObject-&gt;length();
</span><span class="lines">@@ -552,7 +578,7 @@
</span><span class="cx">     if (jsDynamicCast&lt;JSArrayBufferView*&gt;(result))
</span><span class="cx">         return JSValue::encode(result);
</span><span class="cx"> 
</span><del>-    throwTypeError(exec, &quot;species constructor did not return a TypedArray View&quot;);
</del><ins>+    throwTypeError(exec, scope, &quot;species constructor did not return a TypedArray View&quot;);
</ins><span class="cx">     return JSValue::encode(JSValue());
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1202,19 +1202,22 @@
</span><span class="cx"> 
</span><span class="cx"> UnlinkedEvalCodeBlock* JSGlobalObject::createEvalCodeBlock(CallFrame* callFrame, EvalExecutable* executable, const VariableEnvironment* variablesUnderTDZ)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = this-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ParserError error;
</span><span class="cx">     JSParserStrictMode strictMode = executable-&gt;isStrictMode() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
</span><span class="cx">     DebuggerMode debuggerMode = hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
</span><span class="cx">     EvalContextType evalContextType = executable-&gt;executableInfo().evalContextType();
</span><span class="cx">     
</span><del>-    UnlinkedEvalCodeBlock* unlinkedCodeBlock = vm().codeCache()-&gt;getEvalCodeBlock(
-        vm(), executable, executable-&gt;source(), JSParserBuiltinMode::NotBuiltin, strictMode, debuggerMode, error, evalContextType, variablesUnderTDZ);
</del><ins>+    UnlinkedEvalCodeBlock* unlinkedCodeBlock = vm.codeCache()-&gt;getEvalCodeBlock(
+        vm, executable, executable-&gt;source(), JSParserBuiltinMode::NotBuiltin, strictMode, debuggerMode, error, evalContextType, variablesUnderTDZ);
</ins><span class="cx"> 
</span><span class="cx">     if (hasDebugger())
</span><span class="cx">         debugger()-&gt;sourceParsed(callFrame, executable-&gt;source().provider(), error.line(), error.message());
</span><span class="cx"> 
</span><span class="cx">     if (error.isValid()) {
</span><del>-        throwVMError(callFrame, error.toErrorObject(this, executable-&gt;source()));
</del><ins>+        throwVMError(callFrame, scope, error.toErrorObject(this, executable-&gt;source()));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1223,16 +1226,19 @@
</span><span class="cx"> 
</span><span class="cx"> UnlinkedModuleProgramCodeBlock* JSGlobalObject::createModuleProgramCodeBlock(CallFrame* callFrame, ModuleProgramExecutable* executable)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = this-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ParserError error;
</span><span class="cx">     DebuggerMode debuggerMode = hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
</span><del>-    UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock = vm().codeCache()-&gt;getModuleProgramCodeBlock(
-        vm(), executable, executable-&gt;source(), JSParserBuiltinMode::NotBuiltin, debuggerMode, error);
</del><ins>+    UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock = vm.codeCache()-&gt;getModuleProgramCodeBlock(
+        vm, executable, executable-&gt;source(), JSParserBuiltinMode::NotBuiltin, debuggerMode, error);
</ins><span class="cx"> 
</span><span class="cx">     if (hasDebugger())
</span><span class="cx">         debugger()-&gt;sourceParsed(callFrame, executable-&gt;source().provider(), error.line(), error.message());
</span><span class="cx"> 
</span><span class="cx">     if (error.isValid()) {
</span><del>-        throwVMError(callFrame, error.toErrorObject(this, executable-&gt;source()));
</del><ins>+        throwVMError(callFrame, scope, error.toErrorObject(this, executable-&gt;source()));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
</span><span class="cx">  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
</span><del>- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2012, 2016 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2003-2009, 2012, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
</span><span class="cx">  *  Copyright (C) 2007 Maks Orlovich
</span><span class="cx">  *
</span><span class="lines">@@ -76,11 +76,14 @@
</span><span class="cx"> template&lt;typename CharacterType&gt;
</span><span class="cx"> static JSValue encode(ExecState* exec, const Bitmap&lt;256&gt;&amp; doNotEscape, const CharacterType* characters, unsigned length)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 18.2.6.1.1 Runtime Semantics: Encode ( string, unescapedSet )
</span><span class="cx">     // https://tc39.github.io/ecma262/#sec-encode
</span><span class="cx"> 
</span><del>-    auto throwException = [exec] {
-        return exec-&gt;vm().throwException(exec, createURIError(exec, ASCIILiteral(&quot;String contained an illegal UTF-16 sequence.&quot;)));
</del><ins>+    auto throwException = [&amp;scope, exec] {
+        return JSC::throwException(exec, scope, createURIError(exec, ASCIILiteral(&quot;String contained an illegal UTF-16 sequence.&quot;)));
</ins><span class="cx">     };
</span><span class="cx"> 
</span><span class="cx">     StringBuilder builder;
</span><span class="lines">@@ -163,6 +166,9 @@
</span><span class="cx"> ALWAYS_INLINE
</span><span class="cx"> static JSValue decode(ExecState* exec, const CharType* characters, int length, const Bitmap&lt;256&gt;&amp; doNotUnescape, bool strict)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSStringBuilder builder;
</span><span class="cx">     int k = 0;
</span><span class="cx">     UChar u = 0;
</span><span class="lines">@@ -203,7 +209,7 @@
</span><span class="cx">             }
</span><span class="cx">             if (charLen == 0) {
</span><span class="cx">                 if (strict)
</span><del>-                    return exec-&gt;vm().throwException(exec, createURIError(exec, ASCIILiteral(&quot;URI error&quot;)));
</del><ins>+                    return throwException(exec, scope, createURIError(exec, ASCIILiteral(&quot;URI error&quot;)));
</ins><span class="cx">                 // The only case where we don't use &quot;strict&quot; mode is the &quot;unescape&quot; function.
</span><span class="cx">                 // For that, it's good to support the wonky &quot;%u&quot; syntax for compatibility with WinIE.
</span><span class="cx">                 if (k &lt;= length - 6 &amp;&amp; p[1] == 'u'
</span><span class="lines">@@ -640,6 +646,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue x = exec-&gt;argument(0);
</span><span class="cx">     if (!x.isString())
</span><span class="cx">         return JSValue::encode(x);
</span><span class="lines">@@ -646,7 +655,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSGlobalObject* globalObject = exec-&gt;lexicalGlobalObject();
</span><span class="cx">     if (!globalObject-&gt;evalEnabled()) {
</span><del>-        exec-&gt;vm().throwException(exec, createEvalError(exec, globalObject-&gt;evalDisabledErrorMessage()));
</del><ins>+        throwException(exec, scope, createEvalError(exec, globalObject-&gt;evalDisabledErrorMessage()));
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -845,12 +854,16 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeError(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return throwVMTypeError(exec);
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMTypeError(exec, scope);
</ins><span class="cx"> }
</span><span class="cx">     
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeErrorArgumentsCalleeAndCaller(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return throwVMTypeError(exec, &quot;'arguments', 'callee', and 'caller' cannot be accessed in strict mode.&quot;);
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMTypeError(exec, scope, &quot;'arguments', 'callee', and 'caller' cannot be accessed in strict mode.&quot;);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> class GlobalFuncProtoGetterFunctor {
</span><span class="lines">@@ -887,9 +900,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncProtoGetter(ExecState* exec)
</span><span class="cx"> {
</span><del>-    if (exec-&gt;thisValue().isUndefinedOrNull()) 
-        return throwVMTypeError(exec, ASCIILiteral(&quot;Can't convert undefined or null to object&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><ins>+    if (exec-&gt;thisValue().isUndefinedOrNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Can't convert undefined or null to object&quot;));
+
</ins><span class="cx">     JSObject* thisObject = jsDynamicCast&lt;JSObject*&gt;(exec-&gt;thisValue().toThis(exec, NotStrictMode));
</span><span class="cx"> 
</span><span class="cx">     if (!thisObject) {
</span><span class="lines">@@ -944,9 +960,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncProtoSetter(ExecState* exec)
</span><span class="cx"> {
</span><del>-    if (exec-&gt;thisValue().isUndefinedOrNull()) 
-        return throwVMTypeError(exec, ASCIILiteral(&quot;Can't convert undefined or null to object&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><ins>+    if (exec-&gt;thisValue().isUndefinedOrNull())
+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Can't convert undefined or null to object&quot;));
+
</ins><span class="cx">     JSValue value = exec-&gt;argument(0);
</span><span class="cx"> 
</span><span class="cx">     JSObject* thisObject = jsDynamicCast&lt;JSObject*&gt;(exec-&gt;thisValue().toThis(exec, NotStrictMode));
</span><span class="lines">@@ -962,7 +981,6 @@
</span><span class="cx">     if (!value.isObject() &amp;&amp; !value.isNull())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     bool shouldThrowIfCantSet = true;
</span><span class="cx">     thisObject-&gt;setPrototype(vm, exec, value, shouldThrowIfCantSet);
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSModuleEnvironmentcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleEnvironment.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -110,11 +110,14 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSModuleEnvironment::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSModuleEnvironment* thisObject = jsCast&lt;JSModuleEnvironment*&gt;(cell);
</span><span class="cx">     // All imported bindings are immutable.
</span><span class="cx">     JSModuleRecord::Resolution resolution = thisObject-&gt;moduleRecord()-&gt;resolveImport(exec, Identifier::fromUid(exec, propertyName.uid()));
</span><span class="cx">     if (resolution.type == JSModuleRecord::Resolution::Type::Resolved) {
</span><del>-        throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     return Base::put(thisObject, exec, propertyName, value, slot);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSModuleNamespaceObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -100,6 +100,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSModuleNamespaceObject::getOwnPropertySlot(JSObject* cell, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-getownproperty-p
</span><span class="cx"> 
</span><span class="cx">     JSModuleNamespaceObject* thisObject = jsCast&lt;JSModuleNamespaceObject*&gt;(cell);
</span><span class="lines">@@ -129,7 +132,7 @@
</span><span class="cx">         JSModuleEnvironment* targetEnvironment = targetModule-&gt;moduleEnvironment();
</span><span class="cx"> 
</span><span class="cx">         PropertySlot trampolineSlot(targetEnvironment, PropertySlot::InternalMethodType::Get);
</span><del>-        bool found = targetEnvironment-&gt;methodTable(exec-&gt;vm())-&gt;getOwnPropertySlot(targetEnvironment, exec, resolution.localName, trampolineSlot);
</del><ins>+        bool found = targetEnvironment-&gt;methodTable(vm)-&gt;getOwnPropertySlot(targetEnvironment, exec, resolution.localName, trampolineSlot);
</ins><span class="cx">         ASSERT_UNUSED(found, found);
</span><span class="cx"> 
</span><span class="cx">         JSValue value = trampolineSlot.getValue(exec, propertyName);
</span><span class="lines">@@ -137,7 +140,7 @@
</span><span class="cx"> 
</span><span class="cx">         // If the value is filled with TDZ value, throw a reference error.
</span><span class="cx">         if (!value) {
</span><del>-            throwVMError(exec, createTDZError(exec));
</del><ins>+            throwVMError(exec, scope, createTDZError(exec));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -162,16 +165,22 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSModuleNamespaceObject::put(JSCell*, ExecState* exec, PropertyName, JSValue, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-set-p-v-receiver
</span><span class="cx">     if (slot.isStrictMode())
</span><del>-        throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSModuleNamespaceObject::putByIndex(JSCell*, ExecState* exec, unsigned, JSValue, bool shouldThrow)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (shouldThrow)
</span><del>-        throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -193,17 +202,23 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSModuleNamespaceObject::defineOwnProperty(JSObject*, ExecState* exec, PropertyName, const PropertyDescriptor&amp;, bool shouldThrow)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // http://www.ecma-international.org/ecma-262/6.0/#sec-module-namespace-exotic-objects-defineownproperty-p-desc
</span><span class="cx">     if (shouldThrow)
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Attempting to define property on object that is not extensible.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to define property on object that is not extensible.&quot;));
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL moduleNamespaceObjectSymbolIterator(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSModuleNamespaceObject* object = jsDynamicCast&lt;JSModuleNamespaceObject*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (!object)
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;|this| should be a module namespace object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;|this| should be a module namespace object&quot;));
</ins><span class="cx">     return JSValue::encode(JSPropertyNameIterator::create(exec, exec-&gt;lexicalGlobalObject()-&gt;propertyNameIteratorStructure(), object));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSModuleRecordcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleRecord.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleRecord.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSModuleRecord.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -681,6 +681,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSModuleNamespaceObject* JSModuleRecord::getModuleNamespace(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // http://www.ecma-international.org/ecma-262/6.0/#sec-getmodulenamespace
</span><span class="cx">     if (m_moduleNamespaceObject)
</span><span class="cx">         return m_moduleNamespaceObject.get();
</span><span class="lines">@@ -694,11 +697,11 @@
</span><span class="cx">         const JSModuleRecord::Resolution resolution = resolveExport(exec, Identifier::fromUid(exec, name.get()));
</span><span class="cx">         switch (resolution.type) {
</span><span class="cx">         case Resolution::Type::NotFound:
</span><del>-            throwSyntaxError(exec, makeString(&quot;Exported binding name '&quot;, String(name.get()), &quot;' is not found.&quot;));
</del><ins>+            throwSyntaxError(exec, scope, makeString(&quot;Exported binding name '&quot;, String(name.get()), &quot;' is not found.&quot;));
</ins><span class="cx">             return nullptr;
</span><span class="cx"> 
</span><span class="cx">         case Resolution::Type::Error:
</span><del>-            throwSyntaxError(exec, makeString(&quot;Exported binding name 'default' cannot be resolved by star export entries.&quot;));
</del><ins>+            throwSyntaxError(exec, scope, makeString(&quot;Exported binding name 'default' cannot be resolved by star export entries.&quot;));
</ins><span class="cx">             return nullptr;
</span><span class="cx"> 
</span><span class="cx">         case Resolution::Type::Ambiguous:
</span><span class="lines">@@ -710,30 +713,34 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    m_moduleNamespaceObject.set(exec-&gt;vm(), this, JSModuleNamespaceObject::create(exec, globalObject, globalObject-&gt;moduleNamespaceObjectStructure(), this, unambiguousNames));
</del><ins>+    m_moduleNamespaceObject.set(vm, this, JSModuleNamespaceObject::create(exec, globalObject, globalObject-&gt;moduleNamespaceObjectStructure(), this, unambiguousNames));
</ins><span class="cx">     return m_moduleNamespaceObject.get();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JSModuleRecord::link(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ModuleProgramExecutable* executable = ModuleProgramExecutable::create(exec, sourceCode());
</span><span class="cx">     if (!executable) {
</span><del>-        throwSyntaxError(exec);
</del><ins>+        throwSyntaxError(exec, scope);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><del>-    m_moduleProgramExecutable.set(exec-&gt;vm(), this, executable);
</del><ins>+    m_moduleProgramExecutable.set(vm, this, executable);
</ins><span class="cx">     instantiateDeclarations(exec, executable);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JSModuleRecord::instantiateDeclarations(ExecState* exec, ModuleProgramExecutable* moduleProgramExecutable)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // http://www.ecma-international.org/ecma-262/6.0/#sec-moduledeclarationinstantiation
</span><span class="cx"> 
</span><span class="cx">     SymbolTable* symbolTable = moduleProgramExecutable-&gt;moduleEnvironmentSymbolTable();
</span><del>-    JSModuleEnvironment* moduleEnvironment = JSModuleEnvironment::create(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), exec-&gt;lexicalGlobalObject(), symbolTable, jsTDZValue(), this);
</del><ins>+    JSModuleEnvironment* moduleEnvironment = JSModuleEnvironment::create(vm, exec-&gt;lexicalGlobalObject(), exec-&gt;lexicalGlobalObject(), symbolTable, jsTDZValue(), this);
</ins><span class="cx"> 
</span><del>-    VM&amp; vm = exec-&gt;vm();
-
</del><span class="cx">     // http://www.ecma-international.org/ecma-262/6.0/#sec-moduledeclarationinstantiation
</span><span class="cx">     // section 15.2.1.16.4 step 9.
</span><span class="cx">     // Ensure all the indirect exports are correctly resolved to unique bindings.
</span><span class="lines">@@ -745,15 +752,15 @@
</span><span class="cx">             Resolution resolution = resolveExport(exec, exportEntry.exportName);
</span><span class="cx">             switch (resolution.type) {
</span><span class="cx">             case Resolution::Type::NotFound:
</span><del>-                throwSyntaxError(exec, makeString(&quot;Indirectly exported binding name '&quot;, String(exportEntry.exportName.impl()), &quot;' is not found.&quot;));
</del><ins>+                throwSyntaxError(exec, scope, makeString(&quot;Indirectly exported binding name '&quot;, String(exportEntry.exportName.impl()), &quot;' is not found.&quot;));
</ins><span class="cx">                 return;
</span><span class="cx"> 
</span><span class="cx">             case Resolution::Type::Ambiguous:
</span><del>-                throwSyntaxError(exec, makeString(&quot;Indirectly exported binding name '&quot;, String(exportEntry.exportName.impl()), &quot;' cannot be resolved due to ambiguous multiple bindings.&quot;));
</del><ins>+                throwSyntaxError(exec, scope, makeString(&quot;Indirectly exported binding name '&quot;, String(exportEntry.exportName.impl()), &quot;' cannot be resolved due to ambiguous multiple bindings.&quot;));
</ins><span class="cx">                 return;
</span><span class="cx"> 
</span><span class="cx">             case Resolution::Type::Error:
</span><del>-                throwSyntaxError(exec, makeString(&quot;Indirectly exported binding name 'default' cannot be resolved by star export entries.&quot;));
</del><ins>+                throwSyntaxError(exec, scope, makeString(&quot;Indirectly exported binding name 'default' cannot be resolved by star export entries.&quot;));
</ins><span class="cx">                 return;
</span><span class="cx"> 
</span><span class="cx">             case Resolution::Type::Resolved:
</span><span class="lines">@@ -779,15 +786,15 @@
</span><span class="cx">             Resolution resolution = importedModule-&gt;resolveExport(exec, importEntry.importName);
</span><span class="cx">             switch (resolution.type) {
</span><span class="cx">             case Resolution::Type::NotFound:
</span><del>-                throwSyntaxError(exec, makeString(&quot;Importing binding name '&quot;, String(importEntry.importName.impl()), &quot;' is not found.&quot;));
</del><ins>+                throwSyntaxError(exec, scope, makeString(&quot;Importing binding name '&quot;, String(importEntry.importName.impl()), &quot;' is not found.&quot;));
</ins><span class="cx">                 return;
</span><span class="cx"> 
</span><span class="cx">             case Resolution::Type::Ambiguous:
</span><del>-                throwSyntaxError(exec, makeString(&quot;Importing binding name '&quot;, String(importEntry.importName.impl()), &quot;' cannot be resolved due to ambiguous multiple bindings.&quot;));
</del><ins>+                throwSyntaxError(exec, scope, makeString(&quot;Importing binding name '&quot;, String(importEntry.importName.impl()), &quot;' cannot be resolved due to ambiguous multiple bindings.&quot;));
</ins><span class="cx">                 return;
</span><span class="cx"> 
</span><span class="cx">             case Resolution::Type::Error:
</span><del>-                throwSyntaxError(exec, makeString(&quot;Importing binding name 'default' cannot be resolved by star export entries.&quot;));
</del><ins>+                throwSyntaxError(exec, scope, makeString(&quot;Importing binding name 'default' cannot be resolved by star export entries.&quot;));
</ins><span class="cx">                 return;
</span><span class="cx"> 
</span><span class="cx">             case Resolution::Type::Resolved:
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSONObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSONObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSONObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSONObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -297,6 +297,8 @@
</span><span class="cx"> Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&amp; builder, JSValue value, JSObject* holder, const PropertyNameForFunctionCall&amp; propertyName)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = m_exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // Call the toJSON function.
</span><span class="cx">     value = toJSON(value, propertyName);
</span><span class="cx">     if (vm.exception())
</span><span class="lines">@@ -368,7 +370,7 @@
</span><span class="cx">     // Handle cycle detection, and put the holder on the stack.
</span><span class="cx">     for (unsigned i = 0; i &lt; m_holderStack.size(); i++) {
</span><span class="cx">         if (m_holderStack[i].object() == object) {
</span><del>-            throwTypeError(m_exec, ASCIILiteral(&quot;JSON.stringify cannot serialize cyclic structures.&quot;));
</del><ins>+            throwTypeError(m_exec, scope, ASCIILiteral(&quot;JSON.stringify cannot serialize cyclic structures.&quot;));
</ins><span class="cx">             return StringifyFailed;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -589,10 +591,13 @@
</span><span class="cx">                                  ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
</span><span class="cx"> NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = m_exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Vector&lt;PropertyNameArray, 16, UnsafeVectorOverflow&gt; propertyStack;
</span><span class="cx">     Vector&lt;uint32_t, 16, UnsafeVectorOverflow&gt; indexStack;
</span><del>-    LocalStack&lt;JSObject, 16&gt; objectStack(m_exec-&gt;vm());
-    LocalStack&lt;JSArray, 16&gt; arrayStack(m_exec-&gt;vm());
</del><ins>+    LocalStack&lt;JSObject, 16&gt; objectStack(vm);
+    LocalStack&lt;JSArray, 16&gt; arrayStack(vm);
</ins><span class="cx">     Vector&lt;unsigned, 16, UnsafeVectorOverflow&gt; arrayLengthStack;
</span><span class="cx">     
</span><span class="cx">     Vector&lt;WalkerState, 16, UnsafeVectorOverflow&gt; stateStack;
</span><span class="lines">@@ -607,7 +612,7 @@
</span><span class="cx">                 ASSERT(inValue.isObject());
</span><span class="cx">                 ASSERT(isJSArray(asObject(inValue)) || asObject(inValue)-&gt;inherits(JSArray::info()));
</span><span class="cx">                 if (objectStack.size() + arrayStack.size() &gt; maximumFilterRecursion)
</span><del>-                    return throwStackOverflowError(m_exec);
</del><ins>+                    return throwStackOverflowError(m_exec, scope);
</ins><span class="cx"> 
</span><span class="cx">                 JSArray* array = asArray(inValue);
</span><span class="cx">                 arrayStack.push(array);
</span><span class="lines">@@ -663,7 +668,7 @@
</span><span class="cx">                 ASSERT(inValue.isObject());
</span><span class="cx">                 ASSERT(!isJSArray(asObject(inValue)) &amp;&amp; !asObject(inValue)-&gt;inherits(JSArray::info()));
</span><span class="cx">                 if (objectStack.size() + arrayStack.size() &gt; maximumFilterRecursion)
</span><del>-                    return throwStackOverflowError(m_exec);
</del><ins>+                    return throwStackOverflowError(m_exec, scope);
</ins><span class="cx"> 
</span><span class="cx">                 JSObject* object = asObject(inValue);
</span><span class="cx">                 objectStack.push(object);
</span><span class="lines">@@ -736,7 +741,7 @@
</span><span class="cx">     }
</span><span class="cx">     JSObject* finalHolder = constructEmptyObject(m_exec);
</span><span class="cx">     PutPropertySlot slot(finalHolder);
</span><del>-    finalHolder-&gt;methodTable()-&gt;put(finalHolder, m_exec, m_exec-&gt;vm().propertyNames-&gt;emptyIdentifier, outValue, slot);
</del><ins>+    finalHolder-&gt;methodTable()-&gt;put(finalHolder, m_exec, vm.propertyNames-&gt;emptyIdentifier, outValue, slot);
</ins><span class="cx">     return callReviver(finalHolder, jsEmptyString(m_exec), outValue);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -743,24 +748,27 @@
</span><span class="cx"> // ECMA-262 v5 15.12.2
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!exec-&gt;argumentCount())
</span><del>-        return throwVMError(exec, createError(exec, ASCIILiteral(&quot;JSON.parse requires at least one parameter&quot;)));
</del><ins>+        return throwVMError(exec, scope, createError(exec, ASCIILiteral(&quot;JSON.parse requires at least one parameter&quot;)));
</ins><span class="cx">     JSString::SafeView source = exec-&gt;uncheckedArgument(0).toString(exec)-&gt;view(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsNull());
</span><span class="cx"> 
</span><span class="cx">     JSValue unfiltered;
</span><del>-    LocalScope scope(exec-&gt;vm());
</del><ins>+    LocalScope localScope(vm);
</ins><span class="cx">     if (source.is8Bit()) {
</span><span class="cx">         LiteralParser&lt;LChar&gt; jsonParser(exec, source.characters8(), source.length(), StrictJSON);
</span><span class="cx">         unfiltered = jsonParser.tryLiteralParse();
</span><span class="cx">         if (!unfiltered)
</span><del>-            return throwVMError(exec, createSyntaxError(exec, jsonParser.getErrorMessage()));
</del><ins>+            return throwVMError(exec, scope, createSyntaxError(exec, jsonParser.getErrorMessage()));
</ins><span class="cx">     } else {
</span><span class="cx">         LiteralParser&lt;UChar&gt; jsonParser(exec, source.characters16(), source.length(), StrictJSON);
</span><span class="cx">         unfiltered = jsonParser.tryLiteralParse();
</span><span class="cx">         if (!unfiltered)
</span><del>-            return throwVMError(exec, createSyntaxError(exec, jsonParser.getErrorMessage()));        
</del><ins>+            return throwVMError(exec, scope, createSyntaxError(exec, jsonParser.getErrorMessage()));
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     if (exec-&gt;argumentCount() &lt; 2)
</span><span class="lines">@@ -771,18 +779,21 @@
</span><span class="cx">     CallType callType = getCallData(function, callData);
</span><span class="cx">     if (callType == CallType::None)
</span><span class="cx">         return JSValue::encode(unfiltered);
</span><del>-    return JSValue::encode(Walker(exec, Local&lt;JSObject&gt;(exec-&gt;vm(), asObject(function)), callType, callData).walk(unfiltered));
</del><ins>+    return JSValue::encode(Walker(exec, Local&lt;JSObject&gt;(vm, asObject(function)), callType, callData).walk(unfiltered));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // ECMA-262 v5 15.12.3
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!exec-&gt;argumentCount())
</span><del>-        return throwVMError(exec, createError(exec, ASCIILiteral(&quot;No input to stringify&quot;)));
-    LocalScope scope(exec-&gt;vm());
-    Local&lt;Unknown&gt; value(exec-&gt;vm(), exec-&gt;uncheckedArgument(0));
-    Local&lt;Unknown&gt; replacer(exec-&gt;vm(), exec-&gt;argument(1));
-    Local&lt;Unknown&gt; space(exec-&gt;vm(), exec-&gt;argument(2));
</del><ins>+        return throwVMError(exec, scope, createError(exec, ASCIILiteral(&quot;No input to stringify&quot;)));
+    LocalScope localScope(vm);
+    Local&lt;Unknown&gt; value(vm, exec-&gt;uncheckedArgument(0));
+    Local&lt;Unknown&gt; replacer(vm, exec-&gt;argument(1));
+    Local&lt;Unknown&gt; space(vm, exec-&gt;argument(2));
</ins><span class="cx">     JSValue result = Stringifier(exec, replacer, space).stringify(value).get();
</span><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><span class="cx">  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
</span><del>- *  Copyright (C) 2003-2006, 2008, 2009, 2012-2016 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2003-2006, 2008-2009, 2012-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *  Copyright (C) 2007 Eric Seidel (eric@webkit.org)
</span><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="lines">@@ -1354,6 +1354,7 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSObject::setPrototypeWithCycleCheck(VM&amp; vm, ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     ASSERT(methodTable(vm)-&gt;toThis(this, exec, NotStrictMode) == this);
</span><span class="cx"> 
</span><span class="cx">     if (this-&gt;getPrototypeDirect() == prototype)
</span><span class="lines">@@ -1365,7 +1366,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (!isExtensible) {
</span><span class="cx">         if (shouldThrowIfCantSet)
</span><del>-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1374,7 +1375,7 @@
</span><span class="cx">     while (nextPrototype &amp;&amp; nextPrototype.isObject()) {
</span><span class="cx">         if (nextPrototype == this) {
</span><span class="cx">             if (shouldThrowIfCantSet)
</span><del>-                throwTypeError(exec, ASCIILiteral(&quot;cyclic __proto__ value&quot;));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(&quot;cyclic __proto__ value&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         if (UNLIKELY(asObject(nextPrototype)-&gt;methodTable(vm)-&gt;getPrototype != defaultGetPrototype))
</span><span class="lines">@@ -1616,15 +1617,18 @@
</span><span class="cx"> template&lt;TypeHintMode mode = TypeHintMode::DoesNotTakeHint&gt;
</span><span class="cx"> static ALWAYS_INLINE JSValue callToPrimitiveFunction(ExecState* exec, const JSObject* object, PropertyName propertyName, PreferredPrimitiveType hint)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue function = object-&gt;get(exec, propertyName);
</span><del>-    if (exec-&gt;hadException())
-        return exec-&gt;exception();
</del><ins>+    if (scope.exception())
+        return scope.exception();
</ins><span class="cx">     if (function.isUndefined() &amp;&amp; mode == TypeHintMode::TakesHint)
</span><span class="cx">         return JSValue();
</span><span class="cx">     CallData callData;
</span><span class="cx">     CallType callType = getCallData(function, callData);
</span><span class="cx">     if (callType == CallType::None)
</span><del>-        return exec-&gt;exception();
</del><ins>+        return scope.exception();
</ins><span class="cx"> 
</span><span class="cx">     MarkedArgumentBuffer callArgs;
</span><span class="cx">     if (mode == TypeHintMode::TakesHint) {
</span><span class="lines">@@ -1631,13 +1635,13 @@
</span><span class="cx">         JSString* hintString = nullptr;
</span><span class="cx">         switch (hint) {
</span><span class="cx">         case NoPreference:
</span><del>-            hintString = exec-&gt;vm().smallStrings.defaultString();
</del><ins>+            hintString = vm.smallStrings.defaultString();
</ins><span class="cx">             break;
</span><span class="cx">         case PreferNumber:
</span><del>-            hintString = exec-&gt;vm().smallStrings.numberString();
</del><ins>+            hintString = vm.smallStrings.numberString();
</ins><span class="cx">             break;
</span><span class="cx">         case PreferString:
</span><del>-            hintString = exec-&gt;vm().smallStrings.stringString();
</del><ins>+            hintString = vm.smallStrings.stringString();
</ins><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         callArgs.append(hintString);
</span><span class="lines">@@ -1645,10 +1649,10 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue result = call(exec, function, callType, callData, const_cast&lt;JSObject*&gt;(object), callArgs);
</span><span class="cx">     ASSERT(!result.isGetterSetter());
</span><del>-    if (exec-&gt;hadException())
-        return exec-&gt;exception();
</del><ins>+    if (scope.exception())
+        return scope.exception();
</ins><span class="cx">     if (result.isObject())
</span><del>-        return mode == TypeHintMode::DoesNotTakeHint ? JSValue() : throwTypeError(exec, ASCIILiteral(&quot;Symbol.toPrimitive returned an object&quot;));
</del><ins>+        return mode == TypeHintMode::DoesNotTakeHint ? JSValue() : throwTypeError(exec, scope, ASCIILiteral(&quot;Symbol.toPrimitive returned an object&quot;));
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1655,23 +1659,30 @@
</span><span class="cx"> // ECMA 7.1.1
</span><span class="cx"> JSValue JSObject::ordinaryToPrimitive(ExecState* exec, PreferredPrimitiveType hint) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // Make sure that whatever default value methods there are on object's prototype chain are
</span><span class="cx">     // being watched.
</span><del>-    this-&gt;structure()-&gt;startWatchingInternalPropertiesIfNecessaryForEntireChain(exec-&gt;vm());
</del><ins>+    this-&gt;structure()-&gt;startWatchingInternalPropertiesIfNecessaryForEntireChain(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSValue value;
</span><span class="cx">     if (hint == PreferString) {
</span><span class="cx">         value = callToPrimitiveFunction(exec, this, exec-&gt;propertyNames().toString, hint);
</span><ins>+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
</ins><span class="cx">         if (value)
</span><span class="cx">             return value;
</span><span class="cx">         value = callToPrimitiveFunction(exec, this, exec-&gt;propertyNames().valueOf, hint);
</span><ins>+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
</ins><span class="cx">         if (value)
</span><span class="cx">             return value;
</span><span class="cx">     } else {
</span><span class="cx">         value = callToPrimitiveFunction(exec, this, exec-&gt;propertyNames().valueOf, hint);
</span><ins>+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
</ins><span class="cx">         if (value)
</span><span class="cx">             return value;
</span><span class="cx">         value = callToPrimitiveFunction(exec, this, exec-&gt;propertyNames().toString, hint);
</span><ins>+        ASSERT(!scope.exception() || scope.exception() == value.asCell());
</ins><span class="cx">         if (value)
</span><span class="cx">             return value;
</span><span class="cx">     }
</span><span class="lines">@@ -1678,7 +1689,7 @@
</span><span class="cx"> 
</span><span class="cx">     ASSERT(!exec-&gt;hadException());
</span><span class="cx"> 
</span><del>-    return throwTypeError(exec, ASCIILiteral(&quot;No default value&quot;));
</del><ins>+    return throwTypeError(exec, scope, ASCIILiteral(&quot;No default value&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSValue JSObject::defaultValue(const JSObject* object, ExecState* exec, PreferredPrimitiveType hint)
</span><span class="lines">@@ -1727,12 +1738,14 @@
</span><span class="cx"> bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue hasInstanceValue)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
</ins><span class="cx"> 
</span><span class="cx">     if (!hasInstanceValue.isUndefinedOrNull() &amp;&amp; hasInstanceValue != exec-&gt;lexicalGlobalObject()-&gt;functionProtoHasInstanceSymbolFunction()) {
</span><span class="cx">         CallData callData;
</span><span class="cx">         CallType callType = JSC::getCallData(hasInstanceValue, callData);
</span><span class="cx">         if (callType == CallType::None) {
</span><del>-            vm.throwException(exec, createInvalidInstanceofParameterErrorhasInstanceValueNotFunction(exec, this));
</del><ins>+            throwException(exec, scope, createInvalidInstanceofParameterErrorhasInstanceValueNotFunction(exec, this));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -1747,7 +1760,7 @@
</span><span class="cx">         return defaultHasInstance(exec, value, get(exec, exec-&gt;propertyNames().prototype));
</span><span class="cx">     if (info.implementsHasInstance())
</span><span class="cx">         return methodTable(vm)-&gt;customHasInstance(this, exec, value);
</span><del>-    vm.throwException(exec, createInvalidInstanceofParameterErrorNotFunction(exec, this));
</del><ins>+    throwException(exec, scope, createInvalidInstanceofParameterErrorNotFunction(exec, this));
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -1760,15 +1773,17 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSObject::defaultHasInstance(ExecState* exec, JSValue value, JSValue proto)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject())
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     if (!proto.isObject()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;instanceof called on an object with an invalid prototype property.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;instanceof called on an object with an invalid prototype property.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     JSObject* object = asObject(value);
</span><span class="cx">     while (true) {
</span><span class="cx">         JSValue objectValue = object-&gt;getPrototype(vm, exec);
</span><span class="lines">@@ -2238,6 +2253,9 @@
</span><span class="cx"> template&lt;IndexingType indexingShape&gt;
</span><span class="cx"> bool JSObject::putByIndexBeyondVectorLengthWithoutAttributes(ExecState* exec, unsigned i, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT((indexingType() &amp; IndexingShapeMask) == indexingShape);
</span><span class="cx">     ASSERT(!indexingShouldBeSparse());
</span><span class="cx"> 
</span><span class="lines">@@ -2247,8 +2265,6 @@
</span><span class="cx">     // or equal to the vector length.
</span><span class="cx">     ASSERT(i &gt;= butterfly-&gt;vectorLength());
</span><span class="cx">     
</span><del>-    VM&amp; vm = exec-&gt;vm();
-    
</del><span class="cx">     if (i &gt; MAX_STORAGE_VECTOR_INDEX
</span><span class="cx">         || (i &gt;= MIN_SPARSE_ARRAY_INDEX &amp;&amp; !isDenseEnoughForVector(i, countElements&lt;indexingShape&gt;(butterfly)))
</span><span class="cx">         || indexIsSufficientlyBeyondLengthForSparseMap(i, butterfly-&gt;vectorLength())) {
</span><span class="lines">@@ -2262,7 +2278,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!ensureLength(vm, i + 1)) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     butterfly = m_butterfly.get();
</span><span class="lines">@@ -2300,6 +2316,7 @@
</span><span class="cx"> bool JSObject::putByIndexBeyondVectorLengthWithArrayStorage(ExecState* exec, unsigned i, JSValue value, bool shouldThrow, ArrayStorage* storage)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     // i should be a valid array index that is outside of the current vector.
</span><span class="cx">     ASSERT(i &lt;= MAX_ARRAY_INDEX);
</span><span class="lines">@@ -2327,7 +2344,7 @@
</span><span class="cx">             return true;
</span><span class="cx">         }
</span><span class="cx">         // We don't want to, or can't use a vector to hold this property - allocate a sparse map &amp; add the value.
</span><del>-        map = allocateSparseIndexMap(exec-&gt;vm());
</del><ins>+        map = allocateSparseIndexMap(vm);
</ins><span class="cx">         return map-&gt;putEntry(exec, this, i, value, shouldThrow);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -2337,7 +2354,7 @@
</span><span class="cx">         // Prohibit growing the array if length is not writable.
</span><span class="cx">         if (map-&gt;lengthIsReadOnly() || !isStructureExtensible()) {
</span><span class="cx">             if (shouldThrow)
</span><del>-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+                throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         length = i + 1;
</span><span class="lines">@@ -2347,7 +2364,7 @@
</span><span class="cx">     // We are currently using a map - check whether we still want to be doing so.
</span><span class="cx">     // We will continue  to use a sparse map if SparseMode is set, a vector would be too sparse, or if allocation fails.
</span><span class="cx">     unsigned numValuesInArray = storage-&gt;m_numValuesInVector + map-&gt;size();
</span><del>-    if (map-&gt;sparseMode() || !isDenseEnoughForVector(length, numValuesInArray) || !increaseVectorLength(exec-&gt;vm(), length))
</del><ins>+    if (map-&gt;sparseMode() || !isDenseEnoughForVector(length, numValuesInArray) || !increaseVectorLength(vm, length))
</ins><span class="cx">         return map-&gt;putEntry(exec, this, i, value, shouldThrow);
</span><span class="cx"> 
</span><span class="cx">     // Reread m_storage after increaseVectorLength, update m_numValuesInVector.
</span><span class="lines">@@ -2944,6 +2961,9 @@
</span><span class="cx"> bool validateAndApplyPropertyDescriptor(ExecState* exec, JSObject* object, PropertyName propertyName, bool isExtensible,
</span><span class="cx">     const PropertyDescriptor&amp; descriptor, bool isCurrentDefined, const PropertyDescriptor&amp; current, bool throwException)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // If we have a new property we can just put it on normally
</span><span class="cx">     // Step 2.
</span><span class="cx">     if (!isCurrentDefined) {
</span><span class="lines">@@ -2951,7 +2971,7 @@
</span><span class="cx">         // Step 2.a
</span><span class="cx">         if (!isExtensible) {
</span><span class="cx">             if (throwException)
</span><del>-                throwTypeError(exec, ASCIILiteral(&quot;Attempting to define property on object that is not extensible.&quot;));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to define property on object that is not extensible.&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         if (!object)
</span><span class="lines">@@ -2974,12 +2994,12 @@
</span><span class="cx">     if (!current.configurable()) {
</span><span class="cx">         if (descriptor.configurable()) {
</span><span class="cx">             if (throwException)
</span><del>-                throwTypeError(exec, ASCIILiteral(&quot;Attempting to change configurable attribute of unconfigurable property.&quot;));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to change configurable attribute of unconfigurable property.&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         if (descriptor.enumerablePresent() &amp;&amp; descriptor.enumerable() != current.enumerable()) {
</span><span class="cx">             if (throwException)
</span><del>-                throwTypeError(exec, ASCIILiteral(&quot;Attempting to change enumerable attribute of unconfigurable property.&quot;));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to change enumerable attribute of unconfigurable property.&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -2988,7 +3008,7 @@
</span><span class="cx">     // A generic descriptor is simply changing the attributes of an existing property
</span><span class="cx">     if (descriptor.isGenericDescriptor()) {
</span><span class="cx">         if (!current.attributesEqual(descriptor) &amp;&amp; object) {
</span><del>-            object-&gt;methodTable(exec-&gt;vm())-&gt;deleteProperty(object, exec, propertyName);
</del><ins>+            object-&gt;methodTable(vm)-&gt;deleteProperty(object, exec, propertyName);
</ins><span class="cx">             return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
</span><span class="cx">         }
</span><span class="cx">         return true;
</span><span class="lines">@@ -2999,7 +3019,7 @@
</span><span class="cx">     if (descriptor.isDataDescriptor() != current.isDataDescriptor()) {
</span><span class="cx">         if (!current.configurable()) {
</span><span class="cx">             if (throwException)
</span><del>-                throwTypeError(exec, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -3006,7 +3026,7 @@
</span><span class="cx">         if (!object)
</span><span class="cx">             return true;
</span><span class="cx"> 
</span><del>-        object-&gt;methodTable(exec-&gt;vm())-&gt;deleteProperty(object, exec, propertyName);
</del><ins>+        object-&gt;methodTable(vm)-&gt;deleteProperty(object, exec, propertyName);
</ins><span class="cx">         return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -3016,13 +3036,13 @@
</span><span class="cx">         if (!current.configurable()) {
</span><span class="cx">             if (!current.writable() &amp;&amp; descriptor.writable()) {
</span><span class="cx">                 if (throwException)
</span><del>-                    throwTypeError(exec, ASCIILiteral(&quot;Attempting to change writable attribute of unconfigurable property.&quot;));
</del><ins>+                    throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to change writable attribute of unconfigurable property.&quot;));
</ins><span class="cx">                 return false;
</span><span class="cx">             }
</span><span class="cx">             if (!current.writable()) {
</span><span class="cx">                 if (descriptor.value() &amp;&amp; !sameValue(exec, current.value(), descriptor.value())) {
</span><span class="cx">                     if (throwException)
</span><del>-                        throwTypeError(exec, ASCIILiteral(&quot;Attempting to change value of a readonly property.&quot;));
</del><ins>+                        throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to change value of a readonly property.&quot;));
</ins><span class="cx">                     return false;
</span><span class="cx">                 }
</span><span class="cx">             }
</span><span class="lines">@@ -3031,7 +3051,7 @@
</span><span class="cx">             return true;
</span><span class="cx">         if (!object)
</span><span class="cx">             return true;
</span><del>-        object-&gt;methodTable(exec-&gt;vm())-&gt;deleteProperty(object, exec, propertyName);
</del><ins>+        object-&gt;methodTable(vm)-&gt;deleteProperty(object, exec, propertyName);
</ins><span class="cx">         return putDescriptor(exec, object, propertyName, descriptor, descriptor.attributesOverridingCurrent(current), current);
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -3041,17 +3061,17 @@
</span><span class="cx">     if (!current.configurable()) {
</span><span class="cx">         if (descriptor.setterPresent() &amp;&amp; !(current.setterPresent() &amp;&amp; JSValue::strictEqual(exec, current.setter(), descriptor.setter()))) {
</span><span class="cx">             if (throwException)
</span><del>-                throwTypeError(exec, ASCIILiteral(&quot;Attempting to change the setter of an unconfigurable property.&quot;));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to change the setter of an unconfigurable property.&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         if (descriptor.getterPresent() &amp;&amp; !(current.getterPresent() &amp;&amp; JSValue::strictEqual(exec, current.getter(), descriptor.getter()))) {
</span><span class="cx">             if (throwException)
</span><del>-                throwTypeError(exec, ASCIILiteral(&quot;Attempting to change the getter of an unconfigurable property.&quot;));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(&quot;Attempting to change the getter of an unconfigurable property.&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         if (current.attributes() &amp; CustomAccessor) {
</span><span class="cx">             if (throwException)
</span><del>-                throwTypeError(exec, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(UnconfigurablePropertyChangeAccessMechanismError));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -3059,33 +3079,33 @@
</span><span class="cx">     // Step 10/11.
</span><span class="cx">     if (!object)
</span><span class="cx">         return true;
</span><del>-    JSValue accessor = object-&gt;getDirect(exec-&gt;vm(), propertyName);
</del><ins>+    JSValue accessor = object-&gt;getDirect(vm, propertyName);
</ins><span class="cx">     if (!accessor)
</span><span class="cx">         return false;
</span><span class="cx">     GetterSetter* getterSetter;
</span><span class="cx">     bool getterSetterChanged = false;
</span><span class="cx">     if (accessor.isCustomGetterSetter()) {
</span><del>-        getterSetter = GetterSetter::create(exec-&gt;vm(), exec-&gt;lexicalGlobalObject());
</del><ins>+        getterSetter = GetterSetter::create(vm, exec-&gt;lexicalGlobalObject());
</ins><span class="cx">         auto* customGetterSetter = jsCast&lt;CustomGetterSetter*&gt;(accessor);
</span><span class="cx">         if (customGetterSetter-&gt;setter())
</span><del>-            getterSetter-&gt;setSetter(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, customGetterSetter, JSCustomGetterSetterFunction::Type::Setter));
</del><ins>+            getterSetter-&gt;setSetter(vm, exec-&gt;lexicalGlobalObject(), getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, customGetterSetter, JSCustomGetterSetterFunction::Type::Setter));
</ins><span class="cx">         if (customGetterSetter-&gt;getter())
</span><del>-            getterSetter-&gt;setGetter(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, customGetterSetter, JSCustomGetterSetterFunction::Type::Getter));
</del><ins>+            getterSetter-&gt;setGetter(vm, exec-&gt;lexicalGlobalObject(), getCustomGetterSetterFunctionForGetterSetter(exec, propertyName, customGetterSetter, JSCustomGetterSetterFunction::Type::Getter));
</ins><span class="cx">     } else {
</span><span class="cx">         ASSERT(accessor.isGetterSetter());
</span><span class="cx">         getterSetter = asGetterSetter(accessor);
</span><span class="cx">     }
</span><span class="cx">     if (descriptor.setterPresent()) {
</span><del>-        getterSetter = getterSetter-&gt;withSetter(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), descriptor.setterObject());
</del><ins>+        getterSetter = getterSetter-&gt;withSetter(vm, exec-&gt;lexicalGlobalObject(), descriptor.setterObject());
</ins><span class="cx">         getterSetterChanged = true;
</span><span class="cx">     }
</span><span class="cx">     if (descriptor.getterPresent()) {
</span><del>-        getterSetter = getterSetter-&gt;withGetter(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), descriptor.getterObject());
</del><ins>+        getterSetter = getterSetter-&gt;withGetter(vm, exec-&gt;lexicalGlobalObject(), descriptor.getterObject());
</ins><span class="cx">         getterSetterChanged = true;
</span><span class="cx">     }
</span><span class="cx">     if (current.attributesEqual(descriptor) &amp;&amp; !getterSetterChanged)
</span><span class="cx">         return true;
</span><del>-    object-&gt;methodTable(exec-&gt;vm())-&gt;deleteProperty(object, exec, propertyName);
</del><ins>+    object-&gt;methodTable(vm)-&gt;deleteProperty(object, exec, propertyName);
</ins><span class="cx">     unsigned attrs = descriptor.attributesOverridingCurrent(current);
</span><span class="cx">     object-&gt;putDirectAccessor(exec, propertyName, getterSetter, attrs | Accessor);
</span><span class="cx">     return true;
</span><span class="lines">@@ -3233,6 +3253,9 @@
</span><span class="cx"> // http://www.ecma-international.org/ecma-262/6.0/index.html#sec-getmethod
</span><span class="cx"> JSValue JSObject::getMethod(ExecState* exec, CallData&amp; callData, CallType&amp; callType, const Identifier&amp; ident, const String&amp; errorMessage)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue method = get(exec, ident);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return jsUndefined();
</span><span class="lines">@@ -3241,13 +3264,13 @@
</span><span class="cx">         if (method.isUndefinedOrNull())
</span><span class="cx">             return jsUndefined();
</span><span class="cx"> 
</span><del>-        throwVMTypeError(exec, errorMessage);
</del><ins>+        throwVMTypeError(exec, scope, errorMessage);
</ins><span class="cx">         return jsUndefined();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     callType = method.asCell()-&gt;methodTable()-&gt;getCallData(method.asCell(), callData);
</span><span class="cx">     if (callType == CallType::None) {
</span><del>-        throwVMTypeError(exec, errorMessage);
</del><ins>+        throwVMTypeError(exec, scope, errorMessage);
</ins><span class="cx">         return jsUndefined();
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObject.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObject.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObject.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -42,7 +42,6 @@
</span><span class="cx"> #include &quot;PutDirectIndexMode.h&quot;
</span><span class="cx"> #include &quot;PutPropertySlot.h&quot;
</span><span class="cx"> #include &quot;RuntimeType.h&quot;
</span><del>-
</del><span class="cx"> #include &quot;Structure.h&quot;
</span><span class="cx"> #include &quot;VM.h&quot;
</span><span class="cx"> #include &quot;JSString.h&quot;
</span><span class="lines">@@ -66,10 +65,11 @@
</span><span class="cx"> class PropertyDescriptor;
</span><span class="cx"> class PropertyNameArray;
</span><span class="cx"> class Structure;
</span><ins>+class ThrowScope;
</ins><span class="cx"> struct HashTable;
</span><span class="cx"> struct HashTableValue;
</span><span class="cx"> 
</span><del>-JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, const String&amp;);
</del><ins>+JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, ThrowScope&amp;, const String&amp;);
</ins><span class="cx"> extern JS_EXPORTDATA const char* StrictModeReadonlyPropertyWriteError;
</span><span class="cx"> extern JS_EXPORTDATA const char* UnconfigurablePropertyChangeAccessMechanismError;
</span><span class="cx"> 
</span><span class="lines">@@ -1665,37 +1665,6 @@
</span><span class="cx">     return name;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-// Section 7.3.17 of the spec. 
-template &lt;typename AddFunction&gt; // Add function should have a type like: (JSValue, RuntimeType) -&gt; bool
-void createListFromArrayLike(ExecState* exec, JSValue arrayLikeValue, RuntimeTypeMask legalTypesFilter, const String&amp; errorMessage, AddFunction addFunction)
-{
-    VM&amp; vm = exec-&gt;vm();
-    Vector&lt;JSValue&gt; result;
-    JSValue lengthProperty = arrayLikeValue.get(exec, exec-&gt;vm().propertyNames-&gt;length);
-    if (vm.exception())
-        return;
-    double lengthAsDouble = lengthProperty.toLength(exec);
-    if (vm.exception())
-        return;
-    RELEASE_ASSERT(lengthAsDouble &gt;= 0.0 &amp;&amp; lengthAsDouble == std::trunc(lengthAsDouble));
-    uint64_t length = static_cast&lt;uint64_t&gt;(lengthAsDouble);
-    for (uint64_t index = 0; index &lt; length; index++) {
-        JSValue  next = arrayLikeValue.get(exec, index);
-        if (vm.exception())
-            return;
-
-        RuntimeType type = runtimeTypeForValue(next);
-        if (!(type &amp; legalTypesFilter)) {
-            throwTypeError(exec, errorMessage);
-            return;
-        }
-
-        bool exitEarly = addFunction(next, type);
-        if (exitEarly)
-            return;
-    }
-}
-
</del><span class="cx"> bool validateAndApplyPropertyDescriptor(ExecState*, JSObject*, PropertyName, bool isExtensible,
</span><span class="cx">     const PropertyDescriptor&amp; descriptor, bool isCurrentDefined, const PropertyDescriptor&amp; current, bool throwException);
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSObjectInlinesh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObjectInlines.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObjectInlines.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSObjectInlines.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -30,6 +30,39 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><ins>+// Section 7.3.17 of the spec.
+template &lt;typename AddFunction&gt; // Add function should have a type like: (JSValue, RuntimeType) -&gt; bool
+void createListFromArrayLike(ExecState* exec, JSValue arrayLikeValue, RuntimeTypeMask legalTypesFilter, const String&amp; errorMessage, AddFunction addFunction)
+{
+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
+    Vector&lt;JSValue&gt; result;
+    JSValue lengthProperty = arrayLikeValue.get(exec, vm.propertyNames-&gt;length);
+    if (vm.exception())
+        return;
+    double lengthAsDouble = lengthProperty.toLength(exec);
+    if (vm.exception())
+        return;
+    RELEASE_ASSERT(lengthAsDouble &gt;= 0.0 &amp;&amp; lengthAsDouble == std::trunc(lengthAsDouble));
+    uint64_t length = static_cast&lt;uint64_t&gt;(lengthAsDouble);
+    for (uint64_t index = 0; index &lt; length; index++) {
+        JSValue next = arrayLikeValue.get(exec, index);
+        if (vm.exception())
+            return;
+        
+        RuntimeType type = runtimeTypeForValue(next);
+        if (!(type &amp; legalTypesFilter)) {
+            throwTypeError(exec, scope, errorMessage);
+            return;
+        }
+        
+        bool exitEarly = addFunction(next, type);
+        if (exitEarly)
+            return;
+    }
+}
+
</ins><span class="cx"> ALWAYS_INLINE bool JSObject::canPerformFastPutInline(ExecState* exec, VM&amp; vm, PropertyName propertyName)
</span><span class="cx"> {
</span><span class="cx">     if (UNLIKELY(propertyName == exec-&gt;propertyNames().underscoreProto))
</span><span class="lines">@@ -55,10 +88,12 @@
</span><span class="cx"> // ECMA 8.6.2.2
</span><span class="cx"> ALWAYS_INLINE bool JSObject::putInline(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSObject* thisObject = jsCast&lt;JSObject*&gt;(cell);
</span><span class="cx">     ASSERT(value);
</span><span class="cx">     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject));
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
</span><span class="cx">         return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
</span><span class="lines">@@ -69,10 +104,10 @@
</span><span class="cx">         return putByIndex(thisObject, exec, index.value(), value, slot.isStrictMode());
</span><span class="cx"> 
</span><span class="cx">     if (thisObject-&gt;canPerformFastPutInline(exec, vm, propertyName)) {
</span><del>-        ASSERT(!thisObject-&gt;structure(vm)-&gt;prototypeChainMayInterceptStoreTo(exec-&gt;vm(), propertyName));
</del><ins>+        ASSERT(!thisObject-&gt;structure(vm)-&gt;prototypeChainMayInterceptStoreTo(vm, propertyName));
</ins><span class="cx">         if (!thisObject-&gt;putDirectInternal&lt;PutModePut&gt;(vm, propertyName, value, 0, slot)) {
</span><span class="cx">             if (slot.isStrictMode())
</span><del>-                throwTypeError(exec, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(StrictModeReadonlyPropertyWriteError));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         return true;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSPromiseConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -96,12 +96,13 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructPromise(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSGlobalObject* globalObject = exec-&gt;callee()-&gt;globalObject();
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx"> 
</span><span class="cx">     JSValue newTarget = exec-&gt;newTarget();
</span><span class="cx">     if (newTarget.isUndefined())
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     Structure* promiseStructure = InternalFunction::createSubclassStructure(exec, exec-&gt;newTarget(), globalObject-&gt;promiseStructure());
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -114,7 +115,9 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callPromise(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, &quot;Promise&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, &quot;Promise&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ConstructType JSPromiseConstructor::getConstructData(JSCell*, ConstructData&amp; constructData)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSPropertyNameIteratorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -143,9 +143,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL propertyNameIteratorFuncNext(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSPropertyNameIterator* iterator = jsDynamicCast&lt;JSPropertyNameIterator*&gt;(exec-&gt;thisValue());
</span><span class="cx">     if (!iterator)
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Cannot call PropertyNameIterator.next() on a non-PropertyNameIterator object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Cannot call PropertyNameIterator.next() on a non-PropertyNameIterator object&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     JSValue result;
</span><span class="cx">     if (iterator-&gt;next(exec, result))
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSStringcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSString.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSString.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSString.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
</span><span class="cx">  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
</span><del>- *  Copyright (C) 2004, 2007, 2008, 2015 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2004, 2007-2008, 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -380,11 +380,14 @@
</span><span class="cx"> 
</span><span class="cx"> void JSRopeString::outOfMemory(ExecState* exec) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     clearFibers();
</span><span class="cx">     ASSERT(isRope());
</span><span class="cx">     ASSERT(m_value.isNull());
</span><span class="cx">     if (exec)
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSValue JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSStringBuilderh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringBuilder.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringBuilder.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringBuilder.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2009 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -71,17 +71,19 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue build(ExecState* exec)
</span><span class="cx">     {
</span><ins>+        VM&amp; vm = exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">         if (!m_okay)
</span><del>-            return throwOutOfMemoryError(exec);
</del><ins>+            return throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         if (m_is8Bit) {
</span><span class="cx">             buffer8.shrinkToFit();
</span><span class="cx">             if (!buffer8.data())
</span><del>-                return throwOutOfMemoryError(exec);
</del><ins>+                return throwOutOfMemoryError(exec, scope);
</ins><span class="cx">             return jsString(exec, String::adopt(buffer8));
</span><span class="cx">         }
</span><span class="cx">         buffer16.shrinkToFit();
</span><span class="cx">         if (!buffer16.data())
</span><del>-            return throwOutOfMemoryError(exec);
</del><ins>+            return throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return jsString(exec, String::adopt(buffer16));
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -127,9 +129,11 @@
</span><span class="cx"> template&lt;typename StringType, typename... StringTypes&gt;
</span><span class="cx"> inline JSValue jsMakeNontrivialString(ExecState* exec, const StringType&amp; string, const StringTypes&amp;... strings)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     String result = WTF::tryMakeString(string, strings...);
</span><span class="cx">     if (!result)
</span><del>-        return throwOutOfMemoryError(exec);
</del><ins>+        return throwOutOfMemoryError(exec, scope);
</ins><span class="cx">     return jsNontrivialString(exec, WTFMove(result));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSStringJoinercpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringJoiner.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringJoiner.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringJoiner.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -81,6 +81,9 @@
</span><span class="cx"> 
</span><span class="cx"> inline unsigned JSStringJoiner::joinedLength(ExecState&amp; state) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     unsigned numberOfStrings = m_strings.size();
</span><span class="cx">     if (!numberOfStrings)
</span><span class="cx">         return 0;
</span><span class="lines">@@ -91,7 +94,7 @@
</span><span class="cx"> 
</span><span class="cx">     unsigned result;
</span><span class="cx">     if (totalLength.safeGet(result) == CheckedState::DidOverflow) {
</span><del>-        throwOutOfMemoryError(&amp;state);
</del><ins>+        throwOutOfMemoryError(&amp;state, scope);
</ins><span class="cx">         return 0;
</span><span class="cx">     }
</span><span class="cx">     return result;
</span><span class="lines">@@ -99,6 +102,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSStringJoiner::join(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT(m_strings.size() &lt;= m_strings.capacity());
</span><span class="cx"> 
</span><span class="cx">     unsigned length = joinedLength(state);
</span><span class="lines">@@ -115,7 +121,7 @@
</span><span class="cx">         result = joinStrings&lt;UChar&gt;(m_strings, m_separator, length);
</span><span class="cx"> 
</span><span class="cx">     if (result.isNull())
</span><del>-        return throwOutOfMemoryError(&amp;state);
</del><ins>+        return throwOutOfMemoryError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     return jsString(&amp;state, WTFMove(result));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSStringJoinerh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringJoiner.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringJoiner.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSStringJoiner.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -60,8 +60,10 @@
</span><span class="cx">     : m_separator(separator)
</span><span class="cx">     , m_isAll8Bit(m_separator.is8Bit())
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!m_strings.tryReserveCapacity(stringCount)))
</span><del>-        throwOutOfMemoryError(&amp;state);
</del><ins>+        throwOutOfMemoryError(&amp;state, scope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> inline JSStringJoiner::JSStringJoiner(ExecState&amp; state, LChar separator, unsigned stringCount)
</span><span class="lines">@@ -68,8 +70,10 @@
</span><span class="cx">     : m_singleCharacterSeparator(separator)
</span><span class="cx">     , m_separator { &amp;m_singleCharacterSeparator, 1 }
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!m_strings.tryReserveCapacity(stringCount)))
</span><del>-        throwOutOfMemoryError(&amp;state);
</del><ins>+        throwOutOfMemoryError(&amp;state, scope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE void JSStringJoiner::append(StringViewWithUnderlyingString&amp;&amp; string)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSSymbolTableObjecth"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSSymbolTableObject.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSSymbolTableObject.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSSymbolTableObject.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012, 2014, 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012, 2014-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -32,6 +32,7 @@
</span><span class="cx"> #include &quot;JSScope.h&quot;
</span><span class="cx"> #include &quot;PropertyDescriptor.h&quot;
</span><span class="cx"> #include &quot;SymbolTable.h&quot;
</span><ins>+#include &quot;ThrowScope.h&quot;
</ins><span class="cx"> #include &quot;VariableWriteFireDetail.h&quot;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -166,6 +167,7 @@
</span><span class="cx"> inline bool symbolTablePut(SymbolTableObjectType* object, ExecState* exec, PropertyName propertyName, JSValue value, bool shouldThrowReadOnlyError, bool ignoreReadOnlyErrors, bool&amp; putResult)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     WatchpointSet* set = nullptr;
</span><span class="cx">     WriteBarrierBase&lt;Unknown&gt;* reg;
</span><span class="lines">@@ -182,7 +184,7 @@
</span><span class="cx">         ASSERT(!fastEntry.isNull());
</span><span class="cx">         if (fastEntry.isReadOnly() &amp;&amp; !ignoreReadOnlyErrors) {
</span><span class="cx">             if (shouldThrowReadOnlyError)
</span><del>-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+                throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">             putResult = false;
</span><span class="cx">             return true;
</span><span class="cx">         }
</span><span class="lines">@@ -200,9 +202,9 @@
</span><span class="cx">     // the right for barriers to be able to trigger GC. And I don't want to hold VM
</span><span class="cx">     // locks while GC'ing.
</span><span class="cx">     if (symbolTablePutMode == SymbolTablePutMode::Invalidate)
</span><del>-        symbolTablePutInvalidateWatchpointSet(exec-&gt;vm(), object, propertyName, value, reg, set);
</del><ins>+        symbolTablePutInvalidateWatchpointSet(vm, object, propertyName, value, reg, set);
</ins><span class="cx">     else
</span><del>-        symbolTablePutTouchWatchpointSet(exec-&gt;vm(), object, propertyName, value, reg, set);
</del><ins>+        symbolTablePutTouchWatchpointSet(vm, object, propertyName, value, reg, set);
</ins><span class="cx">     putResult = true;
</span><span class="cx">     return true;
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSTypedArrayViewConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -66,7 +66,9 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructTypedArrayView(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return throwVMTypeError(exec, ASCIILiteral(&quot;%TypedArray% should not be called directly&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMTypeError(exec, scope, ASCIILiteral(&quot;%TypedArray% should not be called directly&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> ConstructType JSTypedArrayViewConstructor::getConstructData(JSCell*, ConstructData&amp; constructData)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeJSTypedArrayViewPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/JSTypedArrayViewPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -39,26 +39,26 @@
</span><span class="cx"> #define CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(functionName) do {                           \
</span><span class="cx">     switch (thisValue.getObject()-&gt;classInfo()-&gt;typedArrayStorageType) {                        \
</span><span class="cx">     case TypeUint8Clamped:                                                                      \
</span><del>-        return functionName&lt;JSUint8ClampedArray&gt;(exec);                                         \
</del><ins>+        return functionName&lt;JSUint8ClampedArray&gt;(vm, exec);                                     \
</ins><span class="cx">     case TypeInt32:                                                                             \
</span><del>-        return functionName&lt;JSInt32Array&gt;(exec);                                                \
</del><ins>+        return functionName&lt;JSInt32Array&gt;(vm, exec);                                            \
</ins><span class="cx">     case TypeUint32:                                                                            \
</span><del>-        return functionName&lt;JSUint32Array&gt;(exec);                                               \
</del><ins>+        return functionName&lt;JSUint32Array&gt;(vm, exec);                                           \
</ins><span class="cx">     case TypeFloat64:                                                                           \
</span><del>-        return functionName&lt;JSFloat64Array&gt;(exec);                                              \
</del><ins>+        return functionName&lt;JSFloat64Array&gt;(vm, exec);                                          \
</ins><span class="cx">     case TypeFloat32:                                                                           \
</span><del>-        return functionName&lt;JSFloat32Array&gt;(exec);                                              \
</del><ins>+        return functionName&lt;JSFloat32Array&gt;(vm, exec);                                          \
</ins><span class="cx">     case TypeInt8:                                                                              \
</span><del>-        return functionName&lt;JSInt8Array&gt;(exec);                                                 \
</del><ins>+        return functionName&lt;JSInt8Array&gt;(vm, exec);                                             \
</ins><span class="cx">     case TypeUint8:                                                                             \
</span><del>-        return functionName&lt;JSUint8Array&gt;(exec);                                                \
</del><ins>+        return functionName&lt;JSUint8Array&gt;(vm, exec);                                            \
</ins><span class="cx">     case TypeInt16:                                                                             \
</span><del>-        return functionName&lt;JSInt16Array&gt;(exec);                                                \
</del><ins>+        return functionName&lt;JSInt16Array&gt;(vm, exec);                                            \
</ins><span class="cx">     case TypeUint16:                                                                            \
</span><del>-        return functionName&lt;JSUint16Array&gt;(exec);                                               \
</del><ins>+        return functionName&lt;JSUint16Array&gt;(vm, exec);                                           \
</ins><span class="cx">     case NotTypedArray:                                                                         \
</span><span class="cx">     case TypeDataView:                                                                          \
</span><del>-        return throwVMTypeError(exec,                                                           \
</del><ins>+        return throwVMTypeError(exec, scope,                                                    \
</ins><span class="cx">             ASCIILiteral(&quot;Receiver should be a typed array view&quot;));                             \
</span><span class="cx">     }                                                                                           \
</span><span class="cx">     RELEASE_ASSERT_NOT_REACHED();                                                               \
</span><span class="lines">@@ -72,14 +72,16 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncLength(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue argument = exec-&gt;argument(0);
</span><span class="cx">     if (!argument.isCell() || !isTypedView(argument.asCell()-&gt;classInfo()-&gt;typedArrayStorageType))
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view&quot;));
</ins><span class="cx"> 
</span><span class="cx">     JSArrayBufferView* thisObject = jsCast&lt;JSArrayBufferView*&gt;(argument);
</span><span class="cx"> 
</span><span class="cx">     if (thisObject-&gt;isNeutered())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Underlying ArrayBuffer has been detached from the view&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Underlying ArrayBuffer has been detached from the view&quot;));
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsNumber(thisObject-&gt;length()));
</span><span class="cx"> }
</span><span class="lines">@@ -94,6 +96,8 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncSort(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;argument(0);
</span><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewPrivateFuncSort);
</span><span class="cx"> }
</span><span class="lines">@@ -100,105 +104,131 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncSet(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><del>-    if (!thisValue.isObject())
-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+    if (UNLIKELY(!thisValue.isObject()))
+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncSet);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncCopyWithin(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncCopyWithin);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncIncludes(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMError(exec, createTypeError(exec, &quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMError(exec, scope, createTypeError(exec, &quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncIncludes);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncLastIndexOf(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncLastIndexOf);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncIndexOf(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncIndexOf);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncJoin(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncJoin);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncBuffer(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncBuffer);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncLength(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncLength);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncByteLength(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncByteLength);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoGetterFuncByteOffset(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoGetterFuncByteOffset);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncReverse(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncReverse);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL typedArrayViewPrivateFuncSubarrayCreate(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewPrivateFuncSubarrayCreate);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL typedArrayViewProtoFuncSlice(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Receiver should be a typed array view but was not an object&quot;));
</ins><span class="cx">     CALL_GENERIC_TYPEDARRAY_PROTOTYPE_FUNCTION(genericTypedArrayViewProtoFuncSlice);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeMapConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -50,11 +50,16 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callMap(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, &quot;Map&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, &quot;Map&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructMap(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSGlobalObject* globalObject = asInternalFunction(exec-&gt;callee())-&gt;globalObject();
</span><span class="cx">     Structure* mapStructure = InternalFunction::createSubclassStructure(exec, exec-&gt;newTarget(), globalObject-&gt;mapStructure());
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -71,11 +76,11 @@
</span><span class="cx">     CallData adderFunctionCallData;
</span><span class="cx">     CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
</span><span class="cx">     if (adderFunctionCallType == CallType::None)
</span><del>-        return JSValue::encode(throwTypeError(exec));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope));
</ins><span class="cx"> 
</span><span class="cx">     forEachInIterable(exec, iterable, [&amp;](VM&amp; vm, ExecState* exec, JSValue nextItem) {
</span><span class="cx">         if (!nextItem.isObject()) {
</span><del>-            throwTypeError(exec);
</del><ins>+            throwTypeError(exec, scope);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeMapDataInlinesh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapDataInlines.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapDataInlines.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapDataInlines.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -204,6 +204,9 @@
</span><span class="cx"> template&lt;typename Entry, typename JSIterator&gt;
</span><span class="cx"> inline CheckedBoolean MapDataImpl&lt;Entry, JSIterator&gt;::ensureSpaceForAppend(ExecState* exec, JSCell* owner)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (m_capacity &gt; m_size)
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="lines">@@ -211,7 +214,7 @@
</span><span class="cx">     void* newStorage = nullptr;
</span><span class="cx">     DeferGC defer(*exec-&gt;heap());
</span><span class="cx">     if (!exec-&gt;heap()-&gt;tryAllocateStorage(owner, requiredSize * sizeof(Entry), &amp;newStorage)) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     Entry* newEntries = static_cast&lt;Entry*&gt;(newStorage);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeMapIteratorPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapIteratorPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple, Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -50,9 +50,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL MapIteratorPrototypeFuncNext(CallFrame* callFrame)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSMapIterator* iterator = jsDynamicCast&lt;JSMapIterator*&gt;(callFrame-&gt;thisValue());
</span><span class="cx">     if (!iterator)
</span><del>-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral(&quot;Cannot call MapIterator.next() on a non-MapIterator object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot call MapIterator.next() on a non-MapIterator object&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     JSValue result;
</span><span class="cx">     if (iterator-&gt;next(callFrame, result))
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeMapPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/MapPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -90,13 +90,16 @@
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE static JSMap* getMap(CallFrame* callFrame, JSValue thisValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!thisValue.isObject()) {
</span><del>-        throwVMError(callFrame, createNotAnObjectError(callFrame, thisValue));
</del><ins>+        throwVMError(callFrame, scope, createNotAnObjectError(callFrame, thisValue));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     JSMap* map = jsDynamicCast&lt;JSMap*&gt;(thisValue);
</span><span class="cx">     if (!map) {
</span><del>-        throwTypeError(callFrame, ASCIILiteral(&quot;Map operation called on non-Map object&quot;));
</del><ins>+        throwTypeError(callFrame, scope, ASCIILiteral(&quot;Map operation called on non-Map object&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     return map;
</span><span class="lines">@@ -155,26 +158,35 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL mapProtoFuncValues(CallFrame* callFrame)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSMap* thisObj = jsDynamicCast&lt;JSMap*&gt;(callFrame-&gt;thisValue());
</span><span class="cx">     if (!thisObj)
</span><del>-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral(&quot;Cannot create a Map value iterator for a non-Map object.&quot;)));
-    return JSValue::encode(JSMapIterator::create(callFrame-&gt;vm(), callFrame-&gt;callee()-&gt;globalObject()-&gt;mapIteratorStructure(), thisObj, IterateValue));
</del><ins>+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot create a Map value iterator for a non-Map object.&quot;)));
+    return JSValue::encode(JSMapIterator::create(vm, callFrame-&gt;callee()-&gt;globalObject()-&gt;mapIteratorStructure(), thisObj, IterateValue));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL mapProtoFuncEntries(CallFrame* callFrame)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSMap* thisObj = jsDynamicCast&lt;JSMap*&gt;(callFrame-&gt;thisValue());
</span><span class="cx">     if (!thisObj)
</span><del>-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral(&quot;Cannot create a Map entry iterator for a non-Map object.&quot;)));
-    return JSValue::encode(JSMapIterator::create(callFrame-&gt;vm(), callFrame-&gt;callee()-&gt;globalObject()-&gt;mapIteratorStructure(), thisObj, IterateKeyValue));
</del><ins>+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot create a Map entry iterator for a non-Map object.&quot;)));
+    return JSValue::encode(JSMapIterator::create(vm, callFrame-&gt;callee()-&gt;globalObject()-&gt;mapIteratorStructure(), thisObj, IterateKeyValue));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL mapProtoFuncKeys(CallFrame* callFrame)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSMap* thisObj = jsDynamicCast&lt;JSMap*&gt;(callFrame-&gt;thisValue());
</span><span class="cx">     if (!thisObj)
</span><del>-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral(&quot;Cannot create a Map key iterator for a non-Map object.&quot;)));
-    return JSValue::encode(JSMapIterator::create(callFrame-&gt;vm(), callFrame-&gt;callee()-&gt;globalObject()-&gt;mapIteratorStructure(), thisObj, IterateKey));
</del><ins>+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot create a Map key iterator for a non-Map object.&quot;)));
+    return JSValue::encode(JSMapIterator::create(vm, callFrame-&gt;callee()-&gt;globalObject()-&gt;mapIteratorStructure(), thisObj, IterateKey));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL privateFuncIsMap(ExecState* exec)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeModuleLoaderPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ModuleLoaderPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All Rights Reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -109,6 +109,8 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL moduleLoaderPrototypeParseModule(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     const Identifier moduleKey = exec-&gt;argument(0).toPropertyKey(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -127,7 +129,7 @@
</span><span class="cx">         JSParserStrictMode::Strict, JSParserCommentMode::Module, SourceParseMode::ModuleAnalyzeMode, SuperBinding::NotNeeded, error);
</span><span class="cx"> 
</span><span class="cx">     if (error.isValid()) {
</span><del>-        throwVMError(exec, error.toErrorObject(exec-&gt;lexicalGlobalObject(), sourceCode));
</del><ins>+        throwVMError(exec, scope, error.toErrorObject(exec-&gt;lexicalGlobalObject(), sourceCode));
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     }
</span><span class="cx">     ASSERT(moduleProgramNode);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeNullSetterFunctioncpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/NullSetterFunction.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/NullSetterFunction.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/NullSetterFunction.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -72,8 +72,11 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callReturnUndefined(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (callerIsStrict(exec))
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Setting a property that has only a getter&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Setting a property that has only a getter&quot;)));
</ins><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeNumberPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/NumberPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/NumberPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/NumberPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -364,15 +364,18 @@
</span><span class="cx"> // to argument-plus-one significant figures).
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     double x;
</span><span class="cx">     if (!toThisNumber(exec-&gt;thisValue(), x))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     // Get the argument. 
</span><span class="cx">     int decimalPlacesInExponent;
</span><span class="cx">     bool isUndefined;
</span><span class="cx">     if (!getIntegerArgumentInRange(exec, 0, 20, decimalPlacesInExponent, isUndefined))
</span><del>-        return throwVMError(exec, createRangeError(exec, ASCIILiteral(&quot;toExponential() argument must be between 0 and 20&quot;)));
</del><ins>+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;toExponential() argument must be between 0 and 20&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     // Handle NaN and Infinity.
</span><span class="cx">     if (!std::isfinite(x))
</span><span class="lines">@@ -395,15 +398,18 @@
</span><span class="cx"> // method will instead fallback to calling ToString. 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     double x;
</span><span class="cx">     if (!toThisNumber(exec-&gt;thisValue(), x))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     // Get the argument. 
</span><span class="cx">     int decimalPlaces;
</span><span class="cx">     bool isUndefined; // This is ignored; undefined treated as 0.
</span><span class="cx">     if (!getIntegerArgumentInRange(exec, 0, 20, decimalPlaces, isUndefined))
</span><del>-        return throwVMError(exec, createRangeError(exec, ASCIILiteral(&quot;toFixed() argument must be between 0 and 20&quot;)));
</del><ins>+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;toFixed() argument must be between 0 and 20&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     // 15.7.4.5.7 states &quot;If x &gt;= 10^21, then let m = ToString(x)&quot;
</span><span class="cx">     // This also covers Ininity, and structure the check so that NaN
</span><span class="lines">@@ -428,15 +434,18 @@
</span><span class="cx"> // with smaller values converted to exponential representation.
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     double x;
</span><span class="cx">     if (!toThisNumber(exec-&gt;thisValue(), x))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     // Get the argument. 
</span><span class="cx">     int significantFigures;
</span><span class="cx">     bool isUndefined;
</span><span class="cx">     if (!getIntegerArgumentInRange(exec, 1, 21, significantFigures, isUndefined))
</span><del>-        return throwVMError(exec, createRangeError(exec, ASCIILiteral(&quot;toPrecision() argument must be between 1 and 21&quot;)));
</del><ins>+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;toPrecision() argument must be between 1 and 21&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     // To precision called with no argument is treated as ToString.
</span><span class="cx">     if (isUndefined)
</span><span class="lines">@@ -485,22 +494,23 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL numberProtoFuncToString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     double doubleValue;
</span><span class="cx">     if (!toThisNumber(exec-&gt;thisValue(), doubleValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     int32_t radix = extractRadixFromArgs(exec);
</span><span class="cx">     if (radix &lt; 2 || radix &gt; 36)
</span><del>-        return throwVMError(exec, createRangeError(exec, ASCIILiteral(&quot;toString() radix argument must be between 2 and 36&quot;)));
</del><ins>+        return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;toString() radix argument must be between 2 and 36&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     int32_t integerValue = static_cast&lt;int32_t&gt;(doubleValue);
</span><span class="cx">     if (integerValue == doubleValue)
</span><span class="cx">         return integerValueToString(exec, radix, integerValue);
</span><span class="cx"> 
</span><del>-    if (radix == 10) {
-        VM* vm = &amp;exec-&gt;vm();
-        return JSValue::encode(jsString(vm, vm-&gt;numericStrings.add(doubleValue)));
-    }
</del><ins>+    if (radix == 10)
+        return JSValue::encode(jsString(&amp;vm, vm.numericStrings.add(doubleValue)));
</ins><span class="cx"> 
</span><span class="cx">     if (!std::isfinite(doubleValue))
</span><span class="cx">         return JSValue::encode(jsNontrivialString(exec, String::numberToStringECMAScript(doubleValue)));
</span><span class="lines">@@ -511,9 +521,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL numberProtoFuncToLocaleString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     double x;
</span><span class="cx">     if (!toThisNumber(exec-&gt;thisValue(), x))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsNumber(x).toString(exec));
</span><span class="cx"> }
</span><span class="lines">@@ -520,10 +533,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     double x;
</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!toThisNumber(thisValue, x))
</span><del>-        return throwVMTypeError(exec, WTF::makeString(&quot;thisNumberValue called on incompatible &quot;, jsCast&lt;JSString*&gt;(jsTypeStringForValue(exec, thisValue))-&gt;value(exec)));
</del><ins>+        return throwVMTypeError(exec, scope, WTF::makeString(&quot;thisNumberValue called on incompatible &quot;, jsCast&lt;JSString*&gt;(jsTypeStringForValue(exec, thisValue))-&gt;value(exec)));
</ins><span class="cx">     return JSValue::encode(jsNumber(x));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeObjectConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ObjectConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -217,13 +217,16 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectConstructorSetPrototypeOf(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue objectValue = exec-&gt;argument(0);
</span><span class="cx">     if (objectValue.isUndefinedOrNull())
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     JSValue protoValue = exec-&gt;argument(1);
</span><span class="cx">     if (!protoValue.isObject() &amp;&amp; !protoValue.isNull())
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     JSObject* object = objectValue.toObject(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -232,7 +235,6 @@
</span><span class="cx">     if (!checkProtoSetterAccessAllowed(exec, object))
</span><span class="cx">         return JSValue::encode(objectValue);
</span><span class="cx"> 
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     bool shouldThrowIfCantSet = true;
</span><span class="cx">     bool didSetPrototype = object-&gt;setPrototype(vm, exec, protoValue, shouldThrowIfCantSet);
</span><span class="cx">     ASSERT_UNUSED(didSetPrototype, vm.exception() || didSetPrototype);
</span><span class="lines">@@ -344,8 +346,10 @@
</span><span class="cx"> bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor&amp; desc)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!in.isObject()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Property description must be an object.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Property description must be an object.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     JSObject* description = asObject(in);
</span><span class="lines">@@ -390,7 +394,7 @@
</span><span class="cx">         if (!get.isUndefined()) {
</span><span class="cx">             CallData callData;
</span><span class="cx">             if (getCallData(get, callData) == CallType::None) {
</span><del>-                throwTypeError(exec, ASCIILiteral(&quot;Getter must be a function.&quot;));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(&quot;Getter must be a function.&quot;));
</ins><span class="cx">                 return false;
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="lines">@@ -405,7 +409,7 @@
</span><span class="cx">         if (!set.isUndefined()) {
</span><span class="cx">             CallData callData;
</span><span class="cx">             if (getCallData(set, callData) == CallType::None) {
</span><del>-                throwTypeError(exec, ASCIILiteral(&quot;Setter must be a function.&quot;));
</del><ins>+                throwTypeError(exec, scope, ASCIILiteral(&quot;Setter must be a function.&quot;));
</ins><span class="cx">                 return false;
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="lines">@@ -417,12 +421,12 @@
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="cx">     if (desc.value()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Invalid property.  'value' present on property with getter or setter.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Invalid property.  'value' present on property with getter or setter.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (desc.writablePresent()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Invalid property.  'writable' present on property with getter or setter.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Invalid property.  'writable' present on property with getter or setter.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     return true;
</span><span class="lines">@@ -430,19 +434,25 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperty(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!exec-&gt;argument(0).isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Properties can only be defined on Objects.&quot;));
-    JSObject* O = asObject(exec-&gt;argument(0));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Properties can only be defined on Objects.&quot;));
+    JSObject* obj = asObject(exec-&gt;argument(0));
</ins><span class="cx">     auto propertyName = exec-&gt;argument(1).toPropertyKey(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsNull());
</span><span class="cx">     PropertyDescriptor descriptor;
</span><del>-    if (!toPropertyDescriptor(exec, exec-&gt;argument(2), descriptor))
</del><ins>+    auto success = toPropertyDescriptor(exec, exec-&gt;argument(2), descriptor);
+    ASSERT(!scope.exception() == success);
+    if (!success)
</ins><span class="cx">         return JSValue::encode(jsNull());
</span><span class="cx">     ASSERT((descriptor.attributes() &amp; Accessor) || (!descriptor.isAccessorDescriptor()));
</span><span class="cx">     ASSERT(!exec-&gt;hadException());
</span><del>-    O-&gt;methodTable(exec-&gt;vm())-&gt;defineOwnProperty(O, exec, propertyName, descriptor, true);
-    return JSValue::encode(O);
</del><ins>+    obj-&gt;methodTable(vm)-&gt;defineOwnProperty(obj, exec, propertyName, descriptor, true);
+    scope.release();
+    return JSValue::encode(obj);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static JSValue defineProperties(ExecState* exec, JSObject* object, JSObject* properties)
</span><span class="lines">@@ -485,8 +495,11 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectConstructorDefineProperties(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!exec-&gt;argument(0).isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Properties can only be defined on Objects.&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Properties can only be defined on Objects.&quot;));
</ins><span class="cx">     JSObject* targetObj = asObject(exec-&gt;argument(0));
</span><span class="cx">     JSObject* props = exec-&gt;argument(1).toObject(exec);
</span><span class="cx">     if (!props)
</span><span class="lines">@@ -496,9 +509,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectConstructorCreate(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue proto = exec-&gt;argument(0);
</span><span class="cx">     if (!proto.isObject() &amp;&amp; !proto.isNull())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Object prototype may only be an Object or null.&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Object prototype may only be an Object or null.&quot;));
</ins><span class="cx">     JSObject* newObject = proto.isObject()
</span><span class="cx">         ? constructEmptyObject(exec, asObject(proto))
</span><span class="cx">         : constructEmptyObject(exec, exec-&gt;lexicalGlobalObject()-&gt;nullPrototypeObjectStructure());
</span><span class="lines">@@ -505,7 +521,7 @@
</span><span class="cx">     if (exec-&gt;argument(1).isUndefined())
</span><span class="cx">         return JSValue::encode(newObject);
</span><span class="cx">     if (!exec-&gt;argument(1).isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Property descriptor list must be an Object.&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Property descriptor list must be an Object.&quot;));
</ins><span class="cx">     return JSValue::encode(defineProperties(exec, newObject, asObject(exec-&gt;argument(1))));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeObjectPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ObjectPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ObjectPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ObjectPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2008, 2011 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2008, 2011, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -127,6 +127,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSObject* thisObject = exec-&gt;thisValue().toThis(exec, StrictMode).toObject(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -134,7 +137,7 @@
</span><span class="cx">     JSValue get = exec-&gt;argument(1);
</span><span class="cx">     CallData callData;
</span><span class="cx">     if (getCallData(get, callData) == CallType::None)
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;invalid getter usage&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;invalid getter usage&quot;));
</ins><span class="cx"> 
</span><span class="cx">     auto propertyName = exec-&gt;argument(0).toPropertyKey(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -146,7 +149,7 @@
</span><span class="cx">     descriptor.setConfigurable(true);
</span><span class="cx"> 
</span><span class="cx">     bool shouldThrow = true;
</span><del>-    thisObject-&gt;methodTable(exec-&gt;vm())-&gt;defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
</del><ins>+    thisObject-&gt;methodTable(vm)-&gt;defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -153,6 +156,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSObject* thisObject = exec-&gt;thisValue().toThis(exec, StrictMode).toObject(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -160,7 +166,7 @@
</span><span class="cx">     JSValue set = exec-&gt;argument(1);
</span><span class="cx">     CallData callData;
</span><span class="cx">     if (getCallData(set, callData) == CallType::None)
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;invalid setter usage&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;invalid setter usage&quot;));
</ins><span class="cx"> 
</span><span class="cx">     auto propertyName = exec-&gt;argument(0).toPropertyKey(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -172,7 +178,7 @@
</span><span class="cx">     descriptor.setConfigurable(true);
</span><span class="cx"> 
</span><span class="cx">     bool shouldThrow = true;
</span><del>-    thisObject-&gt;methodTable(exec-&gt;vm())-&gt;defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
</del><ins>+    thisObject-&gt;methodTable(vm)-&gt;defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -269,6 +275,8 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue().toThis(exec, StrictMode);
</span><span class="cx">     if (thisValue.isUndefinedOrNull())
</span><span class="cx">         return JSValue::encode(thisValue.isUndefined() ? vm.smallStrings.undefinedObjectString() : vm.smallStrings.nullObjectString());
</span><span class="lines">@@ -303,7 +311,7 @@
</span><span class="cx">             return JSValue();
</span><span class="cx">         String newString = WTF::tryMakeString(&quot;[object &quot;, WTFMove(tag), &quot;]&quot;);
</span><span class="cx">         if (!newString)
</span><del>-            return throwOutOfMemoryError(exec);
</del><ins>+            return throwOutOfMemoryError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">         auto result = jsNontrivialString(&amp;vm, newString);
</span><span class="cx">         thisObject-&gt;structure(vm)-&gt;setObjectToStringValue(exec, vm, result, toStringTagSlot);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeOperationsh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Operations.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Operations.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Operations.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2002, 2005, 2006, 2007, 2008, 2009, 2013, 2014 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2002, 2005-2009, 2013-2014, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -40,6 +40,7 @@
</span><span class="cx"> ALWAYS_INLINE JSValue jsString(ExecState* exec, JSString* s1, JSString* s2)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     int32_t length1 = s1-&gt;length();
</span><span class="cx">     if (!length1)
</span><span class="lines">@@ -48,7 +49,7 @@
</span><span class="cx">     if (!length2)
</span><span class="cx">         return s1;
</span><span class="cx">     if (sumOverflows&lt;int32_t&gt;(length1, length2))
</span><del>-        return throwOutOfMemoryError(exec);
</del><ins>+        return throwOutOfMemoryError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSRopeString::create(vm, s1, s2);
</span><span class="cx"> }
</span><span class="lines">@@ -56,6 +57,7 @@
</span><span class="cx"> ALWAYS_INLINE JSValue jsString(ExecState* exec, const String&amp; u1, const String&amp; u2, const String&amp; u3)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx"> 
</span><span class="cx">     int32_t length1 = u1.length();
</span><span class="cx">     int32_t length2 = u2.length();
</span><span class="lines">@@ -62,7 +64,7 @@
</span><span class="cx">     int32_t length3 = u3.length();
</span><span class="cx">     
</span><span class="cx">     if (length1 &lt; 0 || length2 &lt; 0 || length3 &lt; 0)
</span><del>-        return throwOutOfMemoryError(exec);
</del><ins>+        return throwOutOfMemoryError(exec, scope);
</ins><span class="cx">     
</span><span class="cx">     if (!length1)
</span><span class="cx">         return jsString(exec, jsString(vm, u2), jsString(vm, u3));
</span><span class="lines">@@ -72,7 +74,7 @@
</span><span class="cx">         return jsString(exec, jsString(vm, u1), jsString(vm, u2));
</span><span class="cx"> 
</span><span class="cx">     if (sumOverflows&lt;int32_t&gt;(length1, length2, length3))
</span><del>-        return throwOutOfMemoryError(exec);
</del><ins>+        return throwOutOfMemoryError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return JSRopeString::create(exec-&gt;vm(), jsString(vm, u1), jsString(vm, u2), jsString(vm, u3));
</span><span class="cx"> }
</span><span class="lines">@@ -80,12 +82,13 @@
</span><span class="cx"> ALWAYS_INLINE JSValue jsStringFromRegisterArray(ExecState* exec, Register* strings, unsigned count)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx">     JSRopeString::RopeBuilder ropeBuilder(*vm);
</span><span class="cx"> 
</span><span class="cx">     for (unsigned i = 0; i &lt; count; ++i) {
</span><span class="cx">         JSValue v = strings[-static_cast&lt;int&gt;(i)].jsValue();
</span><span class="cx">         if (!ropeBuilder.append(v.toString(exec)))
</span><del>-            return throwOutOfMemoryError(exec);
</del><ins>+            return throwOutOfMemoryError(exec, scope);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return ropeBuilder.release();
</span><span class="lines">@@ -94,6 +97,7 @@
</span><span class="cx"> ALWAYS_INLINE JSValue jsStringFromArguments(ExecState* exec, JSValue thisValue)
</span><span class="cx"> {
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(*vm);
</ins><span class="cx">     JSRopeString::RopeBuilder ropeBuilder(*vm);
</span><span class="cx">     ropeBuilder.append(thisValue.toString(exec));
</span><span class="cx"> 
</span><span class="lines">@@ -100,7 +104,7 @@
</span><span class="cx">     for (unsigned i = 0; i &lt; exec-&gt;argumentCount(); ++i) {
</span><span class="cx">         JSValue v = exec-&gt;argument(i);
</span><span class="cx">         if (!ropeBuilder.append(v.toString(exec)))
</span><del>-            return throwOutOfMemoryError(exec);
</del><ins>+            return throwOutOfMemoryError(exec, scope);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return ropeBuilder.release();
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeProxyConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ProxyConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ProxyConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ProxyConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -56,8 +56,9 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL makeRevocableProxy(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     if (exec-&gt;argumentCount() &lt; 2)
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Proxy.revocable needs to be called with two arguments: the target and the handler&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy.revocable needs to be called with two arguments: the target and the handler&quot;));
</ins><span class="cx"> 
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     ArgList args(exec);
</span><span class="lines">@@ -81,7 +82,8 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL proxyRevocableConstructorThrowError(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return throwVMTypeError(exec, ASCIILiteral(&quot;Proxy.revocable cannot be constructed. It can only be called&quot;));
</del><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
+    return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy.revocable cannot be constructed. It can only be called&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void ProxyConstructor::finishCreation(VM&amp; vm, const char* name, JSGlobalObject* globalObject)
</span><span class="lines">@@ -94,8 +96,9 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructProxyObject(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
</ins><span class="cx">     if (exec-&gt;newTarget().isUndefined())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;new.target of Proxy construct should not be undefined&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;new.target of Proxy construct should not be undefined&quot;));
</ins><span class="cx"> 
</span><span class="cx">     ArgList args(exec);
</span><span class="cx">     JSValue target = args.at(0);
</span><span class="lines">@@ -111,7 +114,8 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callProxy(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, &quot;Proxy&quot;));
</del><ins>+    auto scope = DECLARE_THROW_SCOPE(exec-&gt;vm());
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, &quot;Proxy&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> CallType ProxyConstructor::getCallData(JSCell*, CallData&amp; callData)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeProxyObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ProxyObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ProxyObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ProxyObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -31,6 +31,7 @@
</span><span class="cx"> #include &quot;IdentifierInlines.h&quot;
</span><span class="cx"> #include &quot;JSCJSValueInlines.h&quot;
</span><span class="cx"> #include &quot;JSCellInlines.h&quot;
</span><ins>+#include &quot;JSObjectInlines.h&quot;
</ins><span class="cx"> #include &quot;ObjectConstructor.h&quot;
</span><span class="cx"> #include &quot;SlotVisitorInlines.h&quot;
</span><span class="cx"> #include &quot;StructureInlines.h&quot;
</span><span class="lines">@@ -79,19 +80,20 @@
</span><span class="cx"> 
</span><span class="cx"> void ProxyObject::finishCreation(VM&amp; vm, ExecState* exec, JSValue target, JSValue handler)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     if (!target.isObject()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;A Proxy's 'target' should be an Object&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;A Proxy's 'target' should be an Object&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     if (ProxyObject* targetAsProxy = jsDynamicCast&lt;ProxyObject*&gt;(target)) {
</span><span class="cx">         if (targetAsProxy-&gt;handler().isNull()) {
</span><del>-            throwTypeError(exec, ASCIILiteral(&quot;If a Proxy's handler is another Proxy object, the other Proxy should not have been revoked&quot;));
</del><ins>+            throwTypeError(exec, scope, ASCIILiteral(&quot;If a Proxy's handler is another Proxy object, the other Proxy should not have been revoked&quot;));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx">     if (!handler.isObject()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;A Proxy's 'handler' should be an Object&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;A Proxy's 'handler' should be an Object&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -116,8 +118,9 @@
</span><span class="cx"> static JSValue performProxyGet(ExecState* exec, ProxyObject* proxyObject, JSValue receiver, PropertyName propertyName)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return JSValue();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -135,7 +138,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue handlerValue = proxyObject-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull())
</span><del>-        return throwTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        return throwTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx"> 
</span><span class="cx">     JSObject* handler = jsCast&lt;JSObject*&gt;(handlerValue);
</span><span class="cx">     CallData callData;
</span><span class="lines">@@ -159,10 +162,10 @@
</span><span class="cx">     if (target-&gt;getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
</span><span class="cx">         if (descriptor.isDataDescriptor() &amp;&amp; !descriptor.configurable() &amp;&amp; !descriptor.writable()) {
</span><span class="cx">             if (!sameValue(exec, descriptor.value(), trapResult))
</span><del>-                return throwTypeError(exec, ASCIILiteral(&quot;Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property&quot;));
</del><ins>+                return throwTypeError(exec, scope, ASCIILiteral(&quot;Proxy handler's 'get' result of a non-configurable and non-writable property should be the same value as the target's property&quot;));
</ins><span class="cx">         } else if (descriptor.isAccessorDescriptor() &amp;&amp; !descriptor.configurable() &amp;&amp; descriptor.getter().isUndefined()) {
</span><span class="cx">             if (!trapResult.isUndefined())
</span><del>-                return throwTypeError(exec, ASCIILiteral(&quot;Proxy handler's 'get' result of a non-configurable accessor property without a getter should be undefined&quot;));
</del><ins>+                return throwTypeError(exec, scope, ASCIILiteral(&quot;Proxy handler's 'get' result of a non-configurable accessor property without a getter should be undefined&quot;));
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -185,8 +188,9 @@
</span><span class="cx"> bool ProxyObject::performInternalMethodGetOwnProperty(ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     JSObject* target = this-&gt;target();
</span><span class="lines">@@ -200,7 +204,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue handlerValue = this-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -221,7 +225,7 @@
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     if (!trapResult.isUndefined() &amp;&amp; !trapResult.isObject()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(&quot;result of 'getOwnPropertyDescriptor' call should either be an Object or undefined&quot;));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(&quot;result of 'getOwnPropertyDescriptor' call should either be an Object or undefined&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -234,7 +238,7 @@
</span><span class="cx">         if (!isTargetPropertyDescriptorDefined)
</span><span class="cx">             return false;
</span><span class="cx">         if (!targetPropertyDescriptor.configurable()) {
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;When the result of 'getOwnPropertyDescriptor' is undefined the target must be configurable&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;When the result of 'getOwnPropertyDescriptor' is undefined the target must be configurable&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         // FIXME: this doesn't work if 'target' is another Proxy. We don't have isExtensible implemented in a way that fits w/ Proxys.
</span><span class="lines">@@ -246,7 +250,7 @@
</span><span class="cx">             // FIXME: Come up with a test for this error. I'm not sure how to because
</span><span class="cx">             // Object.seal(o) will make all fields [[Configurable]] false.
</span><span class="cx">             // https://bugs.webkit.org/show_bug.cgi?id=154376
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;When 'getOwnPropertyDescriptor' returns undefined, the 'target' of a Proxy should be extensible&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;When 'getOwnPropertyDescriptor' returns undefined, the 'target' of a Proxy should be extensible&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -264,13 +268,13 @@
</span><span class="cx">     bool valid = validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, isExtensible,
</span><span class="cx">         trapResultAsDescriptor, isTargetPropertyDescriptorDefined, targetPropertyDescriptor, throwException);
</span><span class="cx">     if (!valid) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(&quot;Result from 'getOwnPropertyDescriptor' fails the IsCompatiblePropertyDescriptor test&quot;));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(&quot;Result from 'getOwnPropertyDescriptor' fails the IsCompatiblePropertyDescriptor test&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!trapResultAsDescriptor.configurable()) {
</span><span class="cx">         if (!isTargetPropertyDescriptorDefined || targetPropertyDescriptor.configurable()) {
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;Result from 'getOwnPropertyDescriptor' can't be non-configurable when the 'target' doesn't have it as an own property or if it is a configurable own property on 'target'&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;Result from 'getOwnPropertyDescriptor' can't be non-configurable when the 'target' doesn't have it as an own property or if it is a configurable own property on 'target'&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -291,8 +295,9 @@
</span><span class="cx"> bool ProxyObject::performHasProperty(ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     JSObject* target = this-&gt;target();
</span><span class="lines">@@ -307,7 +312,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue handlerValue = this-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -338,7 +343,7 @@
</span><span class="cx">             return false;
</span><span class="cx">         if (isPropertyDescriptorDefined) {
</span><span class="cx">             if (!descriptor.configurable()) {
</span><del>-                throwVMTypeError(exec, ASCIILiteral(&quot;Proxy 'has' must return 'true' for non-configurable properties&quot;));
</del><ins>+                throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy 'has' must return 'true' for non-configurable properties&quot;));
</ins><span class="cx">                 return false;
</span><span class="cx">             }
</span><span class="cx">             bool isExtensible = target-&gt;isExtensible(exec);
</span><span class="lines">@@ -345,7 +350,7 @@
</span><span class="cx">             if (exec-&gt;hadException())
</span><span class="cx">                 return false;
</span><span class="cx">             if (!isExtensible) {
</span><del>-                throwVMTypeError(exec, ASCIILiteral(&quot;Proxy 'has' must return 'true' for a non-extensible 'target' object with a configurable property&quot;));
</del><ins>+                throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy 'has' must return 'true' for a non-extensible 'target' object with a configurable property&quot;));
</ins><span class="cx">                 return false;
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="lines">@@ -356,8 +361,10 @@
</span><span class="cx"> 
</span><span class="cx"> bool ProxyObject::getOwnPropertySlotCommon(ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><del>-    if (UNLIKELY(!exec-&gt;vm().isSafeToRecurseSoft())) {
-        throwStackOverflowError(exec);
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     slot.disableCaching();
</span><span class="lines">@@ -394,8 +401,9 @@
</span><span class="cx"> bool ProxyObject::performPut(ExecState* exec, JSValue putValue, JSValue thisValue, PropertyName propertyName, PerformDefaultPutFunction performDefaultPut)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -404,7 +412,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue handlerValue = this-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -436,11 +444,11 @@
</span><span class="cx">     if (target-&gt;getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
</span><span class="cx">         if (descriptor.isDataDescriptor() &amp;&amp; !descriptor.configurable() &amp;&amp; !descriptor.writable()) {
</span><span class="cx">             if (!sameValue(exec, descriptor.value(), putValue)) {
</span><del>-                throwVMTypeError(exec, ASCIILiteral(&quot;Proxy handler's 'set' on a non-configurable and non-writable property on 'target' should either return false or be the same value already on the 'target'&quot;));
</del><ins>+                throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy handler's 'set' on a non-configurable and non-writable property on 'target' should either return false or be the same value already on the 'target'&quot;));
</ins><span class="cx">                 return false;
</span><span class="cx">             }
</span><span class="cx">         } else if (descriptor.isAccessorDescriptor() &amp;&amp; !descriptor.configurable() &amp;&amp; descriptor.setter().isUndefined()) {
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;Proxy handler's 'set' method on a non-configurable accessor property without a setter should return false&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy handler's 'set' method on a non-configurable accessor property without a setter should return false&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -486,14 +494,15 @@
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL performProxyCall(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return JSValue::encode(JSValue());
</span><span class="cx">     }
</span><span class="cx">     ProxyObject* proxy = jsCast&lt;ProxyObject*&gt;(exec-&gt;callee());
</span><span class="cx">     JSValue handlerValue = proxy-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx"> 
</span><span class="cx">     JSObject* handler = jsCast&lt;JSObject*&gt;(handlerValue);
</span><span class="cx">     CallData callData;
</span><span class="lines">@@ -535,14 +544,15 @@
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL performProxyConstruct(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return JSValue::encode(JSValue());
</span><span class="cx">     }
</span><span class="cx">     ProxyObject* proxy = jsCast&lt;ProxyObject*&gt;(exec-&gt;callee());
</span><span class="cx">     JSValue handlerValue = proxy-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx"> 
</span><span class="cx">     JSObject* handler = jsCast&lt;JSObject*&gt;(handlerValue);
</span><span class="cx">     CallData callData;
</span><span class="lines">@@ -569,7 +579,7 @@
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     if (!result.isObject())
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;Result from Proxy handler's 'construct' method should be an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Result from Proxy handler's 'construct' method should be an object&quot;));
</ins><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -590,8 +600,9 @@
</span><span class="cx"> bool ProxyObject::performDelete(ExecState* exec, PropertyName propertyName, DefaultDeleteFunction performDefaultDelete)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -600,7 +611,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue handlerValue = this-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -631,7 +642,7 @@
</span><span class="cx">     PropertyDescriptor descriptor;
</span><span class="cx">     if (target-&gt;getOwnPropertyDescriptor(exec, propertyName, descriptor)) {
</span><span class="cx">         if (!descriptor.configurable()) {
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;Proxy handler's 'deleteProperty' method should return false when the target's property is not configurable&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy handler's 'deleteProperty' method should return false when the target's property is not configurable&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -666,14 +677,15 @@
</span><span class="cx"> bool ProxyObject::performPreventExtensions(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSValue handlerValue = this-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -702,7 +714,7 @@
</span><span class="cx">         if (exec-&gt;hadException())
</span><span class="cx">             return false;
</span><span class="cx">         if (targetIsExtensible) {
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;Proxy's 'preventExtensions' trap returned true even though its target is extensible. It should have returned false&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy's 'preventExtensions' trap returned true even though its target is extensible. It should have returned false&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -718,14 +730,15 @@
</span><span class="cx"> bool ProxyObject::performIsExtensible(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSValue handlerValue = this-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -757,11 +770,11 @@
</span><span class="cx">     if (trapResultAsBool != isTargetExtensible) {
</span><span class="cx">         if (isTargetExtensible) {
</span><span class="cx">             ASSERT(!trapResultAsBool);
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;Proxy object's 'isExtensible' trap returned false when the target is extensible. It should have returned true&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy object's 'isExtensible' trap returned false when the target is extensible. It should have returned true&quot;));
</ins><span class="cx">         } else {
</span><span class="cx">             ASSERT(!isTargetExtensible);
</span><span class="cx">             ASSERT(trapResultAsBool);
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;Proxy object's 'isExtensible' trap returned true when the target is non-extensible. It should have returned false&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy object's 'isExtensible' trap returned true when the target is non-extensible. It should have returned false&quot;));
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -776,8 +789,9 @@
</span><span class="cx"> bool ProxyObject::performDefineOwnProperty(ExecState* exec, PropertyName propertyName, const PropertyDescriptor&amp; descriptor, bool shouldThrow)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -791,7 +805,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue handlerValue = this-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -836,11 +850,11 @@
</span><span class="cx"> 
</span><span class="cx">     if (!isTargetDescriptorDefined) {
</span><span class="cx">         if (!targetIsExtensible) {
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;Proxy's 'defineProperty' trap returned true even though getOwnPropertyDescriptor of the Proxy's target returned undefined and the target is non-extensible&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy's 'defineProperty' trap returned true even though getOwnPropertyDescriptor of the Proxy's target returned undefined and the target is non-extensible&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         if (settingConfigurableToFalse) {
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;Proxy's 'defineProperty' trap returned true for a non-configurable field even though getOwnPropertyDescriptor of the Proxy's target returned undefined&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy's 'defineProperty' trap returned true for a non-configurable field even though getOwnPropertyDescriptor of the Proxy's target returned undefined&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="lines">@@ -853,11 +867,11 @@
</span><span class="cx">     bool throwException = false;
</span><span class="cx">     bool isCompatibleDescriptor = validateAndApplyPropertyDescriptor(exec, nullptr, propertyName, targetIsExtensible, descriptor, isCurrentDefined, current, throwException);
</span><span class="cx">     if (!isCompatibleDescriptor) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(&quot;Proxy's 'defineProperty' trap did not define a property on its target that is compatible with the trap's input descriptor&quot;));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy's 'defineProperty' trap did not define a property on its target that is compatible with the trap's input descriptor&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     if (settingConfigurableToFalse &amp;&amp; targetDescriptor.configurable()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(&quot;Proxy's 'defineProperty' trap did not define a non-configurable property on its target even though the input descriptor to the trap said it must do so&quot;));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy's 'defineProperty' trap did not define a non-configurable property on its target even though the input descriptor to the trap said it must do so&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -873,13 +887,14 @@
</span><span class="cx"> void ProxyObject::performGetOwnPropertyNames(ExecState* exec, PropertyNameArray&amp; trapResult, EnumerationMode enumerationMode)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     JSValue handlerValue = this-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -969,7 +984,7 @@
</span><span class="cx"> 
</span><span class="cx">     for (UniquedStringImpl* impl : targetNonConfigurableKeys) {
</span><span class="cx">         if (removeIfContainedInUncheckedResultKeys(impl) == IsNotContainedIn) {
</span><del>-            throwVMTypeError(exec, makeString(&quot;Proxy object's 'target' has the non-configurable property '&quot;, String(impl), &quot;' that was not in the result from the 'ownKeys' trap&quot;));
</del><ins>+            throwVMTypeError(exec, scope, makeString(&quot;Proxy object's 'target' has the non-configurable property '&quot;, String(impl), &quot;' that was not in the result from the 'ownKeys' trap&quot;));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -979,13 +994,13 @@
</span><span class="cx"> 
</span><span class="cx">     for (UniquedStringImpl* impl : targetConfigurableKeys) {
</span><span class="cx">         if (removeIfContainedInUncheckedResultKeys(impl) == IsNotContainedIn) {
</span><del>-            throwVMTypeError(exec, makeString(&quot;Proxy object's non-extensible 'target' has configurable property '&quot;, String(impl), &quot;' that was not in the result from the 'ownKeys' trap&quot;));
</del><ins>+            throwVMTypeError(exec, scope, makeString(&quot;Proxy object's non-extensible 'target' has configurable property '&quot;, String(impl), &quot;' that was not in the result from the 'ownKeys' trap&quot;));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (uncheckedResultKeys.size()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(&quot;Proxy handler's 'ownKeys' method returned a key that was not present in its non-extensible target&quot;));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy handler's 'ownKeys' method returned a key that was not present in its non-extensible target&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -1022,14 +1037,15 @@
</span><span class="cx">     ASSERT(prototype.isObject() || prototype.isNull());
</span><span class="cx"> 
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSValue handlerValue = this-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1057,7 +1073,7 @@
</span><span class="cx">     
</span><span class="cx">     if (!trapResultAsBool) {
</span><span class="cx">         if (shouldThrowIfCantSet)
</span><del>-            throwVMTypeError(exec, ASCIILiteral(&quot;Proxy 'setPrototypeOf' returned false indicating it could not set the prototype value. The operation was expected to succeed&quot;));
</del><ins>+            throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy 'setPrototypeOf' returned false indicating it could not set the prototype value. The operation was expected to succeed&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1071,7 +1087,7 @@
</span><span class="cx">     if (vm.exception())
</span><span class="cx">         return false;
</span><span class="cx">     if (!sameValue(exec, prototype, targetPrototype)) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(&quot;Proxy 'setPrototypeOf' trap returned true when its target is non-extensible and the new prototype value is not the same as the current prototype value. It should have returned false&quot;));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy 'setPrototypeOf' trap returned true when its target is non-extensible and the new prototype value is not the same as the current prototype value. It should have returned false&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1086,14 +1102,15 @@
</span><span class="cx"> JSValue ProxyObject::performGetPrototype(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (UNLIKELY(!vm.isSafeToRecurseSoft())) {
</span><del>-        throwStackOverflowError(exec);
</del><ins>+        throwStackOverflowError(exec, scope);
</ins><span class="cx">         return JSValue();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSValue handlerValue = this-&gt;handler();
</span><span class="cx">     if (handlerValue.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(s_proxyAlreadyRevokedErrorMessage));
</ins><span class="cx">         return JSValue();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1115,7 +1132,7 @@
</span><span class="cx">         return JSValue();
</span><span class="cx"> 
</span><span class="cx">     if (!trapResult.isObject() &amp;&amp; !trapResult.isNull()) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(&quot;Proxy handler's 'getPrototypeOf' trap should either return an object or null&quot;));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy handler's 'getPrototypeOf' trap should either return an object or null&quot;));
</ins><span class="cx">         return JSValue();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -1129,7 +1146,7 @@
</span><span class="cx">     if (vm.exception())
</span><span class="cx">         return JSValue();
</span><span class="cx">     if (!sameValue(exec, targetPrototype, trapResult)) {
</span><del>-        throwVMTypeError(exec, ASCIILiteral(&quot;Proxy's 'getPrototypeOf' trap for a non-extensible target should return the same value as the target's prototype&quot;));
</del><ins>+        throwVMTypeError(exec, scope, ASCIILiteral(&quot;Proxy's 'getPrototypeOf' trap for a non-extensible target should return the same value as the target's prototype&quot;));
</ins><span class="cx">         return JSValue();
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeReflectObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ReflectObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ReflectObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ReflectObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -95,26 +95,29 @@
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.construct
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectConstruct(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.construct requires the first argument be a constructor&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.construct requires the first argument be a constructor&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     ConstructData constructData;
</span><span class="cx">     ConstructType constructType;
</span><span class="cx">     if (!target.isConstructor(constructType, constructData))
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.construct requires the first argument be a constructor&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.construct requires the first argument be a constructor&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     JSValue newTarget = target;
</span><span class="cx">     if (exec-&gt;argumentCount() &gt;= 3) {
</span><span class="cx">         newTarget = exec-&gt;argument(2);
</span><span class="cx">         if (!newTarget.isConstructor())
</span><del>-            return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.construct requires the third argument be a constructor if present&quot;)));
</del><ins>+            return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.construct requires the third argument be a constructor if present&quot;)));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     MarkedArgumentBuffer arguments;
</span><span class="cx">     JSObject* argumentsObject = jsDynamicCast&lt;JSObject*&gt;(exec-&gt;argument(1));
</span><span class="cx">     if (!argumentsObject)
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.construct requires the second argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.construct requires the second argument be an object&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     createListFromArrayLike(exec, argumentsObject, RuntimeTypeMaskAllTypes, ASCIILiteral(&quot;This error must not be raised&quot;), [&amp;] (JSValue value, RuntimeType) -&gt; bool {
</span><span class="cx">         arguments.append(value);
</span><span class="lines">@@ -129,9 +132,12 @@
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.defineproperty
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectDefineProperty(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.defineProperty requires the first argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.defineProperty requires the first argument be an object&quot;)));
</ins><span class="cx">     auto propertyName = exec-&gt;argument(1).toPropertyKey(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -145,7 +151,7 @@
</span><span class="cx">     // Reflect.defineProperty should not throw an error when the defineOwnProperty operation fails.
</span><span class="cx">     bool shouldThrow = false;
</span><span class="cx">     JSObject* targetObject = asObject(target);
</span><del>-    return JSValue::encode(jsBoolean(targetObject-&gt;methodTable(exec-&gt;vm())-&gt;defineOwnProperty(targetObject, exec, propertyName, descriptor, shouldThrow)));
</del><ins>+    return JSValue::encode(jsBoolean(targetObject-&gt;methodTable(vm)-&gt;defineOwnProperty(targetObject, exec, propertyName, descriptor, shouldThrow)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // FIXME: Reflect.enumerate is removed in ECMA 2016 draft.
</span><span class="lines">@@ -152,9 +158,12 @@
</span><span class="cx"> // http://www.ecma-international.org/ecma-262/6.0/#sec-reflect.enumerate
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectEnumerate(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.enumerate requires the first argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.enumerate requires the first argument be an object&quot;)));
</ins><span class="cx">     return JSValue::encode(JSPropertyNameIterator::create(exec, exec-&gt;lexicalGlobalObject()-&gt;propertyNameIteratorStructure(), asObject(target)));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -161,9 +170,12 @@
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.get
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectGet(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.get requires the first argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.get requires the first argument be an object&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     const Identifier propertyName = exec-&gt;argument(1).toPropertyKey(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -180,9 +192,12 @@
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.getownpropertydescriptor
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectGetOwnPropertyDescriptor(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.getOwnPropertyDescriptor requires the first argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.getOwnPropertyDescriptor requires the first argument be an object&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     auto key = exec-&gt;argument(1).toPropertyKey(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -194,9 +209,12 @@
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.getprototypeof
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectGetPrototypeOf(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.getPrototypeOf requires the first argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.getPrototypeOf requires the first argument be an object&quot;)));
</ins><span class="cx">     return JSValue::encode(objectConstructorGetPrototypeOf(exec, asObject(target)));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -203,9 +221,12 @@
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.isextensible
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectIsExtensible(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.isExtensible requires the first argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.isExtensible requires the first argument be an object&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     bool isExtensible = asObject(target)-&gt;isExtensible(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -216,9 +237,12 @@
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.ownkeys
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectOwnKeys(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.ownKeys requires the first argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.ownKeys requires the first argument be an object&quot;)));
</ins><span class="cx">     return JSValue::encode(ownPropertyKeys(exec, jsCast&lt;JSObject*&gt;(target), PropertyNameMode::StringsAndSymbols, DontEnumPropertiesMode::Include));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -225,11 +249,14 @@
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.preventextensions
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectPreventExtensions(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.preventExtensions requires the first argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.preventExtensions requires the first argument be an object&quot;)));
</ins><span class="cx">     JSObject* object = asObject(target);
</span><del>-    bool result = object-&gt;methodTable(exec-&gt;vm())-&gt;preventExtensions(object, exec);
</del><ins>+    bool result = object-&gt;methodTable(vm)-&gt;preventExtensions(object, exec);
</ins><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(JSValue());
</span><span class="cx">     return JSValue::encode(jsBoolean(result));
</span><span class="lines">@@ -238,9 +265,12 @@
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.set
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectSet(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.set requires the first argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.set requires the first argument be an object&quot;)));
</ins><span class="cx">     JSObject* targetObject = asObject(target);
</span><span class="cx"> 
</span><span class="cx">     auto propertyName = exec-&gt;argument(1).toPropertyKey(exec);
</span><span class="lines">@@ -254,18 +284,21 @@
</span><span class="cx">     // Do not raise any readonly errors that happen in strict mode.
</span><span class="cx">     bool shouldThrowIfCantSet = false;
</span><span class="cx">     PutPropertySlot slot(receiver, shouldThrowIfCantSet);
</span><del>-    return JSValue::encode(jsBoolean(targetObject-&gt;methodTable(exec-&gt;vm())-&gt;put(targetObject, exec, propertyName, exec-&gt;argument(2), slot)));
</del><ins>+    return JSValue::encode(jsBoolean(targetObject-&gt;methodTable(vm)-&gt;put(targetObject, exec, propertyName, exec-&gt;argument(2), slot)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.setprototypeof
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL reflectObjectSetPrototypeOf(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue target = exec-&gt;argument(0);
</span><span class="cx">     if (!target.isObject())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.setPrototypeOf requires the first argument be an object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.setPrototypeOf requires the first argument be an object&quot;)));
</ins><span class="cx">     JSValue proto = exec-&gt;argument(1);
</span><span class="cx">     if (!proto.isObject() &amp;&amp; !proto.isNull())
</span><del>-        return JSValue::encode(throwTypeError(exec, ASCIILiteral(&quot;Reflect.setPrototypeOf requires the second argument be either an object or null&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, ASCIILiteral(&quot;Reflect.setPrototypeOf requires the second argument be either an object or null&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     JSObject* object = asObject(target);
</span><span class="cx"> 
</span><span class="lines">@@ -272,7 +305,6 @@
</span><span class="cx">     if (!checkProtoSetterAccessAllowed(exec, object))
</span><span class="cx">         return JSValue::encode(jsBoolean(false));
</span><span class="cx"> 
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     bool shouldThrowIfCantSet = false;
</span><span class="cx">     bool didSetPrototype = object-&gt;setPrototype(vm, exec, proto, shouldThrowIfCantSet);
</span><span class="cx">     if (vm.exception())
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRegExpConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -210,6 +210,9 @@
</span><span class="cx"> 
</span><span class="cx"> inline RegExpFlags toFlags(ExecState* exec, JSValue flags)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (flags.isUndefined())
</span><span class="cx">         return NoFlags;
</span><span class="cx">     JSString* flagsString = flags.toString(exec);
</span><span class="lines">@@ -222,7 +225,7 @@
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return InvalidFlags;
</span><span class="cx">     if (result == InvalidFlags)
</span><del>-        throwSyntaxError(exec, ASCIILiteral(&quot;Invalid flags supplied to RegExp constructor.&quot;));
</del><ins>+        throwSyntaxError(exec, scope, ASCIILiteral(&quot;Invalid flags supplied to RegExp constructor.&quot;));
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -229,6 +232,8 @@
</span><span class="cx"> static JSObject* regExpCreate(ExecState* exec, JSGlobalObject* globalObject, JSValue newTarget, JSValue patternArg, JSValue flagsArg)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String pattern = patternArg.isUndefined() ? emptyString() : patternArg.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return nullptr;
</span><span class="lines">@@ -239,7 +244,7 @@
</span><span class="cx"> 
</span><span class="cx">     RegExp* regExp = RegExp::create(vm, pattern, flags);
</span><span class="cx">     if (!regExp-&gt;isValid())
</span><del>-        return vm.throwException(exec, createSyntaxError(exec, regExp-&gt;errorMessage()));
</del><ins>+        return throwException(exec, scope, createSyntaxError(exec, regExp-&gt;errorMessage()));
</ins><span class="cx"> 
</span><span class="cx">     Structure* structure = getRegExpStructure(exec, globalObject, newTarget);
</span><span class="cx">     if (vm.exception())
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRegExpObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -171,6 +171,8 @@
</span><span class="cx"> template&lt;typename FixEndFunc&gt;
</span><span class="cx"> JSValue collectMatches(VM&amp; vm, ExecState* exec, JSString* string, const String&amp; s, RegExpConstructor* constructor, RegExp* regExp, const FixEndFunc&amp; fixEnd)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     MatchResult result = constructor-&gt;performMatch(vm, regExp, string, s, 0);
</span><span class="cx">     if (!result)
</span><span class="cx">         return jsNull();
</span><span class="lines">@@ -197,7 +199,7 @@
</span><span class="cx">             MatchResult savedResult = result;
</span><span class="cx">             do {
</span><span class="cx">                 if (array-&gt;length() + matchCount &gt;= MAX_STORAGE_VECTOR_LENGTH) {
</span><del>-                    throwOutOfMemoryError(exec);
</del><ins>+                    throwOutOfMemoryError(exec, scope);
</ins><span class="cx">                     return jsUndefined();
</span><span class="cx">                 }
</span><span class="cx">                 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRegExpObjecth"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpObject.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpObject.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpObject.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -23,6 +23,7 @@
</span><span class="cx"> 
</span><span class="cx"> #include &quot;JSObject.h&quot;
</span><span class="cx"> #include &quot;RegExp.h&quot;
</span><ins>+#include &quot;ThrowScope.h&quot;
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx">     
</span><span class="lines">@@ -43,15 +44,21 @@
</span><span class="cx"> 
</span><span class="cx">     bool setLastIndex(ExecState* exec, size_t lastIndex)
</span><span class="cx">     {
</span><ins>+        VM&amp; vm = exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">         if (LIKELY(m_lastIndexIsWritable)) {
</span><span class="cx">             m_lastIndex.setWithoutWriteBarrier(jsNumber(lastIndex));
</span><span class="cx">             return true;
</span><span class="cx">         }
</span><del>-        throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+        throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     bool setLastIndex(ExecState* exec, JSValue lastIndex, bool shouldThrow)
</span><span class="cx">     {
</span><ins>+        VM&amp; vm = exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">         if (LIKELY(m_lastIndexIsWritable)) {
</span><span class="cx">             m_lastIndex.set(exec-&gt;vm(), this, lastIndex);
</span><span class="cx">             return true;
</span><span class="lines">@@ -58,7 +65,7 @@
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         if (shouldThrow)
</span><del>-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     JSValue getLastIndex() const
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRegExpPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/RegExpPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -98,9 +98,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoFuncTestFast(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(RegExpObject::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSString* string = exec-&gt;argument(0).toStringOrNull(exec);
</span><span class="cx">     if (!string)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -109,9 +112,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(RegExpObject::info()))
</span><del>-        return throwVMTypeError(exec, &quot;Builtin RegExp exec can only be called on a RegExp object&quot;);
</del><ins>+        return throwVMTypeError(exec, scope, &quot;Builtin RegExp exec can only be called on a RegExp object&quot;);
</ins><span class="cx">     JSString* string = exec-&gt;argument(0).toStringOrNull(exec);
</span><span class="cx">     if (!string)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -120,9 +126,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoFuncMatchFast(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(RegExpObject::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSString* string = exec-&gt;argument(0).toStringOrNull(exec);
</span><span class="cx">     if (!string)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -133,9 +142,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(RegExpObject::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     RegExp* regExp;
</span><span class="cx">     JSValue arg0 = exec-&gt;argument(0);
</span><span class="lines">@@ -143,7 +155,7 @@
</span><span class="cx">     
</span><span class="cx">     if (arg0.inherits(RegExpObject::info())) {
</span><span class="cx">         if (!arg1.isUndefined())
</span><del>-            return throwVMTypeError(exec, ASCIILiteral(&quot;Cannot supply flags when constructing one RegExp from another.&quot;));
</del><ins>+            return throwVMTypeError(exec, scope, ASCIILiteral(&quot;Cannot supply flags when constructing one RegExp from another.&quot;));
</ins><span class="cx">         regExp = asRegExpObject(arg0)-&gt;regExp();
</span><span class="cx">     } else {
</span><span class="cx">         String pattern = !exec-&gt;argumentCount() ? emptyString() : arg0.toString(exec)-&gt;value(exec);
</span><span class="lines">@@ -156,15 +168,15 @@
</span><span class="cx">             if (exec-&gt;hadException())
</span><span class="cx">                 return JSValue::encode(jsUndefined());
</span><span class="cx">             if (flags == InvalidFlags)
</span><del>-                return throwVMError(exec, createSyntaxError(exec, ASCIILiteral(&quot;Invalid flags supplied to RegExp constructor.&quot;)));
</del><ins>+                return throwVMError(exec, scope, createSyntaxError(exec, ASCIILiteral(&quot;Invalid flags supplied to RegExp constructor.&quot;)));
</ins><span class="cx">         }
</span><del>-        regExp = RegExp::create(exec-&gt;vm(), pattern, flags);
</del><ins>+        regExp = RegExp::create(vm, pattern, flags);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!regExp-&gt;isValid())
</span><del>-        return throwVMError(exec, createSyntaxError(exec, regExp-&gt;errorMessage()));
</del><ins>+        return throwVMError(exec, scope, createSyntaxError(exec, regExp-&gt;errorMessage()));
</ins><span class="cx"> 
</span><del>-    asRegExpObject(thisValue)-&gt;setRegExp(exec-&gt;vm(), regExp);
</del><ins>+    asRegExpObject(thisValue)-&gt;setRegExp(vm, regExp);
</ins><span class="cx">     asRegExpObject(thisValue)-&gt;setLastIndex(exec, 0);
</span><span class="cx">     return JSValue::encode(thisValue);
</span><span class="cx"> }
</span><span class="lines">@@ -212,9 +224,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     JSObject* thisObject = asObject(thisValue);
</span><span class="cx"> 
</span><span class="lines">@@ -222,7 +237,6 @@
</span><span class="cx">     if (JSValue earlyReturnValue = checker.earlyReturnValue())
</span><span class="cx">         return JSValue::encode(earlyReturnValue);
</span><span class="cx"> 
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     JSValue sourceValue = thisObject-&gt;get(exec, vm.propertyNames-&gt;source);
</span><span class="cx">     if (vm.exception())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -242,11 +256,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoGetterGlobal(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
</span><span class="cx">         if (thisValue.inherits(RegExpPrototype::info()))
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;The RegExp.prototype.global getter can only be called on a RegExp object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.global getter can only be called on a RegExp object&quot;));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsBoolean(asRegExpObject(thisValue)-&gt;regExp()-&gt;global()));
</span><span class="lines">@@ -254,11 +271,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoGetterIgnoreCase(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
</span><span class="cx">         if (thisValue.inherits(RegExpPrototype::info()))
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;The RegExp.prototype.ignoreCase getter can only be called on a RegExp object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.ignoreCase getter can only be called on a RegExp object&quot;));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsBoolean(asRegExpObject(thisValue)-&gt;regExp()-&gt;ignoreCase()));
</span><span class="lines">@@ -266,11 +286,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoGetterMultiline(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
</span><span class="cx">         if (thisValue.inherits(RegExpPrototype::info()))
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;The RegExp.prototype.multiline getter can only be called on a RegExp object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.multiline getter can only be called on a RegExp object&quot;));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsBoolean(asRegExpObject(thisValue)-&gt;regExp()-&gt;multiline()));
</span><span class="lines">@@ -278,11 +301,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoGetterSticky(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
</span><span class="cx">         if (thisValue.inherits(RegExpPrototype::info()))
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;The RegExp.prototype.sticky getter can only be called on a RegExp object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.sticky getter can only be called on a RegExp object&quot;));
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     return JSValue::encode(jsBoolean(asRegExpObject(thisValue)-&gt;regExp()-&gt;sticky()));
</span><span class="lines">@@ -290,11 +316,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoGetterUnicode(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
</span><span class="cx">         if (thisValue.inherits(RegExpPrototype::info()))
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;The RegExp.prototype.unicode getter can only be called on a RegExp object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.unicode getter can only be called on a RegExp object&quot;));
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     return JSValue::encode(jsBoolean(asRegExpObject(thisValue)-&gt;regExp()-&gt;unicode()));
</span><span class="lines">@@ -302,9 +331,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoGetterFlags(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (UNLIKELY(!thisValue.isObject()))
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;The RegExp.prototype.flags getter can only be called on an object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.flags getter can only be called on an object&quot;));
</ins><span class="cx"> 
</span><span class="cx">     auto flags = flagsString(exec, asObject(thisValue));
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -421,11 +453,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoGetterSource(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (UNLIKELY(!thisValue.inherits(RegExpObject::info()))) {
</span><span class="cx">         if (thisValue.inherits(RegExpPrototype::info()))
</span><span class="cx">             return JSValue::encode(jsString(exec, ASCIILiteral(&quot;(?:)&quot;)));
</span><del>-        return throwVMTypeError(exec, ASCIILiteral(&quot;The RegExp.prototype.source getter can only be called on a RegExp object&quot;));
</del><ins>+        return throwVMTypeError(exec, scope, ASCIILiteral(&quot;The RegExp.prototype.source getter can only be called on a RegExp object&quot;));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     String pattern = asRegExpObject(thisValue)-&gt;regExp()-&gt;pattern();
</span><span class="lines">@@ -539,6 +574,7 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL regExpProtoFuncSplitFast(ExecState* exec)
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     // 1. [handled by JS builtin] Let rx be the this value.
</span><span class="cx">     // 2. [handled by JS builtin] If Type(rx) is not Object, throw a TypeError exception.
</span><span class="lines">@@ -644,7 +680,7 @@
</span><span class="cx">         });
</span><span class="cx">     
</span><span class="cx">     if (resultLength + dryRunCount &gt;= MAX_STORAGE_VECTOR_LENGTH) {
</span><del>-        throwOutOfMemoryError(exec);
</del><ins>+        throwOutOfMemoryError(exec, scope);
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     }
</span><span class="cx">     
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRejecth"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Reject.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Reject.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Reject.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -33,8 +33,10 @@
</span><span class="cx"> 
</span><span class="cx"> inline bool reject(ExecState* exec, bool throwException, const char* message)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (throwException)
</span><del>-        throwTypeError(exec, message);
</del><ins>+        throwTypeError(exec, scope, message);
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSetConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -51,11 +51,16 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callSet(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, &quot;Set&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, &quot;Set&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructSet(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSGlobalObject* globalObject = asInternalFunction(exec-&gt;callee())-&gt;globalObject();
</span><span class="cx">     Structure* setStructure = InternalFunction::createSubclassStructure(exec, exec-&gt;newTarget(), globalObject-&gt;setStructure());
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -72,7 +77,7 @@
</span><span class="cx">     CallData adderFunctionCallData;
</span><span class="cx">     CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
</span><span class="cx">     if (adderFunctionCallType == CallType::None)
</span><del>-        return JSValue::encode(throwTypeError(exec));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope));
</ins><span class="cx"> 
</span><span class="cx">     forEachInIterable(exec, iterable, [&amp;](VM&amp;, ExecState* exec, JSValue nextValue) {
</span><span class="cx">         MarkedArgumentBuffer arguments;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSetIteratorPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetIteratorPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -50,10 +50,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL SetIteratorPrototypeFuncNext(CallFrame* callFrame)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue result;
</span><span class="cx">     JSSetIterator* iterator = jsDynamicCast&lt;JSSetIterator*&gt;(callFrame-&gt;thisValue());
</span><span class="cx">     if (!iterator)
</span><del>-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral(&quot;Cannot call SetIterator.next() on a non-SetIterator object&quot;)));
</del><ins>+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot call SetIterator.next() on a non-SetIterator object&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     if (iterator-&gt;next(callFrame, result))
</span><span class="cx">         return JSValue::encode(createIteratorResultObject(callFrame, result, false));
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSetPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SetPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -84,13 +84,16 @@
</span><span class="cx"> 
</span><span class="cx"> ALWAYS_INLINE static JSSet* getSet(CallFrame* callFrame, JSValue thisValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!thisValue.isObject()) {
</span><del>-        throwVMError(callFrame, createNotAnObjectError(callFrame, thisValue));
</del><ins>+        throwVMError(callFrame, scope, createNotAnObjectError(callFrame, thisValue));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     JSSet* set = jsDynamicCast&lt;JSSet*&gt;(thisValue);
</span><span class="cx">     if (!set) {
</span><del>-        throwTypeError(callFrame, ASCIILiteral(&quot;Set operation called on non-Set object&quot;));
</del><ins>+        throwTypeError(callFrame, scope, ASCIILiteral(&quot;Set operation called on non-Set object&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     return set;
</span><span class="lines">@@ -141,18 +144,24 @@
</span><span class="cx">     
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL setProtoFuncValues(CallFrame* callFrame)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSSet* thisObj = jsDynamicCast&lt;JSSet*&gt;(callFrame-&gt;thisValue());
</span><span class="cx">     if (!thisObj)
</span><del>-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral(&quot;Cannot create a Set value iterator for a non-Set object.&quot;)));
-    return JSValue::encode(JSSetIterator::create(callFrame-&gt;vm(), callFrame-&gt;callee()-&gt;globalObject()-&gt;setIteratorStructure(), thisObj, IterateValue));
</del><ins>+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot create a Set value iterator for a non-Set object.&quot;)));
+    return JSValue::encode(JSSetIterator::create(vm, callFrame-&gt;callee()-&gt;globalObject()-&gt;setIteratorStructure(), thisObj, IterateValue));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL setProtoFuncEntries(CallFrame* callFrame)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSSet* thisObj = jsDynamicCast&lt;JSSet*&gt;(callFrame-&gt;thisValue());
</span><span class="cx">     if (!thisObj)
</span><del>-        return JSValue::encode(throwTypeError(callFrame, ASCIILiteral(&quot;Cannot create a Set entry iterator for a non-Set object.&quot;)));
-    return JSValue::encode(JSSetIterator::create(callFrame-&gt;vm(), callFrame-&gt;callee()-&gt;globalObject()-&gt;setIteratorStructure(), thisObj, IterateKeyValue));
</del><ins>+        return JSValue::encode(throwTypeError(callFrame, scope, ASCIILiteral(&quot;Cannot create a Set entry iterator for a non-Set object.&quot;)));
+    return JSValue::encode(JSSetIterator::create(vm, callFrame-&gt;callee()-&gt;globalObject()-&gt;setIteratorStructure(), thisObj, IterateKeyValue));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL privateFuncIsSet(ExecState* exec)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSparseArrayValueMapcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SparseArrayValueMap.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011, 2012, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011-2012, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -90,6 +90,8 @@
</span><span class="cx"> 
</span><span class="cx"> bool SparseArrayValueMap::putEntry(ExecState* exec, JSObject* array, unsigned i, JSValue value, bool shouldThrow)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     ASSERT(value);
</span><span class="cx">     
</span><span class="cx">     AddResult result = add(array, i);
</span><span class="lines">@@ -101,7 +103,7 @@
</span><span class="cx">     if (result.isNewEntry &amp;&amp; !array-&gt;isStructureExtensible()) {
</span><span class="cx">         remove(result.iterator);
</span><span class="cx">         if (shouldThrow)
</span><del>-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -148,14 +150,17 @@
</span><span class="cx"> 
</span><span class="cx"> bool SparseArrayEntry::put(ExecState* exec, JSValue thisValue, SparseArrayValueMap* map, JSValue value, bool shouldThrow)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!(attributes &amp; Accessor)) {
</span><span class="cx">         if (attributes &amp; ReadOnly) {
</span><span class="cx">             if (shouldThrow)
</span><del>-                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+                throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        set(exec-&gt;vm(), map, value);
</del><ins>+        set(vm, map, value);
</ins><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeStringConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2004-2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -90,6 +90,9 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL stringFromCodePoint(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     unsigned length = exec-&gt;argumentCount();
</span><span class="cx">     StringBuilder builder;
</span><span class="cx">     builder.reserveCapacity(length);
</span><span class="lines">@@ -102,7 +105,7 @@
</span><span class="cx">         uint32_t codePoint = static_cast&lt;uint32_t&gt;(codePointAsDouble);
</span><span class="cx"> 
</span><span class="cx">         if (codePoint != codePointAsDouble || codePoint &gt; UCHAR_MAX_VALUE)
</span><del>-            return throwVMError(exec, createRangeError(exec, ASCIILiteral(&quot;Arguments contain a value that is out of range of code points&quot;)));
</del><ins>+            return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;Arguments contain a value that is out of range of code points&quot;)));
</ins><span class="cx"> 
</span><span class="cx">         if (U_IS_BMP(codePoint))
</span><span class="cx">             builder.append(static_cast&lt;UChar&gt;(codePoint));
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeStringObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2004-2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -63,6 +63,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool StringObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     StringObject* thisObject = jsCast&lt;StringObject*&gt;(cell);
</span><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
</span><span class="lines">@@ -70,7 +73,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (propertyName == exec-&gt;propertyNames().length) {
</span><span class="cx">         if (slot.isStrictMode())
</span><del>-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     if (Optional&lt;uint32_t&gt; index = parseIndex(propertyName))
</span><span class="lines">@@ -80,10 +83,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool StringObject::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     StringObject* thisObject = jsCast&lt;StringObject*&gt;(cell);
</span><span class="cx">     if (thisObject-&gt;internalValue()-&gt;canGetIndex(propertyName)) {
</span><span class="cx">         if (shouldThrow)
</span><del>-            throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</del><ins>+            throwTypeError(exec, scope, StrictModeReadonlyPropertyWriteError);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     return JSObject::putByIndex(cell, exec, propertyName, value, shouldThrow);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeStringPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -289,6 +289,9 @@
</span><span class="cx"> 
</span><span class="cx"> static ALWAYS_INLINE JSValue jsSpliceSubstrings(ExecState* exec, JSString* sourceVal, const String&amp; source, const StringRange* substringRanges, int rangeCount)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (rangeCount == 1) {
</span><span class="cx">         int sourceSize = source.length();
</span><span class="cx">         int position = substringRanges[0].position;
</span><span class="lines">@@ -311,7 +314,7 @@
</span><span class="cx">         const LChar* sourceData = source.characters8();
</span><span class="cx">         auto impl = StringImpl::tryCreateUninitialized(totalLength, buffer);
</span><span class="cx">         if (!impl)
</span><del>-            return throwOutOfMemoryError(exec);
</del><ins>+            return throwOutOfMemoryError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">         int bufferPos = 0;
</span><span class="cx">         for (int i = 0; i &lt; rangeCount; i++) {
</span><span class="lines">@@ -329,7 +332,7 @@
</span><span class="cx"> 
</span><span class="cx">     auto impl = StringImpl::tryCreateUninitialized(totalLength, buffer);
</span><span class="cx">     if (!impl)
</span><del>-        return throwOutOfMemoryError(exec);
</del><ins>+        return throwOutOfMemoryError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     int bufferPos = 0;
</span><span class="cx">     for (int i = 0; i &lt; rangeCount; i++) {
</span><span class="lines">@@ -344,6 +347,9 @@
</span><span class="cx"> 
</span><span class="cx"> static ALWAYS_INLINE JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, JSString* sourceVal, const String&amp; source, const StringRange* substringRanges, int rangeCount, const String* separators, int separatorCount)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (rangeCount == 1 &amp;&amp; separatorCount == 0) {
</span><span class="cx">         int sourceSize = source.length();
</span><span class="cx">         int position = substringRanges[0].position;
</span><span class="lines">@@ -364,7 +370,7 @@
</span><span class="cx">             allSeparators8Bit = false;
</span><span class="cx">     }
</span><span class="cx">     if (totalLength.hasOverflowed())
</span><del>-        return throwOutOfMemoryError(exec);
</del><ins>+        return throwOutOfMemoryError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     if (!totalLength)
</span><span class="cx">         return jsEmptyString(exec);
</span><span class="lines">@@ -375,7 +381,7 @@
</span><span class="cx"> 
</span><span class="cx">         auto impl = StringImpl::tryCreateUninitialized(totalLength.unsafeGet(), buffer);
</span><span class="cx">         if (!impl)
</span><del>-            return throwOutOfMemoryError(exec);
</del><ins>+            return throwOutOfMemoryError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">         int maxCount = std::max(rangeCount, separatorCount);
</span><span class="cx">         int bufferPos = 0;
</span><span class="lines">@@ -400,7 +406,7 @@
</span><span class="cx">     UChar* buffer;
</span><span class="cx">     auto impl = StringImpl::tryCreateUninitialized(totalLength.unsafeGet(), buffer);
</span><span class="cx">     if (!impl)
</span><del>-        return throwOutOfMemoryError(exec);
</del><ins>+        return throwOutOfMemoryError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     int maxCount = std::max(rangeCount, separatorCount);
</span><span class="cx">     int bufferPos = 0;
</span><span class="lines">@@ -752,10 +758,13 @@
</span><span class="cx"> template &lt;typename CharacterType&gt;
</span><span class="cx"> static inline JSString* repeatCharacter(ExecState&amp; exec, CharacterType character, unsigned repeatCount)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     CharacterType* buffer = nullptr;
</span><span class="cx">     auto impl = StringImpl::tryCreateUninitialized(repeatCount, buffer);
</span><span class="cx">     if (!impl) {
</span><del>-        throwOutOfMemoryError(&amp;exec);
</del><ins>+        throwOutOfMemoryError(&amp;exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -797,8 +806,10 @@
</span><span class="cx"> ALWAYS_INLINE EncodedJSValue replace(
</span><span class="cx">     VM&amp; vm, ExecState* exec, JSValue thisValue, JSValue searchValue, JSValue replaceValue)
</span><span class="cx"> {
</span><ins>+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSString* string = thisValue.toString(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -841,6 +852,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     // Also used for valueOf.
</span><span class="cx"> 
</span><span class="lines">@@ -850,14 +864,17 @@
</span><span class="cx">     if (thisValue.inherits(StringObject::info()))
</span><span class="cx">         return JSValue::encode(asStringObject(thisValue)-&gt;internalValue());
</span><span class="cx"> 
</span><del>-    return throwVMTypeError(exec);
</del><ins>+    return throwVMTypeError(exec, scope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSString::SafeView string = thisValue.toString(exec)-&gt;view(exec);
</span><span class="cx">     JSValue a0 = exec-&gt;argument(0);
</span><span class="cx">     if (a0.isUInt32()) {
</span><span class="lines">@@ -874,9 +891,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSString::SafeView string = thisValue.toString(exec)-&gt;view(exec);
</span><span class="cx">     JSValue a0 = exec-&gt;argument(0);
</span><span class="cx">     if (a0.isUInt32()) {
</span><span class="lines">@@ -903,9 +923,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncCodePointAt(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     String string = thisValue.toWTFString(exec);
</span><span class="cx">     unsigned length = string.length();
</span><span class="lines">@@ -929,20 +952,26 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (thisValue.isString() &amp;&amp; exec-&gt;argumentCount() == 1)
</span><span class="cx">         return JSValue::encode(jsString(exec, asString(thisValue), exec-&gt;uncheckedArgument(0).toString(exec)));
</span><span class="cx"> 
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     return JSValue::encode(jsStringFromArguments(exec, thisValue));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     JSValue a0 = exec-&gt;argument(0);
</span><span class="cx">     JSValue a1 = exec-&gt;argument(1);
</span><span class="lines">@@ -977,9 +1006,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     JSValue a0 = exec-&gt;argument(0);
</span><span class="cx">     JSValue a1 = exec-&gt;argument(1);
</span><span class="lines">@@ -1014,9 +1046,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1201,9 +1236,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     unsigned len;
</span><span class="cx">     JSString* jsString = 0;
</span><span class="cx">     String uString;
</span><span class="lines">@@ -1257,9 +1295,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     JSString* jsString = thisValue.toString(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -1297,9 +1338,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSString* sVal = thisValue.toString(exec);
</span><span class="cx">     const String&amp; s = sVal-&gt;value(exec);
</span><span class="cx">     String lowercasedString = s.convertToLowercaseWithoutLocale();
</span><span class="lines">@@ -1310,9 +1354,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSString* sVal = thisValue.toString(exec);
</span><span class="cx">     const String&amp; s = sVal-&gt;value(exec);
</span><span class="cx">     String uppercasedString = s.convertToUppercaseWithoutLocale();
</span><span class="lines">@@ -1323,9 +1370,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1340,10 +1390,13 @@
</span><span class="cx"> #if ENABLE(INTL)
</span><span class="cx"> static EncodedJSValue toLocaleCase(ExecState* state, int32_t (*convertCase)(UChar*, int32_t, const UChar*, int32_t, const char*, UErrorCode*))
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // 1. Let O be RequireObjectCoercible(this value).
</span><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, scope);
</ins><span class="cx"> 
</span><span class="cx">     // 2. Let S be ToString(O).
</span><span class="cx">     JSString* sVal = thisValue.toString(state);
</span><span class="lines">@@ -1411,10 +1464,10 @@
</span><span class="cx">         Vector&lt;UChar&gt; buffer(resultLength);
</span><span class="cx">         convertCase(buffer.data(), resultLength, view.upconvertedCharacters(), viewLength, utf8LocaleBuffer.data(), &amp;error);
</span><span class="cx">         if (U_FAILURE(error))
</span><del>-            return throwVMTypeError(state, u_errorName(error));
</del><ins>+            return throwVMTypeError(state, scope, u_errorName(error));
</ins><span class="cx">         lower = String(buffer.data(), resultLength);
</span><span class="cx">     } else
</span><del>-        return throwVMTypeError(state, u_errorName(error));
</del><ins>+        return throwVMTypeError(state, scope, u_errorName(error));
</ins><span class="cx"> 
</span><span class="cx">     // 18. Return L.
</span><span class="cx">     return JSValue::encode(jsString(state, lower));
</span><span class="lines">@@ -1438,9 +1491,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1449,9 +1505,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1460,9 +1519,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1471,9 +1533,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1482,9 +1547,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1493,9 +1561,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1504,9 +1575,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1515,9 +1589,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1526,9 +1603,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1537,9 +1617,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1553,9 +1636,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1605,9 +1691,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1621,9 +1710,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     String s = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1667,8 +1759,11 @@
</span><span class="cx"> 
</span><span class="cx"> static inline JSValue trimString(ExecState* exec, JSValue thisValue, int trimKind)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwTypeError(exec);
</del><ins>+        return throwTypeError(exec, scope);
</ins><span class="cx">     String str = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return jsUndefined();
</span><span class="lines">@@ -1720,9 +1815,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncStartsWith(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     String stringToSearchIn = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -1729,12 +1827,11 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><span class="cx">     JSValue a0 = exec-&gt;argument(0);
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     bool isRegularExpression = isRegExp(vm, exec, a0);
</span><span class="cx">     if (vm.exception())
</span><span class="cx">         return JSValue::encode(JSValue());
</span><span class="cx">     if (isRegularExpression)
</span><del>-        return throwVMTypeError(exec, &quot;Argument to String.prototype.startsWith cannot be a RegExp&quot;);
</del><ins>+        return throwVMTypeError(exec, scope, &quot;Argument to String.prototype.startsWith cannot be a RegExp&quot;);
</ins><span class="cx"> 
</span><span class="cx">     String searchString = a0.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -1756,9 +1853,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncEndsWith(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     String stringToSearchIn = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -1765,12 +1865,11 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><span class="cx">     JSValue a0 = exec-&gt;argument(0);
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     bool isRegularExpression = isRegExp(vm, exec, a0);
</span><span class="cx">     if (vm.exception())
</span><span class="cx">         return JSValue::encode(JSValue());
</span><span class="cx">     if (isRegularExpression)
</span><del>-        return throwVMTypeError(exec, &quot;Argument to String.prototype.endsWith cannot be a RegExp&quot;);
</del><ins>+        return throwVMTypeError(exec, scope, &quot;Argument to String.prototype.endsWith cannot be a RegExp&quot;);
</ins><span class="cx"> 
</span><span class="cx">     String searchString = a0.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -1808,9 +1907,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncIncludes(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     String stringToSearchIn = thisValue.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -1817,12 +1919,11 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><span class="cx">     JSValue a0 = exec-&gt;argument(0);
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     bool isRegularExpression = isRegExp(vm, exec, a0);
</span><span class="cx">     if (vm.exception())
</span><span class="cx">         return JSValue::encode(JSValue());
</span><span class="cx">     if (isRegularExpression)
</span><del>-        return throwVMTypeError(exec, &quot;Argument to String.prototype.includes cannot be a RegExp&quot;);
</del><ins>+        return throwVMTypeError(exec, scope, &quot;Argument to String.prototype.includes cannot be a RegExp&quot;);
</ins><span class="cx"> 
</span><span class="cx">     String searchString = a0.toString(exec)-&gt;value(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -1855,9 +1956,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncIterator(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSString* string = thisValue.toString(exec);
</span><span class="cx">     return JSValue::encode(JSStringIterator::create(exec, exec-&gt;callee()-&gt;globalObject()-&gt;stringIteratorStructure(), string));
</span><span class="cx"> }
</span><span class="lines">@@ -1864,6 +1968,9 @@
</span><span class="cx"> 
</span><span class="cx"> static JSValue normalize(ExecState* exec, const UChar* source, size_t sourceLength, UNormalizationMode form)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     UErrorCode status = U_ZERO_ERROR;
</span><span class="cx">     int32_t normalizedStringLength = unorm_normalize(source, sourceLength, form, 0, nullptr, 0, &amp;status);
</span><span class="cx"> 
</span><span class="lines">@@ -1870,18 +1977,18 @@
</span><span class="cx">     if (U_FAILURE(status) &amp;&amp; status != U_BUFFER_OVERFLOW_ERROR) {
</span><span class="cx">         // The behavior is not specified when normalize fails.
</span><span class="cx">         // Now we throw a type erorr since it seems that the contents of the string are invalid.
</span><del>-        return throwTypeError(exec);
</del><ins>+        return throwTypeError(exec, scope);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     UChar* buffer = nullptr;
</span><span class="cx">     auto impl = StringImpl::tryCreateUninitialized(normalizedStringLength, buffer);
</span><span class="cx">     if (!impl)
</span><del>-        return throwOutOfMemoryError(exec);
</del><ins>+        return throwOutOfMemoryError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     status = U_ZERO_ERROR;
</span><span class="cx">     unorm_normalize(source, sourceLength, form, 0, buffer, normalizedStringLength, &amp;status);
</span><span class="cx">     if (U_FAILURE(status))
</span><del>-        return throwTypeError(exec);
</del><ins>+        return throwTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     return jsString(exec, WTFMove(impl));
</span><span class="cx"> }
</span><span class="lines">@@ -1888,9 +1995,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL stringProtoFuncNormalize(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!checkObjectCoercible(thisValue))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSString::SafeView source = thisValue.toString(exec)-&gt;view(exec);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1911,7 +2021,7 @@
</span><span class="cx">         else if (formString == &quot;NFKD&quot;)
</span><span class="cx">             form = UNORM_NFKD;
</span><span class="cx">         else
</span><del>-            return throwVMError(exec, createRangeError(exec, ASCIILiteral(&quot;argument does not match any normalization form&quot;)));
</del><ins>+            return throwVMError(exec, scope, createRangeError(exec, ASCIILiteral(&quot;argument does not match any normalization form&quot;)));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return JSValue::encode(normalize(exec, source.get().upconvertedCharacters(), source.length(), form));
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeStringRecursionCheckercpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/StringRecursionChecker.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- *  Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2011-2012, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -28,7 +28,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue StringRecursionChecker::throwStackOverflowError()
</span><span class="cx"> {
</span><del>-    return JSC::throwStackOverflowError(m_exec);
</del><ins>+    VM&amp; vm = m_exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSC::throwStackOverflowError(m_exec, scope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSValue StringRecursionChecker::emptyString()
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSymbolcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Symbol.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Symbol.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Symbol.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  * Copyright (C) 2015-2016 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -87,7 +87,9 @@
</span><span class="cx"> 
</span><span class="cx"> double Symbol::toNumber(ExecState* exec) const
</span><span class="cx"> {
</span><del>-    throwTypeError(exec, ASCIILiteral(&quot;Cannot convert a symbol to a number&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    throwTypeError(exec, scope, ASCIILiteral(&quot;Cannot convert a symbol to a number&quot;));
</ins><span class="cx">     return 0.0;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSymbolConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SymbolConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SymbolConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SymbolConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  * Copyright (C) 2015 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -110,16 +110,19 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL symbolConstructorKeyFor(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue symbolValue = exec-&gt;argument(0);
</span><span class="cx">     if (!symbolValue.isSymbol())
</span><del>-        return JSValue::encode(throwTypeError(exec, SymbolKeyForTypeError));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope, SymbolKeyForTypeError));
</ins><span class="cx"> 
</span><span class="cx">     SymbolImpl* uid = asSymbol(symbolValue)-&gt;privateName().uid();
</span><span class="cx">     if (!uid-&gt;symbolRegistry())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx"> 
</span><del>-    ASSERT(uid-&gt;symbolRegistry() == &amp;exec-&gt;vm().symbolRegistry());
-    return JSValue::encode(jsString(exec, exec-&gt;vm().symbolRegistry().keyForSymbol(*uid)));
</del><ins>+    ASSERT(uid-&gt;symbolRegistry() == &amp;vm.symbolRegistry());
+    return JSValue::encode(jsString(exec, vm.symbolRegistry().keyForSymbol(*uid)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeSymbolPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SymbolPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SymbolPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/SymbolPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2012 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2012, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  * Copyright (C) 2015 Yusuke Suzuki &lt;utatane.tea@gmail.com&gt;.
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -72,6 +72,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL symbolProtoFuncToString(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     Symbol* symbol = nullptr;
</span><span class="cx">     if (thisValue.isSymbol())
</span><span class="lines">@@ -78,10 +81,10 @@
</span><span class="cx">         symbol = asSymbol(thisValue);
</span><span class="cx">     else {
</span><span class="cx">         if (!thisValue.isObject())
</span><del>-            return throwVMTypeError(exec, SymbolToStringTypeError);
</del><ins>+            return throwVMTypeError(exec, scope, SymbolToStringTypeError);
</ins><span class="cx">         JSObject* thisObject = asObject(thisValue);
</span><span class="cx">         if (!thisObject-&gt;inherits(SymbolObject::info()))
</span><del>-            return throwVMTypeError(exec, SymbolToStringTypeError);
</del><ins>+            return throwVMTypeError(exec, scope, SymbolToStringTypeError);
</ins><span class="cx">         symbol = asSymbol(jsCast&lt;SymbolObject*&gt;(thisObject)-&gt;internalValue());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -90,16 +93,19 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL symbolProtoFuncValueOf(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (thisValue.isSymbol())
</span><span class="cx">         return JSValue::encode(thisValue);
</span><span class="cx"> 
</span><span class="cx">     if (!thisValue.isObject())
</span><del>-        return throwVMTypeError(exec, SymbolValueOfTypeError);
</del><ins>+        return throwVMTypeError(exec, scope, SymbolValueOfTypeError);
</ins><span class="cx"> 
</span><span class="cx">     JSObject* thisObject = asObject(thisValue);
</span><span class="cx">     if (!thisObject-&gt;inherits(SymbolObject::info()))
</span><del>-        return throwVMTypeError(exec, SymbolValueOfTypeError);
</del><ins>+        return throwVMTypeError(exec, scope, SymbolValueOfTypeError);
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsCast&lt;SymbolObject*&gt;(thisObject)-&gt;internalValue());
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeThrowScopecpp"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScope.cpp (0 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScope.cpp                                (rev 0)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScope.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -0,0 +1,395 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;ThrowScope.h&quot;
+
+#include &quot;JSCJSValueInlines.h&quot;
+#include &quot;VM.h&quot;
+
+namespace JSC {
+    
+#if ENABLE(THROW_SCOPE_VERIFICATION)
+
+namespace {
+
+// Logs all ThrowScope activity to help debug the source of a verification failure.
+bool traceOn = false;
+
+// A more verbose logging option to dump the C++ stack trace at strategic points to aid debugging.
+bool traceWithStackTraces = false;
+
+// Disabled temporarily until all known verification failures are fixed.
+bool verificationOn = false;
+
+unsigned traceCount = 0;
+};
+
+/*
+    ThrowScope verification works to simulate exception throws and catch cases where
+    exception checks are missing. This is how it works:
+
+ 1. The VM has a m_needExceptionCheck bit that indicates where an exception check is
+    needed. You can think of the m_needExceptionCheck bit being set as a simulated
+    throw.
+
+ 2. Every throw site must declare a ThrowScope instance using DECLARE_THROW_SCOPE at
+    the top of its function (as early as possible) e.g.

+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+            throwException(exec, scope, ...);
+        }
+
+    Note: VM::throwException() methods are private, and only calleableby the ThrowScope
+    friend class. All throws must go through a ThrowScope. Hence, we are guaranteed that
+    any function that can throw will have a ThrowScope.
+
+    Note: by convention, every throw helper function must take a ThrowScope argument
+    instead of instantiating its own ThrowScope.  This allows the throw to be attributed
+    to the client code rather than the throw helper itself.
+
+ 3. Verification of needed exception checks
+
+    a. On construction, each ThrowScope will verify that VM::m_needExceptionCheck is
+       not set.

+       This ensures that the caller of the current function has checked for exceptions
+       where needed before doing more work which led to calling the current function.
+
+    b. On destruction, each ThrowScope will verify that VM::m_needExceptionCheck is
+       not set. This verification will be skipped if the ThrowScope has been released
+       (see (5) below).
+
+       This ensures that the function that owns this ThrowScope is not missing any
+       exception checks before returning.

+    c. When throwing an exception, the ThrowScope will verify that VM::m_needExceptionCheck
+       is not set, unless it's been ask to rethrow the same Exception object.
+
+ 4. Simulated throws
+
+    Throws are simulated by setting the m_needExceptionCheck bit.
+
+    The bit will only be set in the ThrowScope destructor except when the ThrowScope
+    detects the caller is a LLInt or JIT function. LLInt or JIT functions will always
+    check for exceptions after a host C++ function returns to it. However, they will
+    not clear the m_needExceptionCheck bit.
+
+    Hence, if the ThrowScope destructor detects the caller is a LLInt or JIT function,
+    it will just skip the setting of the bit.
+
+    Note: there is no need, and it is incorrect to set the m_needExceptionCheck bit
+    in the throwException methods. This is because, in practice, we always return
+    immediately after throwing an exception. It doesn't make sense to set the bit in
+    the throw just to have to clear it immediately after before we do verification in
+    the ThrowScope destructor.
+
+ 5. Using ThrowScope::release()
+
+    ThrowScope::release() should only be used at the bottom of a function if:

+    a. This function is going to let its caller check and handle the exception.

+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+            auto result = goo(); // may throw.
+
+            ... // Cleanup code that will are not affected by a pending exceptions.
+
+            scope.release(); // tell the ThrowScope that the caller will handle the exception.
+            return result;
+        }

+    b. This function is going to do a tail call that may throw.
+
+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+            ...
+            scope.release(); // tell the ThrowScope that the caller will handle the exception.
+            return goo(); // may throw.
+        }

+    ThrowScope::release() should not be used in the code paths that branch. For example:

+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+
+            auto result = goo1(); // may throw.
+            scope.release(); // &lt;=================== the WRONG way !!!
+            if (result)
+                return;

+            result = goo2(); // may throw.
+            ...
+            return result;
+        }

+    The above will result in a verification failure in goo2()'s ThrowScope.  The proper way
+    to fix this verification is to do wither (6) or (7) below.

+  6. Checking exceptions with ThrowScope::exception()

+     ThrowScope::exception() returns the thrown Exception object if there is one pending.
+     Else it returns nullptr.

+     It also clears the m_needExceptionCheck bit thereby indicating that we've satisifed
+     the needed exception check.

+     This is how we do it:

+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+
+            auto result = goo1(); // may throw.
+            if (scope.exception())
+                return;
+
+            result = goo2(); // may throw.
+            ...
+            return result;
+        }

+    But sometimes, for optimization reasons, we may choose to test the result of the callee
+    function instead doing a load of the VM exception value. See (7) below.

+ 7. Checking exception by checking callee result

+    This approach should only be applied when it makes a difference to performance.
+    If we need to do this, we should add an ASSERT() that invokes ThrowScope::exception()
+    and verify the result. Since ThrowScope verification is only done on DEBUG builds,
+    this ASSERT will satisfy the verification requirements while not impacting performance.

+    This is how we do it:
+
+        void foo(...)
+        {
+            auto scope = DECLARE_THROW_SCOPE(vm);
+
+            bool failed = goo1(); // may throw.
+            ASSERT(!!scope.exception() == failed)
+            if (failed)
+                return;
+
+            result = goo2(); // may throw.
+            ...
+            return result;
+        }

+ 8. Debugging verification failures.
+
+    a. When verification fails, you will see a helpful message followed by an assertion failure.
+       For example:

+    FAILED exception check verification:
+        Exception thrown from ThrowScope [2] Exit: setUpCall @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1245
+        is unchecked in ThrowScope [1]: varargsSetup @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1398
+
+       The message tells you that failure was detected at in varargsSetup() @ LLIntSlowPaths.cpp
+       line 1398, and that the missing exception check should have happened somewhere between
+       the call to setUpCall() @ LLIntSlowPaths.cpp line 1245 and it.
+
+       If that is insufficient information, you can ...
+
+    b. Turn on ThrowScope tracing

+       Just set traceOn=true at the top of ThrowScope.cpp, and rebuild. Thereafter, you should
+       see a trace of ThrowScopes being entered and exited as well as their depth e.g.
+
+    ThrowScope [1] Enter: llint_slow_path_jfalse @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1032
+    ThrowScope [1] Exit: llint_slow_path_jfalse @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1032
+
+       You will also see traces of simulated throws e.g.
+
+    ThrowScope [2] Throw from: setUpCall @ /Volumes/Data/ws6/OpenSource/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp:1245
+
+       If that is insufficient information, you can ...
+
+    c. Turn on ThrowScope stack dumps
+
+       Just set traceWithStackTraces=true at the top of ThrowScope.cpp, and rebuild.
+       Thereafter, you should see a stack traces at various relevant ThrowScope events.
+
+    d. Using throwScopePrintIfNeedCheck()
+
+       If you have isolated the missing exception check to a function that is large but
+       is unsure which statement can throw and is missing the check, you can sprinkle
+       the function with calls to throwScopePrintIfNeedCheck().
+
+       throwScopePrintIfNeedCheck() will log a line &quot;Need exception check at ...&quot; that
+       inlcudes the file and line number only when it see the m_needExceptionCheck set.
+       This will tell you which statement simulated the throw that is not being checked
+       i.e. the one that preceded the throwScopePrintIfNeedCheck() that printed a line.
+*/
+
+ThrowScope::ThrowScope(VM&amp; vm, ThrowScopeLocation location)
+    : m_vm(vm)
+    , m_previousScope(vm.m_topThrowScope)
+    , m_location(location)
+    , m_depth(m_previousScope ? m_previousScope-&gt;m_depth + 1 : 0)
+{
+    m_vm.m_topThrowScope = this;
+
+    if (traceOn) {
+        dataLog(&quot;&lt;&quot;, traceCount++, &quot;&gt; ThrowScope [&quot;, m_depth, &quot;] Enter: &quot;, location.functionName, &quot; @ &quot;, location.file, &quot;:&quot;, location.line);
+        if (m_vm.m_needExceptionCheck)
+            dataLog(&quot;, needs check&quot;);
+        dataLog(&quot;\n&quot;);
+
+        if (traceWithStackTraces)
+            WTFReportBacktrace();
+    }
+
+    verifyExceptionCheckNeedIsSatisfied(Site::ScopeEntry);
+}
+
+ThrowScope::~ThrowScope()
+{
+    RELEASE_ASSERT(m_vm.m_topThrowScope);
+
+    if (!m_isReleased)
+        verifyExceptionCheckNeedIsSatisfied(Site::ScopeExit);
+    else {
+        // If we released the scope, that means we're letting our callers do the
+        // exception check. However, because our caller may be a LLInt or JIT
+        // function (which always checks for exceptions but won't clear the
+        // m_needExceptionCheck bit), we should clear m_needExceptionCheck here
+        // and let code below decide if we need to simulate a re-throw.
+        m_vm.m_needExceptionCheck = false;
+    }
+
+    bool willBeHandleByLLIntOrJIT = false;
+    void* previousScope = m_previousScope;
+    void* topCallFrame = m_vm.topCallFrame;
+    
+    // If the topCallFrame was pushed on the stack after the previousScope was instantiated,
+    // then this throwScope will be returning to LLINT or JIT code that always do an exception
+    // check. In that case, skip the simulated throw because the LLInt and JIT will be
+    // checking for the exception their own way instead of calling ThrowScope::exception().
+    if (topCallFrame &amp;&amp; previousScope &gt; topCallFrame)
+        willBeHandleByLLIntOrJIT = true;
+    
+    if (!willBeHandleByLLIntOrJIT)
+        simulateThrow();
+
+    if (traceOn) {
+        dataLog(&quot;&lt;&quot;, traceCount++, &quot;&gt; ThrowScope [&quot;, m_depth, &quot;] Exit: &quot;, m_location.functionName, &quot; @ &quot;, m_location.file, &quot;:&quot;, m_location.line);
+        if (!willBeHandleByLLIntOrJIT)
+            dataLog(&quot;, with rethrow&quot;);
+        if (m_vm.m_needExceptionCheck)
+            dataLog(&quot;, needs check&quot;);
+        dataLog(&quot;\n&quot;);
+
+        if (traceWithStackTraces)
+            WTFReportBacktrace();
+    }
+
+    m_vm.m_topThrowScope = m_previousScope;
+}
+
+void ThrowScope::throwException(ExecState* exec, Exception* exception)
+{
+    if (m_vm.exception() &amp;&amp; m_vm.exception() != exception)
+        verifyExceptionCheckNeedIsSatisfied(Site::Throw);
+    
+    m_vm.throwException(exec, exception);
+}
+
+JSValue ThrowScope::throwException(ExecState* exec, JSValue error)
+{
+    if (!error.isCell() || !jsDynamicCast&lt;Exception*&gt;(error.asCell()))
+        verifyExceptionCheckNeedIsSatisfied(Site::Throw);
+    
+    return m_vm.throwException(exec, error);
+}
+
+JSObject* ThrowScope::throwException(ExecState* exec, JSObject* obj)
+{
+    if (!jsDynamicCast&lt;Exception*&gt;(obj))
+        verifyExceptionCheckNeedIsSatisfied(Site::Throw);
+    
+    return m_vm.throwException(exec, obj);
+}
+
+void ThrowScope::printIfNeedCheck(const char* functionName, const char* file, unsigned line)
+{
+    if (m_vm.m_needExceptionCheck)
+        dataLog(&quot;&lt;&quot;, traceCount++, &quot;&gt; Need exception check at &quot;, functionName, &quot; @ &quot;, file, &quot;:&quot;, line, &quot;\n&quot;);
+}
+
+void ThrowScope::simulateThrow()
+{
+    RELEASE_ASSERT(m_vm.m_topThrowScope);
+    m_vm.m_simulatedThrowPointLocation = m_location;
+    m_vm.m_simulatedThrowPointDepth = m_depth;
+    m_vm.m_needExceptionCheck = true;
+
+    if (traceOn) {
+        dataLog(&quot;&lt;&quot;, traceCount++, &quot;&gt; ThrowScope [&quot;, m_depth, &quot;] Throw from: &quot;, m_location.functionName, &quot; @ &quot;, m_location.file, &quot;:&quot;, m_location.line, &quot;\n&quot;);
+        if (traceWithStackTraces)
+            WTFReportBacktrace();
+    }
+}
+
+void ThrowScope::verifyExceptionCheckNeedIsSatisfied(ThrowScope::Site site)
+{
+    if (!verificationOn)
+        return;
+
+    if (UNLIKELY(m_vm.m_needExceptionCheck)) {
+        auto failDepth = m_vm.m_simulatedThrowPointDepth;
+        auto&amp; failLocation = m_vm.m_simulatedThrowPointLocation;
+
+        auto siteName = [] (Site site) -&gt; const char* {
+            switch (site) {
+            case Site::ScopeEntry:
+                return &quot;Entry&quot;;
+            case Site::ScopeExit:
+                return &quot;Exit&quot;;
+            case Site::Throw:
+                return &quot;Throw&quot;;
+            }
+            RELEASE_ASSERT_NOT_REACHED();
+            return nullptr;
+        };
+
+        dataLog(
+            &quot;FAILED exception check verification:\n&quot;
+            &quot;    Exception thrown from ThrowScope [&quot;, failDepth, &quot;] &quot;, siteName(site), &quot;: &quot;, failLocation.functionName, &quot; @ &quot;, failLocation.file, &quot;:&quot;, failLocation.line, &quot;\n&quot;
+            &quot;    is unchecked in ThrowScope [&quot;, m_depth, &quot;]: &quot;, m_location.functionName, &quot; @ &quot;, m_location.file, &quot;:&quot;, m_location.line, &quot;\n&quot;
+            &quot;\n&quot;);
+
+        RELEASE_ASSERT(!m_vm.m_needExceptionCheck);
+    }
+}
+
+#endif // ENABLE(THROW_SCOPE_VERIFICATION)
+    
+} // namespace JSC
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeThrowScopeh"></a>
<div class="addfile"><h4>Added: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScope.h (0 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScope.h                                (rev 0)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScope.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -0,0 +1,129 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThrowScope_h
+#define ThrowScope_h
+
+#include &quot;Exception.h&quot;
+#include &quot;VM.h&quot;
+
+namespace JSC {
+
+class ExecState;
+class JSObject;
+
+#if ENABLE(THROW_SCOPE_VERIFICATION)
+
+class ThrowScope {
+public:
+    JS_EXPORT_PRIVATE ThrowScope(VM&amp;, ThrowScopeLocation);
+    JS_EXPORT_PRIVATE ~ThrowScope();
+
+    ThrowScope(const ThrowScope&amp;) = delete;
+    ThrowScope(ThrowScope&amp;&amp;) = default;
+
+    VM&amp; vm() const { return m_vm; }
+
+    JS_EXPORT_PRIVATE void throwException(ExecState*, Exception*);
+    JS_EXPORT_PRIVATE JSValue throwException(ExecState*, JSValue);
+    JS_EXPORT_PRIVATE JSObject* throwException(ExecState*, JSObject*);
+
+    inline Exception* exception()
+    {
+        m_vm.m_needExceptionCheck = false;
+        return m_vm.exception();
+    }
+
+    inline void release() { m_isReleased = true; }
+
+    JS_EXPORT_PRIVATE void printIfNeedCheck(const char* functionName, const char* file, unsigned line);
+
+private:
+    void simulateThrow();
+
+    enum class Site {
+        ScopeEntry,
+        ScopeExit,
+        Throw
+    };
+    void verifyExceptionCheckNeedIsSatisfied(Site);
+
+    VM&amp; m_vm;
+    ThrowScope* m_previousScope;
+    ThrowScopeLocation m_location;
+    unsigned m_depth;
+    bool m_isReleased { false };
+};
+
+#define DECLARE_THROW_SCOPE(vm__) \
+    JSC::ThrowScope((vm__), JSC::ThrowScopeLocation(__FUNCTION__, __FILE__, __LINE__))
+
+#define throwScopePrintIfNeedCheck(scope__) \
+    scope__.printIfNeedCheck(__FUNCTION__, __FILE__, __LINE__)
+
+#else // not ENABLE(THROW_SCOPE_VERIFICATION)
+
+class ThrowScope {
+public:
+    ThrowScope(VM&amp; vm)
+        : m_vm(vm)
+    { }
+
+    VM&amp; vm() const { return m_vm; }
+    
+    void throwException(ExecState* exec, Exception* exception) { m_vm.throwException(exec, exception); }
+    JSValue throwException(ExecState* exec, JSValue value) { return m_vm.throwException(exec, value); }
+    JSObject* throwException(ExecState* exec, JSObject* obj) { return m_vm.throwException(exec, obj); }
+    
+    Exception* exception() { return m_vm.exception(); }
+    void release() { }
+    
+private:
+    VM&amp; m_vm;
+};
+
+#define DECLARE_THROW_SCOPE(vm__) \
+    JSC::ThrowScope((vm__))
+
+#endif // ENABLE(THROW_SCOPE_VERIFICATION)
+
+ALWAYS_INLINE void throwException(ExecState* exec, ThrowScope&amp; scope, Exception* exception)
+{
+    scope.throwException(exec, exception);
+}
+
+ALWAYS_INLINE JSValue throwException(ExecState* exec, ThrowScope&amp; scope, JSValue value)
+{
+    return scope.throwException(exec, value);
+}
+
+ALWAYS_INLINE JSObject* throwException(ExecState* exec, ThrowScope&amp; scope, JSObject* obj)
+{
+    return scope.throwException(exec, obj);
+}
+
+} // namespace JSC
+
+#endif // ThrowScope_h
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeThrowScopeLocationhfromrev205591releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeRejecth"></a>
<div class="copfile"><h4>Copied: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScopeLocation.h (from rev 205591, releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/Reject.h) (0 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScopeLocation.h                                (rev 0)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/ThrowScopeLocation.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -0,0 +1,43 @@
</span><ins>+/*
+ * Copyright (C) 2016 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+namespace JSC {
+
+struct ThrowScopeLocation {
+    ThrowScopeLocation() { }
+    ThrowScopeLocation(const char* functionName, const char* file, unsigned line)
+        : functionName(functionName)
+        , file(file)
+        , line(line)
+    { }
+    
+    const char* functionName { nullptr };
+    const char* file { nullptr };
+    unsigned line { 0 };
+};
+
+} // namespace JSC
</ins></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/VM.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/VM.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/VM.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -48,6 +48,7 @@
</span><span class="cx"> #include &quot;SmallStrings.h&quot;
</span><span class="cx"> #include &quot;SourceCode.h&quot;
</span><span class="cx"> #include &quot;Strong.h&quot;
</span><ins>+#include &quot;ThrowScopeLocation.h&quot;
</ins><span class="cx"> #include &quot;ThunkGenerators.h&quot;
</span><span class="cx"> #include &quot;TypedArrayController.h&quot;
</span><span class="cx"> #include &quot;VMEntryRecord.h&quot;
</span><span class="lines">@@ -108,6 +109,7 @@
</span><span class="cx"> class RegExp;
</span><span class="cx"> #endif
</span><span class="cx"> class Symbol;
</span><ins>+class ThrowScope;
</ins><span class="cx"> class UnlinkedCodeBlock;
</span><span class="cx"> class UnlinkedEvalCodeBlock;
</span><span class="cx"> class UnlinkedFunctionExecutable;
</span><span class="lines">@@ -449,10 +451,6 @@
</span><span class="cx">     Exception* lastException() const { return m_lastException; }
</span><span class="cx">     JSCell** addressOfLastException() { return reinterpret_cast&lt;JSCell**&gt;(&amp;m_lastException); }
</span><span class="cx"> 
</span><del>-    JS_EXPORT_PRIVATE void throwException(ExecState*, Exception*);
-    JS_EXPORT_PRIVATE JSValue throwException(ExecState*, JSValue);
-    JS_EXPORT_PRIVATE JSObject* throwException(ExecState*, JSObject*);
-
</del><span class="cx">     void setFailNextNewCodeBlock() { m_failNextNewCodeBlock = true; }
</span><span class="cx">     bool getAndClearFailNextNewCodeBlock()
</span><span class="cx">     {
</span><span class="lines">@@ -644,6 +642,10 @@
</span><span class="cx">         m_lastException = exception;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    JS_EXPORT_PRIVATE void throwException(ExecState*, Exception*);
+    JS_EXPORT_PRIVATE JSValue throwException(ExecState*, JSValue);
+    JS_EXPORT_PRIVATE JSObject* throwException(ExecState*, JSObject*);
+
</ins><span class="cx"> #if ENABLE(ASSEMBLER)
</span><span class="cx">     bool m_canUseAssembler;
</span><span class="cx"> #endif
</span><span class="lines">@@ -668,6 +670,13 @@
</span><span class="cx"> 
</span><span class="cx">     Exception* m_exception { nullptr };
</span><span class="cx">     Exception* m_lastException { nullptr };
</span><ins>+#if ENABLE(THROW_SCOPE_VERIFICATION)
+    ThrowScope* m_topThrowScope { nullptr };
+    ThrowScopeLocation m_simulatedThrowPointLocation;
+    unsigned m_simulatedThrowPointDepth { 0 };
+    mutable bool m_needExceptionCheck { false };
+#endif
+
</ins><span class="cx">     bool m_failNextNewCodeBlock { false };
</span><span class="cx">     DeletePropertyMode m_deletePropertyMode { DeletePropertyMode::Default };
</span><span class="cx">     bool m_globalConstRedeclarationShouldThrow { true };
</span><span class="lines">@@ -690,6 +699,8 @@
</span><span class="cx"> #endif
</span><span class="cx">     std::unique_ptr&lt;ShadowChicken&gt; m_shadowChicken;
</span><span class="cx">     std::unique_ptr&lt;BytecodeIntrinsicRegistry&gt; m_bytecodeIntrinsicRegistry;
</span><ins>+
+    friend class ThrowScope;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> #if ENABLE(GC_VALIDATION)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeVMEntryScopeh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/VMEntryScope.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/VMEntryScope.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/VMEntryScope.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -41,6 +41,7 @@
</span><span class="cx">     JS_EXPORT_PRIVATE VMEntryScope(VM&amp;, JSGlobalObject*);
</span><span class="cx">     JS_EXPORT_PRIVATE ~VMEntryScope();
</span><span class="cx"> 
</span><ins>+    VM&amp; vm() const { return m_vm; }
</ins><span class="cx">     JSGlobalObject* globalObject() const { return m_globalObject; }
</span><span class="cx"> 
</span><span class="cx">     void addDidPopListener(std::function&lt;void ()&gt;);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeWeakMapConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -48,11 +48,16 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callWeakMap(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, &quot;WeakMap&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, &quot;WeakMap&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructWeakMap(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSGlobalObject* globalObject = asInternalFunction(exec-&gt;callee())-&gt;globalObject();
</span><span class="cx">     Structure* weakMapStructure = InternalFunction::createSubclassStructure(exec, exec-&gt;newTarget(), globalObject-&gt;weakMapStructure());
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -69,11 +74,11 @@
</span><span class="cx">     CallData adderFunctionCallData;
</span><span class="cx">     CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
</span><span class="cx">     if (adderFunctionCallType == CallType::None)
</span><del>-        return JSValue::encode(throwTypeError(exec));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope));
</ins><span class="cx"> 
</span><span class="cx">     forEachInIterable(exec, iterable, [&amp;](VM&amp; vm, ExecState* exec, JSValue nextItem) {
</span><span class="cx">         if (!nextItem.isObject()) {
</span><del>-            throwTypeError(exec);
</del><ins>+            throwTypeError(exec, scope);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeWeakMapPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple, Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple, Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -56,8 +56,11 @@
</span><span class="cx"> 
</span><span class="cx"> static WeakMapData* getWeakMapData(CallFrame* callFrame, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwTypeError(callFrame, WTF::ASCIILiteral(&quot;Called WeakMap function on non-object&quot;));
</del><ins>+        throwTypeError(callFrame, scope, WTF::ASCIILiteral(&quot;Called WeakMap function on non-object&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -64,7 +67,7 @@
</span><span class="cx">     if (JSWeakMap* weakMap = jsDynamicCast&lt;JSWeakMap*&gt;(value))
</span><span class="cx">         return weakMap-&gt;weakMapData();
</span><span class="cx"> 
</span><del>-    throwTypeError(callFrame, WTF::ASCIILiteral(&quot;Called WeakMap function on a non-WeakMap object&quot;));
</del><ins>+    throwTypeError(callFrame, scope, WTF::ASCIILiteral(&quot;Called WeakMap function on a non-WeakMap object&quot;));
</ins><span class="cx">     return nullptr;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -99,13 +102,16 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL protoFuncWeakMapSet(CallFrame* callFrame)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     WeakMapData* map = getWeakMapData(callFrame, callFrame-&gt;thisValue());
</span><span class="cx">     if (!map)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     JSValue key = callFrame-&gt;argument(0);
</span><span class="cx">     if (!key.isObject())
</span><del>-        return JSValue::encode(throwTypeError(callFrame, WTF::ASCIILiteral(&quot;Attempted to set a non-object key in a WeakMap&quot;)));
-    map-&gt;set(callFrame-&gt;vm(), asObject(key), callFrame-&gt;argument(1));
</del><ins>+        return JSValue::encode(throwTypeError(callFrame, scope, WTF::ASCIILiteral(&quot;Attempted to set a non-object key in a WeakMap&quot;)));
+    map-&gt;set(vm, asObject(key), callFrame-&gt;argument(1));
</ins><span class="cx">     return JSValue::encode(callFrame-&gt;thisValue());
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeWeakSetConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -48,11 +48,16 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callWeakSet(ExecState* exec)
</span><span class="cx"> {
</span><del>-    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, &quot;WeakSet&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, &quot;WeakSet&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructWeakSet(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSGlobalObject* globalObject = asInternalFunction(exec-&gt;callee())-&gt;globalObject();
</span><span class="cx">     Structure* weakSetStructure = InternalFunction::createSubclassStructure(exec, exec-&gt;newTarget(), globalObject-&gt;weakSetStructure());
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="lines">@@ -69,7 +74,7 @@
</span><span class="cx">     CallData adderFunctionCallData;
</span><span class="cx">     CallType adderFunctionCallType = getCallData(adderFunction, adderFunctionCallData);
</span><span class="cx">     if (adderFunctionCallType == CallType::None)
</span><del>-        return JSValue::encode(throwTypeError(exec));
</del><ins>+        return JSValue::encode(throwTypeError(exec, scope));
</ins><span class="cx"> 
</span><span class="cx">     forEachInIterable(exec, iterable, [&amp;](VM&amp;, ExecState* exec, JSValue nextValue) {
</span><span class="cx">         MarkedArgumentBuffer arguments;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceJavaScriptCoreruntimeWeakSetPrototypecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/JavaScriptCore/runtime/WeakSetPrototype.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple, Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple, Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -54,8 +54,11 @@
</span><span class="cx"> 
</span><span class="cx"> static WeakMapData* getWeakMapData(CallFrame* callFrame, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwTypeError(callFrame, WTF::ASCIILiteral(&quot;Called WeakSet function on non-object&quot;));
</del><ins>+        throwTypeError(callFrame, scope, WTF::ASCIILiteral(&quot;Called WeakSet function on non-object&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -62,7 +65,7 @@
</span><span class="cx">     if (JSWeakSet* weakSet = jsDynamicCast&lt;JSWeakSet*&gt;(value))
</span><span class="cx">         return weakSet-&gt;weakMapData();
</span><span class="cx"> 
</span><del>-    throwTypeError(callFrame, WTF::ASCIILiteral(&quot;Called WeakSet function on a non-WeakSet object&quot;));
</del><ins>+    throwTypeError(callFrame, scope, WTF::ASCIILiteral(&quot;Called WeakSet function on a non-WeakSet object&quot;));
</ins><span class="cx">     return nullptr;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -86,13 +89,16 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL protoFuncWeakSetAdd(CallFrame* callFrame)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = callFrame-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     WeakMapData* map = getWeakMapData(callFrame, callFrame-&gt;thisValue());
</span><span class="cx">     if (!map)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     JSValue key = callFrame-&gt;argument(0);
</span><span class="cx">     if (!key.isObject())
</span><del>-        return JSValue::encode(throwTypeError(callFrame, WTF::ASCIILiteral(&quot;Attempted to add a non-object key to a WeakSet&quot;)));
-    map-&gt;set(callFrame-&gt;vm(), asObject(key), jsUndefined());
</del><ins>+        return JSValue::encode(throwTypeError(callFrame, scope, WTF::ASCIILiteral(&quot;Attempted to add a non-object key to a WeakSet&quot;)));
+    map-&gt;set(vm, asObject(key), jsUndefined());
</ins><span class="cx">     return JSValue::encode(callFrame-&gt;thisValue());
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWTFChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WTF/ChangeLog (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WTF/ChangeLog        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WTF/ChangeLog        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,3 +1,13 @@
</span><ins>+2016-08-30  Mark Lam  &lt;mark.lam@apple.com&gt;
+
+        Introduce the ThrowScope and force every throw site to instantiate a ThrowScope.
+        https://bugs.webkit.org/show_bug.cgi?id=161171
+
+        Reviewed by Filip Pizlo and Geoffrey Garen.
+
+        * wtf/Platform.h:
+        - Introduced the ENABLE(THROW_SCOPE_VERIFICATION) flag.
+
</ins><span class="cx"> 2016-08-27  Alex Christensen  &lt;achristensen@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         URLParser should parse relative URLs
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWTFwtfPlatformh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WTF/wtf/Platform.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WTF/wtf/Platform.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WTF/wtf/Platform.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -918,6 +918,10 @@
</span><span class="cx"> #define ENABLE_MASM_PROBE 0
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><ins>+#ifndef ENABLE_THROW_SCOPE_VERIFICATION
+#define ENABLE_THROW_SCOPE_VERIFICATION (!defined(NDEBUG))
+#endif
+
</ins><span class="cx"> /* Pick which allocator to use; we only need an executable allocator if the assembler is compiled in.
</span><span class="cx">    On non-Windows x86-64, iOS, and ARM64 we use a single fixed mmap, on other platforms we mmap on demand. */
</span><span class="cx"> #if ENABLE(ASSEMBLER)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/ChangeLog        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,3 +1,759 @@
</span><ins>+2016-08-30  Mark Lam  &lt;mark.lam@apple.com&gt;
+
+        Introduce the ThrowScope and force every throw site to instantiate a ThrowScope.
+        https://bugs.webkit.org/show_bug.cgi?id=161171
+
+        Reviewed by Filip Pizlo and Geoffrey Garen.
+
+        No new tests because this is only an internal API change. If it builds, it should be good.
+
+        * bindings/js/JSApplePaySessionCustom.cpp:
+        (WebCore::JSApplePaySession::completeShippingMethodSelection):
+        (WebCore::JSApplePaySession::completeShippingContactSelection):
+        (WebCore::JSApplePaySession::completePaymentMethodSelection):
+        * bindings/js/JSBlobCustom.cpp:
+        (WebCore::constructJSBlob):
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::getPropertyCSSValue):
+        * bindings/js/JSCryptoAlgorithmDictionary.cpp:
+        (WebCore::JSCryptoAlgorithmDictionary::getAlgorithmIdentifier):
+        (WebCore::createAesCbcParams):
+        (WebCore::createAesKeyGenParams):
+        (WebCore::createHmacParams):
+        (WebCore::createHmacKeyParams):
+        (WebCore::createRsaKeyGenParams):
+        (WebCore::createRsaOaepParams):
+        (WebCore::createRsaSsaParams):
+        * bindings/js/JSCryptoCustom.cpp:
+        (WebCore::JSCrypto::getRandomValues):
+        * bindings/js/JSCryptoKeySerializationJWK.cpp:
+        (WebCore::getJSArrayFromJSON):
+        (WebCore::getStringFromJSON):
+        (WebCore::getBooleanFromJSON):
+        (WebCore::getBigIntegerVectorFromJSON):
+        (WebCore::JSCryptoKeySerializationJWK::JSCryptoKeySerializationJWK):
+        (WebCore::JSCryptoKeySerializationJWK::reconcileAlgorithm):
+        (WebCore::tryJWKKeyOpsValue):
+        (WebCore::JSCryptoKeySerializationJWK::reconcileUsages):
+        (WebCore::JSCryptoKeySerializationJWK::keyDataOctetSequence):
+        (WebCore::JSCryptoKeySerializationJWK::keyDataRSAComponents):
+        (WebCore::JSCryptoKeySerializationJWK::keyData):
+        (WebCore::addJWKAlgorithmToJSON):
+        (WebCore::JSCryptoKeySerializationJWK::serialize):
+        * bindings/js/JSCryptoOperationData.cpp:
+        (WebCore::cryptoOperationDataFromJSValue):
+        * bindings/js/JSCustomElementInterface.cpp:
+        (WebCore::JSCustomElementInterface::upgradeElement):
+        * bindings/js/JSCustomElementRegistryCustom.cpp:
+        (WebCore::getCustomElementCallback):
+        (WebCore::JSCustomElementRegistry::define):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException):
+        (WebCore::enforceRange):
+        (WebCore::toSmallerInt):
+        (WebCore::toSmallerUInt):
+        (WebCore::canAccessDocument):
+        (WebCore::throwTypeError):
+        (WebCore::throwNotSupportedError):
+        (WebCore::throwInvalidStateError):
+        (WebCore::throwSecurityError):
+        (WebCore::throwArgumentMustBeEnumError):
+        (WebCore::throwArgumentMustBeFunctionError):
+        (WebCore::throwArgumentTypeError):
+        (WebCore::throwArrayElementTypeError):
+        (WebCore::throwAttributeTypeError):
+        (WebCore::throwConstructorScriptExecutionContextUnavailableError):
+        (WebCore::throwSequenceTypeError):
+        (WebCore::throwNonFiniteTypeError):
+        (WebCore::throwGetterTypeError):
+        (WebCore::throwSetterTypeError):
+        (WebCore::throwThisTypeError):
+        (WebCore::callThrowTypeError):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::toJSSequence):
+        (WebCore::toRefPtrNativeArray):
+        (WebCore::toNativeArray):
+        * bindings/js/JSDOMConstructor.h:
+        (WebCore::JSDOMConstructorNotConstructable::callThrowTypeError):
+        (WebCore::JSBuiltinConstructor&lt;JSClass&gt;::callConstructor):
+        * bindings/js/JSDOMConvert.h:
+        (WebCore::convertWrapperType):
+        * bindings/js/JSDOMIterator.h:
+        (WebCore::iteratorCreate):
+        (WebCore::iteratorForEach):
+        (WebCore::JSDOMIteratorPrototype&lt;JSWrapper&gt;::next):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
+        (WebCore::JSDOMWindow::put):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::handlePostMessage):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * bindings/js/JSDataCueCustom.cpp:
+        (WebCore::constructJSDataCue):
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::convertValue):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::createTouchList):
+        (WebCore::JSDocument::getCSSCanvasContext):
+        * bindings/js/JSFileCustom.cpp:
+        (WebCore::constructJSFile):
+        * bindings/js/JSHTMLAllCollectionCustom.cpp:
+        (WebCore::JSHTMLAllCollection::item):
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::getContext):
+        (WebCore::JSHTMLCanvasElement::probablySupportsContext):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        * bindings/js/JSHTMLElementCustom.cpp:
+        (WebCore::constructJSHTMLElement):
+        * bindings/js/JSHTMLFormControlsCollectionCustom.cpp:
+        (WebCore::JSHTMLFormControlsCollection::namedItem):
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::selectionStart):
+        (WebCore::JSHTMLInputElement::setSelectionStart):
+        (WebCore::JSHTMLInputElement::selectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionEnd):
+        (WebCore::JSHTMLInputElement::selectionDirection):
+        (WebCore::JSHTMLInputElement::setSelectionDirection):
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::pushState):
+        (WebCore::JSHistory::replaceState):
+        * bindings/js/JSIDBDatabaseCustom.cpp:
+        (WebCore::JSIDBDatabase::createObjectStore):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::construct):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertySlotDelegate):
+        * bindings/js/JSMediaDevicesCustom.cpp:
+        (WebCore::JSMediaDevices::getUserMedia):
+        * bindings/js/JSMediaStreamTrackCustom.cpp:
+        (WebCore::JSMediaStreamTrack::getSettings):
+        (WebCore::JSMediaStreamTrack::getCapabilities):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::fillMessagePortArray):
+        * bindings/js/JSMessagePortCustom.h:
+        (WebCore::handlePostMessage):
+        * bindings/js/JSMockContentFilterSettingsCustom.cpp:
+        (WebCore::JSMockContentFilterSettings::setDecisionPoint):
+        (WebCore::toDecision):
+        * bindings/js/JSModuleLoader.cpp:
+        (WebCore::JSModuleLoader::evaluate):
+        * bindings/js/JSMutationObserverCustom.cpp:
+        (WebCore::constructJSMutationObserver):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::insertBefore):
+        (WebCore::JSNode::replaceChild):
+        (WebCore::JSNode::removeChild):
+        (WebCore::JSNode::appendChild):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::acceptNode):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::pluginElementPropertyGetter):
+        * bindings/js/JSReadableStreamPrivateConstructors.cpp:
+        (WebCore::constructJSReadableStreamDefaultController):
+        (WebCore::constructJSReadableStreamDefaultReader):
+        * bindings/js/JSSVGLengthCustom.cpp:
+        (WebCore::JSSVGLength::setValue):
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSWebGL2RenderingContextCustom.cpp:
+        (WebCore::JSWebGL2RenderingContext::getIndexedParameter):
+        * bindings/js/JSWebGLRenderingContextBaseCustom.cpp:
+        (WebCore::getObjectParameter):
+        (WebCore::JSWebGLRenderingContextBase::getAttachedShaders):
+        (WebCore::JSWebGLRenderingContextBase::getExtension):
+        (WebCore::JSWebGLRenderingContextBase::getFramebufferAttachmentParameter):
+        (WebCore::JSWebGLRenderingContextBase::getParameter):
+        (WebCore::JSWebGLRenderingContextBase::getProgramParameter):
+        (WebCore::JSWebGLRenderingContextBase::getShaderParameter):
+        (WebCore::JSWebGLRenderingContextBase::getUniform):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        * bindings/js/JSWebKitSubtleCryptoCustom.cpp:
+        (WebCore::cryptoKeyFormatFromJSValue):
+        (WebCore::cryptoKeyUsagesFromJSValue):
+        (WebCore::JSWebKitSubtleCrypto::encrypt):
+        (WebCore::JSWebKitSubtleCrypto::decrypt):
+        (WebCore::JSWebKitSubtleCrypto::sign):
+        (WebCore::JSWebKitSubtleCrypto::verify):
+        (WebCore::JSWebKitSubtleCrypto::digest):
+        (WebCore::JSWebKitSubtleCrypto::generateKey):
+        (WebCore::importKey):
+        (WebCore::JSWebKitSubtleCrypto::importKey):
+        (WebCore::exportKey):
+        (WebCore::JSWebKitSubtleCrypto::exportKey):
+        (WebCore::JSWebKitSubtleCrypto::wrapKey):
+        (WebCore::JSWebKitSubtleCrypto::unwrapKey):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::constructJSWorker):
+        * bindings/js/JSWorkerGlobalScopeCustom.cpp:
+        (WebCore::JSWorkerGlobalScope::setTimeout):
+        (WebCore::JSWorkerGlobalScope::setInterval):
+        * bindings/js/ReadableStreamDefaultController.cpp:
+        (WebCore::ReadableStreamDefaultController::invoke):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneBase::throwStackOverflow):
+        (WebCore::CloneDeserializer::throwValidationError):
+        (WebCore::SerializedScriptValue::maybeThrowExceptionIfSerializationFailed):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::setException):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateEnumerationImplementationContent):
+        (GenerateDictionaryImplementationContent):
+        (GenerateOverloadedFunctionOrConstructor):
+        (GenerateImplementation):
+        (GenerateFunctionCastedThis):
+        (GenerateArgumentsCountCheck):
+        (GenerateParametersCheck):
+        (GenerateConstructorDefinition):
+        * bindings/scripts/test/JS/JSInterfaceName.cpp:
+        (WebCore::jsInterfaceNameConstructor):
+        (WebCore::setJSInterfaceNameConstructor):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::jsTestActiveDOMObjectExcitingAttr):
+        (WebCore::jsTestActiveDOMObjectConstructor):
+        (WebCore::setJSTestActiveDOMObjectConstructor):
+        (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):
+        (WebCore::jsTestActiveDOMObjectPrototypeFunctionPostMessage):
+        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
+        (WebCore::jsTestClassWithJSBuiltinConstructorConstructor):
+        (WebCore::setJSTestClassWithJSBuiltinConstructorConstructor):
+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
+        (WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):
+        (WebCore::setJSTestCustomConstructorWithNoInterfaceObjectConstructor):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
+        (WebCore::jsTestCustomNamedGetterConstructor):
+        (WebCore::setJSTestCustomNamedGetterConstructor):
+        (WebCore::jsTestCustomNamedGetterPrototypeFunctionAnotherFunction):
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::JSTestEventConstructorConstructor::construct):
+        (WebCore::jsTestEventConstructorAttr1):
+        (WebCore::jsTestEventConstructorAttr2):
+        (WebCore::jsTestEventConstructorAttr3):
+        (WebCore::jsTestEventConstructorConstructor):
+        (WebCore::setJSTestEventConstructorConstructor):
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore::jsTestEventTargetConstructor):
+        (WebCore::setJSTestEventTargetConstructor):
+        (WebCore::jsTestEventTargetPrototypeFunctionItem):
+        * bindings/scripts/test/JS/JSTestException.cpp:
+        (WebCore::jsTestExceptionName):
+        (WebCore::jsTestExceptionConstructor):
+        (WebCore::setJSTestExceptionConstructor):
+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
+        (WebCore::jsTestGenerateIsReachableConstructor):
+        (WebCore::setJSTestGenerateIsReachableConstructor):
+        * bindings/scripts/test/JS/JSTestGlobalObject.cpp:
+        (WebCore::jsTestGlobalObjectRegularAttribute):
+        (WebCore::jsTestGlobalObjectPublicAndPrivateAttribute):
+        (WebCore::jsTestGlobalObjectPublicAndPrivateConditionalAttribute):
+        (WebCore::jsTestGlobalObjectEnabledAtRuntimeAttribute):
+        (WebCore::jsTestGlobalObjectConstructor):
+        (WebCore::setJSTestGlobalObjectConstructor):
+        (WebCore::setJSTestGlobalObjectRegularAttribute):
+        (WebCore::setJSTestGlobalObjectPublicAndPrivateAttribute):
+        (WebCore::setJSTestGlobalObjectPublicAndPrivateConditionalAttribute):
+        (WebCore::setJSTestGlobalObjectEnabledAtRuntimeAttribute):
+        (WebCore::jsTestGlobalObjectInstanceFunctionRegularOperation):
+        (WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation1):
+        (WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation2):
+        (WebCore::jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation):
+        (WebCore::jsTestGlobalObjectInstanceFunctionTestPrivateFunction):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::construct):
+        (WebCore::jsTestInterfaceConstructorImplementsStaticReadOnlyAttr):
+        (WebCore::jsTestInterfaceConstructorImplementsStaticAttr):
+        (WebCore::jsTestInterfaceImplementsStr1):
+        (WebCore::jsTestInterfaceImplementsStr2):
+        (WebCore::jsTestInterfaceImplementsStr3):
+        (WebCore::jsTestInterfaceImplementsNode):
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr):
+        (WebCore::jsTestInterfaceConstructorSupplementalStaticAttr):
+        (WebCore::jsTestInterfaceSupplementalStr1):
+        (WebCore::jsTestInterfaceSupplementalStr2):
+        (WebCore::jsTestInterfaceSupplementalStr3):
+        (WebCore::jsTestInterfaceSupplementalNode):
+        (WebCore::jsTestInterfaceConstructor):
+        (WebCore::setJSTestInterfaceConstructor):
+        (WebCore::setJSTestInterfaceConstructorImplementsStaticAttr):
+        (WebCore::setJSTestInterfaceImplementsStr2):
+        (WebCore::setJSTestInterfaceImplementsStr3):
+        (WebCore::setJSTestInterfaceImplementsNode):
+        (WebCore::setJSTestInterfaceConstructorSupplementalStaticAttr):
+        (WebCore::setJSTestInterfaceSupplementalStr2):
+        (WebCore::setJSTestInterfaceSupplementalStr3):
+        (WebCore::setJSTestInterfaceSupplementalNode):
+        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod1):
+        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod2):
+        (WebCore::jsTestInterfacePrototypeFunctionImplementsMethod3):
+        (WebCore::jsTestInterfaceConstructorFunctionImplementsMethod4):
+        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod1):
+        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod2):
+        (WebCore::jsTestInterfacePrototypeFunctionSupplementalMethod3):
+        (WebCore::jsTestInterfaceConstructorFunctionSupplementalMethod4):
+        * bindings/scripts/test/JS/JSTestIterable.cpp:
+        (WebCore::jsTestIterableConstructor):
+        (WebCore::setJSTestIterableConstructor):
+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
+        (WebCore::jsTestJSBuiltinConstructorTestAttributeCustom):
+        (WebCore::jsTestJSBuiltinConstructorTestAttributeRWCustom):
+        (WebCore::jsTestJSBuiltinConstructorConstructor):
+        (WebCore::setJSTestJSBuiltinConstructorConstructor):
+        (WebCore::setJSTestJSBuiltinConstructorTestAttributeRWCustom):
+        (WebCore::jsTestJSBuiltinConstructorPrototypeFunctionTestCustomFunction):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore::jsTestMediaQueryListListenerConstructor):
+        (WebCore::setJSTestMediaQueryListListenerConstructor):
+        (WebCore::jsTestMediaQueryListListenerPrototypeFunctionMethod):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore::JSTestNamedConstructorNamedConstructor::construct):
+        (WebCore::jsTestNamedConstructorConstructor):
+        (WebCore::setJSTestNamedConstructorConstructor):
+        * bindings/scripts/test/JS/JSTestNode.cpp:
+        (WebCore::JSTestNodeConstructor::construct):
+        (WebCore::jsTestNodeName):
+        (WebCore::jsTestNodeConstructor):
+        (WebCore::setJSTestNodeConstructor):
+        (WebCore::setJSTestNodeName):
+        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
+        (WebCore::jsTestNondeterministicNondeterministicReadonlyAttr):
+        (WebCore::jsTestNondeterministicNondeterministicWriteableAttr):
+        (WebCore::jsTestNondeterministicNondeterministicExceptionAttr):
+        (WebCore::jsTestNondeterministicNondeterministicGetterExceptionAttr):
+        (WebCore::jsTestNondeterministicNondeterministicSetterExceptionAttr):
+        (WebCore::jsTestNondeterministicConstructor):
+        (WebCore::setJSTestNondeterministicConstructor):
+        (WebCore::setJSTestNondeterministicNondeterministicWriteableAttr):
+        (WebCore::setJSTestNondeterministicNondeterministicExceptionAttr):
+        (WebCore::setJSTestNondeterministicNondeterministicGetterExceptionAttr):
+        (WebCore::setJSTestNondeterministicNondeterministicSetterExceptionAttr):
+        (WebCore::jsTestNondeterministicPrototypeFunctionNondeterministicZeroArgFunction):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::convert&lt;TestObj::EnumType&gt;):
+        (WebCore::convert&lt;TestObj::Optional&gt;):
+        (WebCore::convert&lt;AlternateEnumName&gt;):
+        (WebCore::convert&lt;TestObj::EnumA&gt;):
+        (WebCore::convert&lt;TestObj::EnumB&gt;):
+        (WebCore::convert&lt;TestObj::EnumC&gt;):
+        (WebCore::convert&lt;TestObj::Kind&gt;):
+        (WebCore::convert&lt;TestObj::Size&gt;):
+        (WebCore::convert&lt;TestObj::Confidence&gt;):
+        (WebCore::convertDictionary&lt;TestObj::Dictionary&gt;):
+        (WebCore::convertDictionary&lt;TestObj::DictionaryThatShouldNotTolerateNull&gt;):
+        (WebCore::convertDictionary&lt;TestObj::DictionaryThatShouldTolerateNull&gt;):
+        (WebCore::convertDictionary&lt;AlternateDictionaryName&gt;):
+        (WebCore::JSTestObjConstructor::construct):
+        (WebCore::jsTestObjReadOnlyLongAttr):
+        (WebCore::jsTestObjReadOnlyStringAttr):
+        (WebCore::jsTestObjReadOnlyTestObjAttr):
+        (WebCore::jsTestObjConstructorStaticReadOnlyLongAttr):
+        (WebCore::jsTestObjConstructorStaticStringAttr):
+        (WebCore::jsTestObjConstructorTestSubObj):
+        (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
+        (WebCore::jsTestObjEnumAttr):
+        (WebCore::jsTestObjByteAttr):
+        (WebCore::jsTestObjOctetAttr):
+        (WebCore::jsTestObjShortAttr):
+        (WebCore::jsTestObjClampedShortAttr):
+        (WebCore::jsTestObjEnforceRangeShortAttr):
+        (WebCore::jsTestObjUnsignedShortAttr):
+        (WebCore::jsTestObjLongAttr):
+        (WebCore::jsTestObjLongLongAttr):
+        (WebCore::jsTestObjUnsignedLongLongAttr):
+        (WebCore::jsTestObjStringAttr):
+        (WebCore::jsTestObjUsvstringAttr):
+        (WebCore::jsTestObjTestObjAttr):
+        (WebCore::jsTestObjTestNullableObjAttr):
+        (WebCore::jsTestObjLenientTestObjAttr):
+        (WebCore::jsTestObjUnforgeableAttr):
+        (WebCore::jsTestObjStringAttrTreatingNullAsEmptyString):
+        (WebCore::jsTestObjUsvstringAttrTreatingNullAsEmptyString):
+        (WebCore::jsTestObjImplementationEnumAttr):
+        (WebCore::jsTestObjXMLObjAttr):
+        (WebCore::jsTestObjCreate):
+        (WebCore::jsTestObjReflectedStringAttr):
+        (WebCore::jsTestObjReflectedUSVStringAttr):
+        (WebCore::jsTestObjReflectedIntegralAttr):
+        (WebCore::jsTestObjReflectedUnsignedIntegralAttr):
+        (WebCore::jsTestObjReflectedBooleanAttr):
+        (WebCore::jsTestObjReflectedURLAttr):
+        (WebCore::jsTestObjReflectedUSVURLAttr):
+        (WebCore::jsTestObjReflectedCustomIntegralAttr):
+        (WebCore::jsTestObjReflectedCustomBooleanAttr):
+        (WebCore::jsTestObjReflectedCustomURLAttr):
+        (WebCore::jsTestObjEnabledAtRuntimeAttribute):
+        (WebCore::jsTestObjTypedArrayAttr):
+        (WebCore::jsTestObjAttrWithGetterException):
+        (WebCore::jsTestObjAttrWithGetterExceptionWithMessage):
+        (WebCore::jsTestObjAttrWithSetterException):
+        (WebCore::jsTestObjAttrWithSetterExceptionWithMessage):
+        (WebCore::jsTestObjStringAttrWithGetterException):
+        (WebCore::jsTestObjStringAttrWithSetterException):
+        (WebCore::jsTestObjCustomAttr):
+        (WebCore::jsTestObjOnfoo):
+        (WebCore::jsTestObjOnwebkitfoo):
+        (WebCore::jsTestObjWithScriptStateAttribute):
+        (WebCore::jsTestObjWithCallWithAndSetterCallWithAttribute):
+        (WebCore::jsTestObjWithScriptExecutionContextAttribute):
+        (WebCore::jsTestObjWithScriptStateAttributeRaises):
+        (WebCore::jsTestObjWithScriptExecutionContextAttributeRaises):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttribute):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebCore::jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebCore::jsTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::jsTestObjConditionalAttr1):
+        (WebCore::jsTestObjConditionalAttr2):
+        (WebCore::jsTestObjConditionalAttr3):
+        (WebCore::jsTestObjConditionalAttr4Constructor):
+        (WebCore::jsTestObjConditionalAttr5Constructor):
+        (WebCore::jsTestObjConditionalAttr6Constructor):
+        (WebCore::jsTestObjCachedAttribute1):
+        (WebCore::jsTestObjCachedAttribute2):
+        (WebCore::jsTestObjAnyAttribute):
+        (WebCore::jsTestObjContentDocument):
+        (WebCore::jsTestObjMutablePoint):
+        (WebCore::jsTestObjImmutablePoint):
+        (WebCore::jsTestObjStrawberry):
+        (WebCore::jsTestObjDescription):
+        (WebCore::jsTestObjId):
+        (WebCore::jsTestObjHash):
+        (WebCore::jsTestObjReplaceableAttribute):
+        (WebCore::jsTestObjNullableDoubleAttribute):
+        (WebCore::jsTestObjNullableLongAttribute):
+        (WebCore::jsTestObjNullableBooleanAttribute):
+        (WebCore::jsTestObjNullableStringAttribute):
+        (WebCore::jsTestObjNullableLongSettableAttribute):
+        (WebCore::jsTestObjNullableStringSettableAttribute):
+        (WebCore::jsTestObjNullableUSVStringSettableAttribute):
+        (WebCore::jsTestObjNullableStringValue):
+        (WebCore::jsTestObjAttribute):
+        (WebCore::jsTestObjAttributeWithReservedEnumType):
+        (WebCore::jsTestObjPutForwardsAttribute):
+        (WebCore::jsTestObjPutForwardsNullableAttribute):
+        (WebCore::jsTestObjStringifierAttribute):
+        (WebCore::jsTestObjConstructor):
+        (WebCore::setJSTestObjConstructor):
+        (WebCore::setJSTestObjConstructorStaticStringAttr):
+        (WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
+        (WebCore::setJSTestObjEnumAttr):
+        (WebCore::setJSTestObjByteAttr):
+        (WebCore::setJSTestObjOctetAttr):
+        (WebCore::setJSTestObjShortAttr):
+        (WebCore::setJSTestObjClampedShortAttr):
+        (WebCore::setJSTestObjEnforceRangeShortAttr):
+        (WebCore::setJSTestObjUnsignedShortAttr):
+        (WebCore::setJSTestObjLongAttr):
+        (WebCore::setJSTestObjLongLongAttr):
+        (WebCore::setJSTestObjUnsignedLongLongAttr):
+        (WebCore::setJSTestObjStringAttr):
+        (WebCore::setJSTestObjUsvstringAttr):
+        (WebCore::setJSTestObjTestObjAttr):
+        (WebCore::setJSTestObjTestNullableObjAttr):
+        (WebCore::setJSTestObjLenientTestObjAttr):
+        (WebCore::setJSTestObjStringAttrTreatingNullAsEmptyString):
+        (WebCore::setJSTestObjUsvstringAttrTreatingNullAsEmptyString):
+        (WebCore::setJSTestObjImplementationEnumAttr):
+        (WebCore::setJSTestObjXMLObjAttr):
+        (WebCore::setJSTestObjCreate):
+        (WebCore::setJSTestObjReflectedStringAttr):
+        (WebCore::setJSTestObjReflectedUSVStringAttr):
+        (WebCore::setJSTestObjReflectedIntegralAttr):
+        (WebCore::setJSTestObjReflectedUnsignedIntegralAttr):
+        (WebCore::setJSTestObjReflectedBooleanAttr):
+        (WebCore::setJSTestObjReflectedURLAttr):
+        (WebCore::setJSTestObjReflectedUSVURLAttr):
+        (WebCore::setJSTestObjReflectedCustomIntegralAttr):
+        (WebCore::setJSTestObjReflectedCustomBooleanAttr):
+        (WebCore::setJSTestObjReflectedCustomURLAttr):
+        (WebCore::setJSTestObjEnabledAtRuntimeAttribute):
+        (WebCore::setJSTestObjTypedArrayAttr):
+        (WebCore::setJSTestObjAttrWithGetterException):
+        (WebCore::setJSTestObjAttrWithGetterExceptionWithMessage):
+        (WebCore::setJSTestObjAttrWithSetterException):
+        (WebCore::setJSTestObjAttrWithSetterExceptionWithMessage):
+        (WebCore::setJSTestObjStringAttrWithGetterException):
+        (WebCore::setJSTestObjStringAttrWithSetterException):
+        (WebCore::setJSTestObjCustomAttr):
+        (WebCore::setJSTestObjOnfoo):
+        (WebCore::setJSTestObjOnwebkitfoo):
+        (WebCore::setJSTestObjWithScriptStateAttribute):
+        (WebCore::setJSTestObjWithCallWithAndSetterCallWithAttribute):
+        (WebCore::setJSTestObjWithScriptExecutionContextAttribute):
+        (WebCore::setJSTestObjWithScriptStateAttributeRaises):
+        (WebCore::setJSTestObjWithScriptExecutionContextAttributeRaises):
+        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttribute):
+        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises):
+        (WebCore::setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute):
+        (WebCore::setJSTestObjWithScriptArgumentsAndCallStackAttribute):
+        (WebCore::setJSTestObjConditionalAttr1):
+        (WebCore::setJSTestObjConditionalAttr2):
+        (WebCore::setJSTestObjConditionalAttr3):
+        (WebCore::setJSTestObjConditionalAttr4Constructor):
+        (WebCore::setJSTestObjConditionalAttr5Constructor):
+        (WebCore::setJSTestObjConditionalAttr6Constructor):
+        (WebCore::setJSTestObjAnyAttribute):
+        (WebCore::setJSTestObjMutablePoint):
+        (WebCore::setJSTestObjImmutablePoint):
+        (WebCore::setJSTestObjStrawberry):
+        (WebCore::setJSTestObjId):
+        (WebCore::setJSTestObjReplaceableAttribute):
+        (WebCore::setJSTestObjNullableLongSettableAttribute):
+        (WebCore::setJSTestObjNullableStringSettableAttribute):
+        (WebCore::setJSTestObjNullableUSVStringSettableAttribute):
+        (WebCore::setJSTestObjNullableStringValue):
+        (WebCore::setJSTestObjAttributeWithReservedEnumType):
+        (WebCore::setJSTestObjPutForwardsAttribute):
+        (WebCore::setJSTestObjPutForwardsNullableAttribute):
+        (WebCore::setJSTestObjStringifierAttribute):
+        (WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation1):
+        (WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation2):
+        (WebCore::jsTestObjPrototypeFunctionEnabledAtRuntimeOperation):
+        (WebCore::jsTestObjPrototypeFunctionVoidMethod):
+        (WebCore::jsTestObjPrototypeFunctionVoidMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionByteMethod):
+        (WebCore::jsTestObjPrototypeFunctionByteMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionOctetMethod):
+        (WebCore::jsTestObjPrototypeFunctionOctetMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionLongMethod):
+        (WebCore::jsTestObjPrototypeFunctionLongMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionObjMethod):
+        (WebCore::jsTestObjPrototypeFunctionObjMethodWithArgs):
+        (WebCore::jsTestObjInstanceFunctionUnforgeableMethod):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithArgTreatingNullAsEmptyString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithXPathNSResolverParameter):
+        (WebCore::jsTestObjPrototypeFunctionNullableStringMethod):
+        (WebCore::jsTestObjConstructorFunctionNullableStringStaticMethod):
+        (WebCore::jsTestObjPrototypeFunctionNullableStringSpecialMethod):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithEnumArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalEnumArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalEnumArgAndDefaultValue):
+        (WebCore::jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithUSVStringArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithNullableUSVStringArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithUSVStringArgTreatingNullAsEmptyString):
+        (WebCore::jsTestObjPrototypeFunctionSerializedValue):
+        (WebCore::jsTestObjPrototypeFunctionOptionsObject):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithException):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithExceptionWithMessage):
+        (WebCore::jsTestObjPrototypeFunctionCustomMethod):
+        (WebCore::jsTestObjPrototypeFunctionCustomMethodWithArgs):
+        (WebCore::jsTestObjPrototypeFunctionPrivateMethod):
+        (WebCore::jsTestObjPrototypeFunctionPublicAndPrivateMethod):
+        (WebCore::jsTestObjPrototypeFunctionAddEventListener):
+        (WebCore::jsTestObjPrototypeFunctionRemoveEventListener):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptStateVoid):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObj):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptStateVoidException):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptStateObjException):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContext):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces):
+        (WebCore::jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack):
+        (WebCore::jsTestObjPrototypeFunctionWithDocumentArgument):
+        (WebCore::jsTestObjPrototypeFunctionWithCallerDocumentArgument):
+        (WebCore::jsTestObjPrototypeFunctionWithCallerWindowArgument):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArgAndDefaultValue):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUSVString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringAndDefaultValue):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringAndDefaultValue):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsNull):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringIsNull):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalStringIsEmptyString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUSVStringIsEmptyString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringIsEmptyString):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalDoubleIsNaN):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalFloatIsNaN):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalLongLong):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalLongLongIsZero):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUnsignedLongLong):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalUnsignedLongLongIsZero):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalSequence):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalSequenceIsEmpty):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBoolean):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBooleanIsFalse):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalAny):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalNullableWrapper):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalNullableWrapperIsNull):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithOptionalXPathNSResolver):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackFunctionArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackFunctionArg):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithCallbackFunctionAndOptionalArg):
+        (WebCore::jsTestObjConstructorFunctionStaticMethodWithCallbackAndOptionalArg):
+        (WebCore::jsTestObjConstructorFunctionStaticMethodWithCallbackArg):
+        (WebCore::jsTestObjPrototypeFunctionConditionalMethod1):
+        (WebCore::jsTestObjPrototypeFunctionConditionalMethod2):
+        (WebCore::jsTestObjPrototypeFunctionConditionalMethod3):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod1):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod3):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod4):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod5):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod6):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod11):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod12):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter1):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2):
+        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter):
+        (WebCore::jsTestObjConstructorFunctionClassMethod):
+        (WebCore::jsTestObjConstructorFunctionClassMethodWithOptional):
+        (WebCore::jsTestObjConstructorFunctionClassMethod2):
+        (WebCore::jsTestObjConstructorFunctionOverloadedMethod11):
+        (WebCore::jsTestObjConstructorFunctionOverloadedMethod12):
+        (WebCore::jsTestObjConstructorFunctionOverloadedMethod1):
+        (WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
+        (WebCore::jsTestObjPrototypeFunctionClassMethodWithEnforceRange):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongSequence):
+        (WebCore::jsTestObjPrototypeFunctionStringArrayFunction):
+        (WebCore::jsTestObjPrototypeFunctionDomStringListFunction):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence):
+        (WebCore::jsTestObjPrototypeFunctionGetElementById):
+        (WebCore::jsTestObjPrototypeFunctionGetSVGDocument):
+        (WebCore::jsTestObjPrototypeFunctionConvert1):
+        (WebCore::jsTestObjPrototypeFunctionConvert2):
+        (WebCore::jsTestObjPrototypeFunctionConvert3):
+        (WebCore::jsTestObjPrototypeFunctionConvert4):
+        (WebCore::jsTestObjPrototypeFunctionMutablePointFunction):
+        (WebCore::jsTestObjPrototypeFunctionImmutablePointFunction):
+        (WebCore::jsTestObjPrototypeFunctionOrange):
+        (WebCore::jsTestObjPrototypeFunctionVariadicStringMethod):
+        (WebCore::jsTestObjPrototypeFunctionVariadicDoubleMethod):
+        (WebCore::jsTestObjPrototypeFunctionVariadicNodeMethod):
+        (WebCore::jsTestObjPrototypeFunctionAny):
+        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionPromise):
+        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithFloatArgumentPromise):
+        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithExceptionPromise):
+        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithOptionalIntArgumentPromise):
+        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1Promise):
+        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise):
+        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction):
+        (WebCore::jsTestObjConstructorFunctionTestStaticPromiseFunctionPromise):
+        (WebCore::jsTestObjConstructorFunctionTestStaticPromiseFunctionWithExceptionPromise):
+        (WebCore::jsTestObjPrototypeFunctionMethodWithNeedsCustomElementReactionStack):
+        (WebCore::jsTestObjPrototypeFunctionConditionalOverload1):
+        (WebCore::jsTestObjPrototypeFunctionConditionalOverload2):
+        (WebCore::jsTestObjPrototypeFunctionConditionalOverload):
+        (WebCore::jsTestObjPrototypeFunctionSingleConditionalOverload1):
+        (WebCore::jsTestObjPrototypeFunctionSingleConditionalOverload2):
+        (WebCore::jsTestObjPrototypeFunctionSingleConditionalOverload):
+        (WebCore::jsTestObjPrototypeFunctionAttachShadowRoot):
+        (WebCore::jsTestObjPrototypeFunctionToString):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
+        (WebCore::constructJSTestOverloadedConstructors1):
+        (WebCore::constructJSTestOverloadedConstructors2):
+        (WebCore::constructJSTestOverloadedConstructors3):
+        (WebCore::constructJSTestOverloadedConstructors4):
+        (WebCore::constructJSTestOverloadedConstructors5):
+        (WebCore::JSTestOverloadedConstructorsConstructor::construct):
+        (WebCore::jsTestOverloadedConstructorsConstructor):
+        (WebCore::setJSTestOverloadedConstructorsConstructor):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:
+        (WebCore::constructJSTestOverloadedConstructorsWithSequence1):
+        (WebCore::constructJSTestOverloadedConstructorsWithSequence2):
+        (WebCore::JSTestOverloadedConstructorsWithSequenceConstructor::construct):
+        (WebCore::jsTestOverloadedConstructorsWithSequenceConstructor):
+        (WebCore::setJSTestOverloadedConstructorsWithSequenceConstructor):
+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
+        (WebCore::jsTestOverrideBuiltinsConstructor):
+        (WebCore::setJSTestOverrideBuiltinsConstructor):
+        (WebCore::jsTestOverrideBuiltinsPrototypeFunctionNamedItem):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::jsTestSerializedScriptValueInterfaceValue):
+        (WebCore::jsTestSerializedScriptValueInterfaceReadonlyValue):
+        (WebCore::jsTestSerializedScriptValueInterfaceCachedValue):
+        (WebCore::jsTestSerializedScriptValueInterfacePorts):
+        (WebCore::jsTestSerializedScriptValueInterfaceCachedReadonlyValue):
+        (WebCore::jsTestSerializedScriptValueInterfaceConstructor):
+        (WebCore::setJSTestSerializedScriptValueInterfaceConstructor):
+        (WebCore::setJSTestSerializedScriptValueInterfaceValue):
+        (WebCore::setJSTestSerializedScriptValueInterfaceCachedValue):
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::JSTestTypedefsConstructor::construct):
+        (WebCore::jsTestTypedefsUnsignedLongLongAttr):
+        (WebCore::jsTestTypedefsImmutableSerializedScriptValue):
+        (WebCore::jsTestTypedefsConstructorTestSubObj):
+        (WebCore::jsTestTypedefsAttrWithGetterException):
+        (WebCore::jsTestTypedefsAttrWithSetterException):
+        (WebCore::jsTestTypedefsStringAttrWithGetterException):
+        (WebCore::jsTestTypedefsStringAttrWithSetterException):
+        (WebCore::jsTestTypedefsConstructor):
+        (WebCore::setJSTestTypedefsConstructor):
+        (WebCore::setJSTestTypedefsUnsignedLongLongAttr):
+        (WebCore::setJSTestTypedefsImmutableSerializedScriptValue):
+        (WebCore::setJSTestTypedefsAttrWithGetterException):
+        (WebCore::setJSTestTypedefsAttrWithSetterException):
+        (WebCore::setJSTestTypedefsStringAttrWithGetterException):
+        (WebCore::setJSTestTypedefsStringAttrWithSetterException):
+        (WebCore::jsTestTypedefsPrototypeFunctionFunc):
+        (WebCore::jsTestTypedefsPrototypeFunctionSetShadow):
+        (WebCore::jsTestTypedefsPrototypeFunctionMethodWithSequenceArg):
+        (WebCore::jsTestTypedefsPrototypeFunctionNullableSequenceArg):
+        (WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):
+        (WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction):
+        (WebCore::jsTestTypedefsPrototypeFunctionStringSequenceFunction):
+        (WebCore::jsTestTypedefsPrototypeFunctionStringSequenceFunction2):
+        (WebCore::jsTestTypedefsPrototypeFunctionCallWithSequenceThatRequiresInclude):
+        (WebCore::jsTestTypedefsPrototypeFunctionMethodWithException):
+        * bindings/scripts/test/JS/JSattribute.cpp:
+        (WebCore::jsattributeReadonly):
+        (WebCore::jsattributeConstructor):
+        (WebCore::setJSattributeConstructor):
+        * bindings/scripts/test/JS/JSreadonly.cpp:
+        (WebCore::jsreadonlyConstructor):
+        (WebCore::setJSreadonlyConstructor):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::toJSPrimitive):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeMethod):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        (JSC::Bindings::ObjcArray::setValueAt):
+        (JSC::Bindings::ObjcArray::valueAt):
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/objc/objc_utility.h:
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::throwError):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter):
+        (JSC::RuntimeArray::put):
+        (JSC::RuntimeArray::putByIndex):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::lengthGetter):
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
+        (JSC::Bindings::RuntimeObject::fieldGetter):
+        (JSC::Bindings::RuntimeObject::methodGetter):
+        (JSC::Bindings::RuntimeObject::getOwnPropertySlot):
+        (JSC::Bindings::RuntimeObject::put):
+        (JSC::Bindings::RuntimeObject::defaultValue):
+        (JSC::Bindings::RuntimeObject::getOwnPropertyNames):
+        (JSC::Bindings::RuntimeObject::throwInvalidAccessError):
+        * bridge/runtime_object.h:
+
</ins><span class="cx"> 2016-08-30  Brent Fulgham  &lt;bfulgham@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Use of uninitialised memory in TransformationMatrx::blend4()
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSApplePaySessionCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSApplePaySessionCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSApplePaySessionCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSApplePaySessionCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -40,15 +40,18 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSApplePaySession::completeShippingMethodSelection(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = state.thisValue();
</span><span class="cx">     JSApplePaySession* castedThis = jsDynamicCast&lt;JSApplePaySession*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return JSValue::decode(throwThisTypeError(state, &quot;ApplePaySession&quot;, &quot;completeShippingMethodSelection&quot;));
</del><ins>+        return JSValue::decode(throwThisTypeError(state, scope, &quot;ApplePaySession&quot;, &quot;completeShippingMethodSelection&quot;));
</ins><span class="cx"> 
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSApplePaySession::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 3))
</span><del>-        return JSValue::decode(throwVMError(&amp;state, createNotEnoughArgumentsError(&amp;state)));
</del><ins>+        return JSValue::decode(throwVMError(&amp;state, scope, createNotEnoughArgumentsError(&amp;state)));
</ins><span class="cx"> 
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     uint16_t status = convert&lt;uint16_t&gt;(state, state.argument(0), NormalConversion);
</span><span class="lines">@@ -70,15 +73,18 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSApplePaySession::completeShippingContactSelection(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = state.thisValue();
</span><span class="cx">     JSApplePaySession* castedThis = jsDynamicCast&lt;JSApplePaySession*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return JSValue::decode(throwThisTypeError(state, &quot;ApplePaySession&quot;, &quot;completeShippingContactSelection&quot;));
</del><ins>+        return JSValue::decode(throwThisTypeError(state, scope, &quot;ApplePaySession&quot;, &quot;completeShippingContactSelection&quot;));
</ins><span class="cx"> 
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSApplePaySession::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 4))
</span><del>-        return JSValue::decode(throwVMError(&amp;state, createNotEnoughArgumentsError(&amp;state)));
</del><ins>+        return JSValue::decode(throwVMError(&amp;state, scope, createNotEnoughArgumentsError(&amp;state)));
</ins><span class="cx"> 
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     uint16_t status = convert&lt;uint16_t&gt;(state, state.argument(0), NormalConversion);
</span><span class="lines">@@ -104,15 +110,18 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSApplePaySession::completePaymentMethodSelection(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = state.thisValue();
</span><span class="cx">     JSApplePaySession* castedThis = jsDynamicCast&lt;JSApplePaySession*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return JSValue::decode(throwThisTypeError(state, &quot;ApplePaySession&quot;, &quot;completePaymentMethodSelection&quot;));
</del><ins>+        return JSValue::decode(throwThisTypeError(state, scope, &quot;ApplePaySession&quot;, &quot;completePaymentMethodSelection&quot;));
</ins><span class="cx"> 
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSApplePaySession::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 2))
</span><del>-        return JSValue::decode(throwVMError(&amp;state, createNotEnoughArgumentsError(&amp;state)));
</del><ins>+        return JSValue::decode(throwVMError(&amp;state, scope, createNotEnoughArgumentsError(&amp;state)));
</ins><span class="cx"> 
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     Dictionary newTotal = { &amp;state, state.argument(0) };
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSBlobCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSBlobCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSBlobCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSBlobCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2012 Google Inc. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions are
</span><span class="lines">@@ -63,12 +64,15 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL constructJSBlob(ExecState&amp; exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     DOMConstructorObject* jsConstructor = jsCast&lt;DOMConstructorObject*&gt;(exec.callee());
</span><span class="cx">     ASSERT(jsConstructor);
</span><span class="cx"> 
</span><span class="cx">     ScriptExecutionContext* context = jsConstructor-&gt;scriptExecutionContext();
</span><span class="cx">     if (!context)
</span><del>-        return throwConstructorScriptExecutionContextUnavailableError(exec, &quot;Blob&quot;);
</del><ins>+        return throwConstructorScriptExecutionContextUnavailableError(exec, scope, &quot;Blob&quot;);
</ins><span class="cx"> 
</span><span class="cx">     if (!exec.argumentCount()) {
</span><span class="cx">         return JSValue::encode(CREATE_DOM_WRAPPER(jsConstructor-&gt;globalObject(), Blob, Blob::create()));
</span><span class="lines">@@ -87,7 +91,7 @@
</span><span class="cx">         JSValue blobPropertyBagValue = exec.uncheckedArgument(1);
</span><span class="cx"> 
</span><span class="cx">         if (!blobPropertyBagValue.isObject())
</span><del>-            return throwVMTypeError(&amp;exec, &quot;Second argument of the constructor is not of type Object&quot;);
</del><ins>+            return throwVMTypeError(&amp;exec, scope, &quot;Second argument of the constructor is not of type Object&quot;);
</ins><span class="cx"> 
</span><span class="cx">         // Given the above test, this will always yield an object.
</span><span class="cx">         JSObject* blobPropertyBagObject = blobPropertyBagValue.toObject(&amp;exec);
</span><span class="lines">@@ -102,7 +106,7 @@
</span><span class="cx"> 
</span><span class="cx">         if (containsEndings) {
</span><span class="cx">             if (endings != &quot;transparent&quot; &amp;&amp; endings != &quot;native&quot;)
</span><del>-                return throwVMTypeError(&amp;exec, &quot;The endings property must be either \&quot;transparent\&quot; or \&quot;native\&quot;&quot;);
</del><ins>+                return throwVMTypeError(&amp;exec, scope, &quot;The endings property must be either \&quot;transparent\&quot; or \&quot;native\&quot;&quot;);
</ins><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         // Attempt to get the type property.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCSSStyleDeclarationCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2007-2009, 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -348,8 +348,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSCSSStyleDeclaration::getPropertyCSSValue(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     String propertyName = state.uncheckedArgument(0).toWTFString(&amp;state);
</span><span class="cx">     if (state.hadException())
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCryptoAlgorithmDictionarycpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoAlgorithmDictionary.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -54,6 +54,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSCryptoAlgorithmDictionary::getAlgorithmIdentifier(ExecState* exec, JSValue value, CryptoAlgorithmIdentifier&amp; algorithmIdentifier)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // typedef (Algorithm or DOMString) AlgorithmIdentifier;
</span><span class="cx"> 
</span><span class="cx">     String algorithmName;
</span><span class="lines">@@ -81,7 +84,7 @@
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     if (!algorithmName.containsOnlyASCII()) {
</span><del>-        throwSyntaxError(exec);
</del><ins>+        throwSyntaxError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -122,8 +125,11 @@
</span><span class="cx"> 
</span><span class="cx"> static RefPtr&lt;CryptoAlgorithmParameters&gt; createAesCbcParams(ExecState* exec, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwTypeError(exec);
</del><ins>+        throwTypeError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -140,7 +146,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (ivData.second != 16) {
</span><del>-        exec-&gt;vm().throwException(exec, createError(exec, &quot;AES-CBC initialization data must be 16 bytes&quot;));
</del><ins>+        throwException(exec, scope, createError(exec, &quot;AES-CBC initialization data must be 16 bytes&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -151,8 +157,11 @@
</span><span class="cx"> 
</span><span class="cx"> static RefPtr&lt;CryptoAlgorithmParameters&gt; createAesKeyGenParams(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -169,8 +178,11 @@
</span><span class="cx"> 
</span><span class="cx"> static RefPtr&lt;CryptoAlgorithmParameters&gt; createHmacParams(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -187,8 +199,11 @@
</span><span class="cx"> 
</span><span class="cx"> static RefPtr&lt;CryptoAlgorithmParameters&gt; createHmacKeyParams(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -209,8 +224,11 @@
</span><span class="cx"> 
</span><span class="cx"> static RefPtr&lt;CryptoAlgorithmParameters&gt; createRsaKeyGenParams(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -232,7 +250,7 @@
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;Uint8Array&gt; publicExponentArray = toUint8Array(publicExponentValue);
</span><span class="cx">     if (!publicExponentArray) {
</span><del>-        throwTypeError(&amp;state, &quot;Expected a Uint8Array in publicExponent&quot;);
</del><ins>+        throwTypeError(&amp;state, scope, &quot;Expected a Uint8Array in publicExponent&quot;);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     result-&gt;publicExponent.append(publicExponentArray-&gt;data(), publicExponentArray-&gt;byteLength());
</span><span class="lines">@@ -250,8 +268,11 @@
</span><span class="cx"> 
</span><span class="cx"> static RefPtr&lt;CryptoAlgorithmParameters&gt; createRsaOaepParams(ExecState* exec, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwTypeError(exec);
</del><ins>+        throwTypeError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -284,8 +305,11 @@
</span><span class="cx"> 
</span><span class="cx"> static RefPtr&lt;CryptoAlgorithmParameters&gt; createRsaSsaParams(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCryptoCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2012 Google Inc. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -37,13 +38,16 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSCrypto::getRandomValues(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 1)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     JSValue buffer = state.argument(0);
</span><span class="cx">     RefPtr&lt;ArrayBufferView&gt; arrayBufferView = toArrayBufferView(buffer);
</span><span class="cx">     if (!arrayBufferView)
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     wrapped().getRandomValues(arrayBufferView.get(), ec);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCryptoKeySerializationJWKcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoKeySerializationJWK.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoKeySerializationJWK.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoKeySerializationJWK.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -52,6 +52,9 @@
</span><span class="cx"> 
</span><span class="cx"> static bool getJSArrayFromJSON(ExecState* exec, JSObject* json, const char* key, JSArray*&amp; result)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Identifier identifier = Identifier::fromString(exec, key);
</span><span class="cx">     PropertySlot slot(json, PropertySlot::InternalMethodType::Get);
</span><span class="cx"> 
</span><span class="lines">@@ -61,7 +64,7 @@
</span><span class="cx">     JSValue value = slot.getValue(exec, identifier);
</span><span class="cx">     ASSERT(!exec-&gt;hadException());
</span><span class="cx">     if (!isJSArray(value)) {
</span><del>-        throwTypeError(exec, String::format(&quot;Expected an array for \&quot;%s\&quot; JSON key&quot;,  key));
</del><ins>+        throwTypeError(exec, scope, String::format(&quot;Expected an array for \&quot;%s\&quot; JSON key&quot;,  key));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -72,6 +75,9 @@
</span><span class="cx"> 
</span><span class="cx"> static bool getStringFromJSON(ExecState* exec, JSObject* json, const char* key, String&amp; result)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Identifier identifier = Identifier::fromString(exec, key);
</span><span class="cx">     PropertySlot slot(json, PropertySlot::InternalMethodType::Get);
</span><span class="cx"> 
</span><span class="lines">@@ -84,7 +90,7 @@
</span><span class="cx">         // Can get an out of memory exception.
</span><span class="cx">         if (exec-&gt;hadException())
</span><span class="cx">             return false;
</span><del>-        throwTypeError(exec, String::format(&quot;Expected a string value for \&quot;%s\&quot; JSON key&quot;,  key));
</del><ins>+        throwTypeError(exec, scope, String::format(&quot;Expected a string value for \&quot;%s\&quot; JSON key&quot;,  key));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -93,6 +99,9 @@
</span><span class="cx"> 
</span><span class="cx"> static bool getBooleanFromJSON(ExecState* exec, JSObject* json, const char* key, bool&amp; result)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Identifier identifier = Identifier::fromString(exec, key);
</span><span class="cx">     PropertySlot slot(json, PropertySlot::InternalMethodType::Get);
</span><span class="cx"> 
</span><span class="lines">@@ -102,7 +111,7 @@
</span><span class="cx">     JSValue jsValue = slot.getValue(exec, identifier);
</span><span class="cx">     ASSERT(!exec-&gt;hadException());
</span><span class="cx">     if (!jsValue.isBoolean()) {
</span><del>-        throwTypeError(exec, String::format(&quot;Expected a boolean value for \&quot;%s\&quot; JSON key&quot;,  key));
</del><ins>+        throwTypeError(exec, scope, String::format(&quot;Expected a boolean value for \&quot;%s\&quot; JSON key&quot;,  key));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -112,17 +121,20 @@
</span><span class="cx"> 
</span><span class="cx"> static bool getBigIntegerVectorFromJSON(ExecState* exec, JSObject* json, const char* key, Vector&lt;uint8_t&gt;&amp; result)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String base64urlEncodedNumber;
</span><span class="cx">     if (!getStringFromJSON(exec, json, key, base64urlEncodedNumber))
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     if (!base64URLDecode(base64urlEncodedNumber, result)) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Cannot decode base64url key data in JWK&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Cannot decode base64url key data in JWK&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (result[0] == 0) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;JWK BigInteger must utilize the minimum number of octets to represent the value&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;JWK BigInteger must utilize the minimum number of octets to represent the value&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -132,16 +144,19 @@
</span><span class="cx"> JSCryptoKeySerializationJWK::JSCryptoKeySerializationJWK(ExecState* exec, const String&amp; jsonString)
</span><span class="cx">     : m_exec(exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue jsonValue = JSONParse(exec, jsonString);
</span><span class="cx">     if (exec-&gt;hadException())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     if (!jsonValue || !jsonValue.isObject()) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Invalid JWK serialization&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Invalid JWK serialization&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    m_json.set(m_exec-&gt;vm(), asObject(jsonValue));
</del><ins>+    m_json.set(vm, asObject(jsonValue));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> JSCryptoKeySerializationJWK::~JSCryptoKeySerializationJWK()
</span><span class="lines">@@ -165,6 +180,9 @@
</span><span class="cx"> 
</span><span class="cx"> Optional&lt;CryptoAlgorithmPair&gt; JSCryptoKeySerializationJWK::reconcileAlgorithm(CryptoAlgorithm* suggestedAlgorithm, CryptoAlgorithmParameters* suggestedParameters) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = m_exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!getStringFromJSON(m_exec, m_json.get(), &quot;alg&quot;, m_jwkAlgorithmName)) {
</span><span class="cx">         // Algorithm is optional in JWK.
</span><span class="cx">         return CryptoAlgorithmPair { suggestedAlgorithm, suggestedParameters };
</span><span class="lines">@@ -216,7 +234,7 @@
</span><span class="cx">         algorithm = algorithmRegisty.create(CryptoAlgorithmIdentifier::AES_KW);
</span><span class="cx">         parameters = adoptRef(*new CryptoAlgorithmParameters);
</span><span class="cx">     } else {
</span><del>-        throwTypeError(m_exec, &quot;Unsupported JWK algorithm &quot; + m_jwkAlgorithmName);
</del><ins>+        throwTypeError(m_exec, scope, &quot;Unsupported JWK algorithm &quot; + m_jwkAlgorithmName);
</ins><span class="cx">         return Nullopt;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -254,9 +272,12 @@
</span><span class="cx"> 
</span><span class="cx"> static bool tryJWKKeyOpsValue(ExecState* exec, CryptoKeyUsage&amp; usages, const String&amp; operation, const String&amp; tryOperation, CryptoKeyUsage tryUsage)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (operation == tryOperation) {
</span><span class="cx">         if (usages &amp; tryUsage) {
</span><del>-            throwTypeError(exec, ASCIILiteral(&quot;JWK key_ops contains a duplicate operation&quot;));
</del><ins>+            throwTypeError(exec, scope, ASCIILiteral(&quot;JWK key_ops contains a duplicate operation&quot;));
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">         usages |= tryUsage;
</span><span class="lines">@@ -266,6 +287,9 @@
</span><span class="cx"> 
</span><span class="cx"> void JSCryptoKeySerializationJWK::reconcileUsages(CryptoKeyUsage&amp; suggestedUsages) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = m_exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     CryptoKeyUsage jwkUsages = 0;
</span><span class="cx"> 
</span><span class="cx">     JSArray* keyOps;
</span><span class="lines">@@ -275,7 +299,7 @@
</span><span class="cx">             String operation;
</span><span class="cx">             if (!jsValue.getString(m_exec, operation)) {
</span><span class="cx">                 if (!m_exec-&gt;hadException())
</span><del>-                    throwTypeError(m_exec, ASCIILiteral(&quot;JWK key_ops attribute could not be processed&quot;));
</del><ins>+                    throwTypeError(m_exec, scope, ASCIILiteral(&quot;JWK key_ops attribute could not be processed&quot;));
</ins><span class="cx">                 return;
</span><span class="cx">             }
</span><span class="cx">             if (!tryJWKKeyOpsValue(m_exec, jwkUsages, operation, ASCIILiteral(&quot;sign&quot;), CryptoKeyUsageSign))
</span><span class="lines">@@ -310,7 +334,7 @@
</span><span class="cx">         else if (jwkUseString == &quot;sig&quot;)
</span><span class="cx">             jwkUsages |= (CryptoKeyUsageSign | CryptoKeyUsageVerify);
</span><span class="cx">         else {
</span><del>-            throwTypeError(m_exec, &quot;Unsupported JWK key use value \&quot;&quot; + jwkUseString + &quot;\&quot;&quot;);
</del><ins>+            throwTypeError(m_exec, scope, &quot;Unsupported JWK key use value \&quot;&quot; + jwkUseString + &quot;\&quot;&quot;);
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -362,21 +386,24 @@
</span><span class="cx"> 
</span><span class="cx"> std::unique_ptr&lt;CryptoKeyData&gt; JSCryptoKeySerializationJWK::keyDataOctetSequence() const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = m_exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String keyBase64URL;
</span><span class="cx">     if (!getStringFromJSON(m_exec, m_json.get(), &quot;k&quot;, keyBase64URL)) {
</span><span class="cx">         if (!m_exec-&gt;hadException())
</span><del>-            throwTypeError(m_exec, ASCIILiteral(&quot;Secret key data is not present is JWK&quot;));
</del><ins>+            throwTypeError(m_exec, scope, ASCIILiteral(&quot;Secret key data is not present is JWK&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     Vector&lt;uint8_t&gt; octetSequence;
</span><span class="cx">     if (!base64URLDecode(keyBase64URL, octetSequence)) {
</span><del>-        throwTypeError(m_exec, ASCIILiteral(&quot;Cannot decode base64url key data in JWK&quot;));
</del><ins>+        throwTypeError(m_exec, scope, ASCIILiteral(&quot;Cannot decode base64url key data in JWK&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!keySizeIsValid(octetSequence.size() * 8)) {
</span><del>-        throwTypeError(m_exec, &quot;Key size is not valid for &quot; + m_jwkAlgorithmName);
</del><ins>+        throwTypeError(m_exec, scope, &quot;Key size is not valid for &quot; + m_jwkAlgorithmName);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -385,6 +412,9 @@
</span><span class="cx"> 
</span><span class="cx"> std::unique_ptr&lt;CryptoKeyData&gt; JSCryptoKeySerializationJWK::keyDataRSAComponents() const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = m_exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Vector&lt;uint8_t&gt; modulus;
</span><span class="cx">     Vector&lt;uint8_t&gt; exponent;
</span><span class="cx">     Vector&lt;uint8_t&gt; privateExponent;
</span><span class="lines">@@ -391,18 +421,18 @@
</span><span class="cx"> 
</span><span class="cx">     if (!getBigIntegerVectorFromJSON(m_exec, m_json.get(), &quot;n&quot;, modulus)) {
</span><span class="cx">         if (!m_exec-&gt;hadException())
</span><del>-            throwTypeError(m_exec, ASCIILiteral(&quot;Required JWK \&quot;n\&quot; member is missing&quot;));
</del><ins>+            throwTypeError(m_exec, scope, ASCIILiteral(&quot;Required JWK \&quot;n\&quot; member is missing&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!keySizeIsValid(modulus.size() * 8)) {
</span><del>-        throwTypeError(m_exec, &quot;Key size is not valid for &quot; + m_jwkAlgorithmName);
</del><ins>+        throwTypeError(m_exec, scope, &quot;Key size is not valid for &quot; + m_jwkAlgorithmName);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!getBigIntegerVectorFromJSON(m_exec, m_json.get(), &quot;e&quot;, exponent)) {
</span><span class="cx">         if (!m_exec-&gt;hadException())
</span><del>-            throwTypeError(m_exec, ASCIILiteral(&quot;Required JWK \&quot;e\&quot; member is missing&quot;));
</del><ins>+            throwTypeError(m_exec, scope, ASCIILiteral(&quot;Required JWK \&quot;e\&quot; member is missing&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -458,22 +488,22 @@
</span><span class="cx">         if (m_exec-&gt;hadException())
</span><span class="cx">             return nullptr;
</span><span class="cx">         if (!element.isObject()) {
</span><del>-            throwTypeError(m_exec, ASCIILiteral(&quot;JWK \&quot;oth\&quot; array member is not an object&quot;));
</del><ins>+            throwTypeError(m_exec, scope, ASCIILiteral(&quot;JWK \&quot;oth\&quot; array member is not an object&quot;));
</ins><span class="cx">             return nullptr;
</span><span class="cx">         }
</span><span class="cx">         if (!getBigIntegerVectorFromJSON(m_exec, asObject(element), &quot;r&quot;, info.primeFactor)) {
</span><span class="cx">             if (!m_exec-&gt;hadException())
</span><del>-                throwTypeError(m_exec, ASCIILiteral(&quot;Cannot get prime factor for a prime in \&quot;oth\&quot; dictionary&quot;));
</del><ins>+                throwTypeError(m_exec, scope, ASCIILiteral(&quot;Cannot get prime factor for a prime in \&quot;oth\&quot; dictionary&quot;));
</ins><span class="cx">             return nullptr;
</span><span class="cx">         }
</span><span class="cx">         if (!getBigIntegerVectorFromJSON(m_exec, asObject(element), &quot;d&quot;, info.factorCRTExponent)) {
</span><span class="cx">             if (!m_exec-&gt;hadException())
</span><del>-                throwTypeError(m_exec, ASCIILiteral(&quot;Cannot get factor CRT exponent for a prime in \&quot;oth\&quot; dictionary&quot;));
</del><ins>+                throwTypeError(m_exec, scope, ASCIILiteral(&quot;Cannot get factor CRT exponent for a prime in \&quot;oth\&quot; dictionary&quot;));
</ins><span class="cx">             return nullptr;
</span><span class="cx">         }
</span><span class="cx">         if (!getBigIntegerVectorFromJSON(m_exec, asObject(element), &quot;t&quot;, info.factorCRTCoefficient)) {
</span><span class="cx">             if (!m_exec-&gt;hadException())
</span><del>-                throwTypeError(m_exec, ASCIILiteral(&quot;Cannot get factor CRT coefficient for a prime in \&quot;oth\&quot; dictionary&quot;));
</del><ins>+                throwTypeError(m_exec, scope, ASCIILiteral(&quot;Cannot get factor CRT coefficient for a prime in \&quot;oth\&quot; dictionary&quot;));
</ins><span class="cx">             return nullptr;
</span><span class="cx">         }
</span><span class="cx">         otherPrimeInfos.append(info);
</span><span class="lines">@@ -484,10 +514,13 @@
</span><span class="cx"> 
</span><span class="cx"> std::unique_ptr&lt;CryptoKeyData&gt; JSCryptoKeySerializationJWK::keyData() const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = m_exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String jwkKeyType;
</span><span class="cx">     if (!getStringFromJSON(m_exec, m_json.get(), &quot;kty&quot;, jwkKeyType)) {
</span><span class="cx">         if (!m_exec-&gt;hadException())
</span><del>-            throwTypeError(m_exec, ASCIILiteral(&quot;Required JWK \&quot;kty\&quot; member is missing&quot;));
</del><ins>+            throwTypeError(m_exec, scope, ASCIILiteral(&quot;Required JWK \&quot;kty\&quot; member is missing&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -497,7 +530,7 @@
</span><span class="cx">     if (jwkKeyType == &quot;RSA&quot;)
</span><span class="cx">         return keyDataRSAComponents();
</span><span class="cx"> 
</span><del>-    throwTypeError(m_exec, &quot;Unsupported JWK key type &quot; + jwkKeyType);
</del><ins>+    throwTypeError(m_exec, scope, &quot;Unsupported JWK key type &quot; + jwkKeyType);
</ins><span class="cx">     return nullptr;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -560,6 +593,9 @@
</span><span class="cx"> 
</span><span class="cx"> static void addJWKAlgorithmToJSON(ExecState* exec, JSObject* json, const CryptoKey&amp; key)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String jwkAlgorithm;
</span><span class="cx">     switch (key.algorithmIdentifier()) {
</span><span class="cx">     case CryptoAlgorithmIdentifier::HMAC:
</span><span class="lines">@@ -652,7 +688,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (jwkAlgorithm.isNull()) {
</span><span class="cx">         // The spec doesn't currently tell whether export should fail, or just skip &quot;alg&quot; (which is an optional key in JWK).
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Key algorithm and size do not map to any JWK algorithm identifier&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Key algorithm and size do not map to any JWK algorithm identifier&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -689,10 +725,13 @@
</span><span class="cx"> 
</span><span class="cx"> String JSCryptoKeySerializationJWK::serialize(ExecState* exec, const CryptoKey&amp; key)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     std::unique_ptr&lt;CryptoKeyData&gt; keyData = key.exportData();
</span><span class="cx">     if (!keyData) {
</span><span class="cx">         // This generally shouldn't happen as long as all key types implement exportData(), but as underlying libraries return errors, there may be some rare failure conditions.
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Couldn't export key material&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Couldn't export key material&quot;));
</ins><span class="cx">         return String();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -713,7 +752,7 @@
</span><span class="cx">     else if (is&lt;CryptoKeyDataRSAComponents&gt;(*keyData))
</span><span class="cx">         buildJSONForRSAComponents(exec, downcast&lt;CryptoKeyDataRSAComponents&gt;(*keyData), result);
</span><span class="cx">     else {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Key doesn't support exportKey&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Key doesn't support exportKey&quot;));
</ins><span class="cx">         return String();
</span><span class="cx">     }
</span><span class="cx">     if (exec-&gt;hadException())
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCryptoOperationDatacpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoOperationData.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoOperationData.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCryptoOperationData.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -36,12 +36,15 @@
</span><span class="cx"> 
</span><span class="cx"> bool cryptoOperationDataFromJSValue(ExecState* exec, JSValue value, CryptoOperationData&amp; result)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (ArrayBuffer* buffer = toArrayBuffer(value))
</span><span class="cx">         result = std::make_pair(static_cast&lt;uint8_t*&gt;(buffer-&gt;data()), buffer-&gt;byteLength());
</span><span class="cx">     else if (RefPtr&lt;ArrayBufferView&gt; bufferView = toArrayBufferView(value))
</span><span class="cx">         result = std::make_pair(static_cast&lt;uint8_t*&gt;(bufferView-&gt;baseAddress()), bufferView-&gt;byteLength());
</span><span class="cx">     else {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Only ArrayBuffer and ArrayBufferView objects can be passed as CryptoOperationData&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Only ArrayBuffer and ArrayBufferView objects can be passed as CryptoOperationData&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     return true;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCustomElementInterfacecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCustomElementInterface.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCustomElementInterface.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCustomElementInterface.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2013 Google Inc. All rights reserved.
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -109,7 +109,9 @@
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     Ref&lt;JSCustomElementInterface&gt; protectedThis(*this);
</span><del>-    JSLockHolder lock(m_isolatedWorld-&gt;vm());
</del><ins>+    VM&amp; vm = m_isolatedWorld-&gt;vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     if (!m_constructor)
</span><span class="cx">         return;
</span><span class="lines">@@ -144,7 +146,7 @@
</span><span class="cx"> 
</span><span class="cx">     Element* wrappedElement = JSElement::toWrapped(returnedElement);
</span><span class="cx">     if (!wrappedElement || wrappedElement != &amp;element) {
</span><del>-        throwInvalidStateError(*state, &quot;Custom element constructor failed to upgrade an element&quot;);
</del><ins>+        throwInvalidStateError(*state, scope, &quot;Custom element constructor failed to upgrade an element&quot;);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     wrappedElement-&gt;setCustomElementIsResolved(*this);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSCustomElementRegistryCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCustomElementRegistryCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCustomElementRegistryCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSCustomElementRegistryCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -41,6 +41,9 @@
</span><span class="cx"> 
</span><span class="cx"> static JSObject* getCustomElementCallback(ExecState&amp; state, JSObject&amp; prototype, const Identifier&amp; id)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue callback = prototype.get(&amp;state, id);
</span><span class="cx">     if (state.hadException())
</span><span class="cx">         return nullptr;
</span><span class="lines">@@ -47,7 +50,7 @@
</span><span class="cx">     if (callback.isUndefined())
</span><span class="cx">         return nullptr;
</span><span class="cx">     if (!callback.isFunction()) {
</span><del>-        throwTypeError(&amp;state, ASCIILiteral(&quot;A custom element callback must be a function&quot;));
</del><ins>+        throwTypeError(&amp;state, scope, ASCIILiteral(&quot;A custom element callback must be a function&quot;));
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx">     return callback.getObject();
</span><span class="lines">@@ -56,8 +59,11 @@
</span><span class="cx"> // https://html.spec.whatwg.org/#dom-customelementregistry-define
</span><span class="cx"> JSValue JSCustomElementRegistry::define(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 2))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     AtomicString localName(state.uncheckedArgument(0).toString(&amp;state)-&gt;toAtomicString(&amp;state));
</span><span class="cx">     if (UNLIKELY(state.hadException()))
</span><span class="lines">@@ -65,7 +71,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue constructorValue = state.uncheckedArgument(1);
</span><span class="cx">     if (!constructorValue.isConstructor())
</span><del>-        return throwTypeError(&amp;state, ASCIILiteral(&quot;The second argument must be a constructor&quot;));
</del><ins>+        return throwTypeError(&amp;state, scope, ASCIILiteral(&quot;The second argument must be a constructor&quot;));
</ins><span class="cx">     JSObject* constructor = constructorValue.getObject();
</span><span class="cx"> 
</span><span class="cx">     // FIXME: Throw a TypeError if constructor doesn't inherit from HTMLElement.
</span><span class="lines">@@ -75,11 +81,11 @@
</span><span class="cx">     case CustomElementNameValidationStatus::Valid:
</span><span class="cx">         break;
</span><span class="cx">     case CustomElementNameValidationStatus::ConflictsWithBuiltinNames:
</span><del>-        return throwSyntaxError(&amp;state, ASCIILiteral(&quot;Custom element name cannot be same as one of the builtin elements&quot;));
</del><ins>+        return throwSyntaxError(&amp;state, scope, ASCIILiteral(&quot;Custom element name cannot be same as one of the builtin elements&quot;));
</ins><span class="cx">     case CustomElementNameValidationStatus::NoHyphen:
</span><del>-        return throwSyntaxError(&amp;state, ASCIILiteral(&quot;Custom element name must contain a hyphen&quot;));
</del><ins>+        return throwSyntaxError(&amp;state, scope, ASCIILiteral(&quot;Custom element name must contain a hyphen&quot;));
</ins><span class="cx">     case CustomElementNameValidationStatus::ContainsUpperCase:
</span><del>-        return throwSyntaxError(&amp;state, ASCIILiteral(&quot;Custom element name cannot contain an upper case letter&quot;));
</del><ins>+        return throwSyntaxError(&amp;state, scope, ASCIILiteral(&quot;Custom element name cannot contain an upper case letter&quot;));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // FIXME: Check re-entrancy here.
</span><span class="lines">@@ -87,21 +93,20 @@
</span><span class="cx"> 
</span><span class="cx">     CustomElementRegistry&amp; registry = wrapped();
</span><span class="cx">     if (registry.findInterface(localName)) {
</span><del>-        throwNotSupportedError(state, ASCIILiteral(&quot;Cannot define multiple custom elements with the same tag name&quot;));
</del><ins>+        throwNotSupportedError(state, scope, ASCIILiteral(&quot;Cannot define multiple custom elements with the same tag name&quot;));
</ins><span class="cx">         return jsUndefined();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (registry.containsConstructor(constructor)) {
</span><del>-        throwNotSupportedError(state, ASCIILiteral(&quot;Cannot define multiple custom elements with the same class&quot;));
</del><ins>+        throwNotSupportedError(state, scope, ASCIILiteral(&quot;Cannot define multiple custom elements with the same class&quot;));
</ins><span class="cx">         return jsUndefined();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    auto&amp; vm = globalObject()-&gt;vm();
</del><span class="cx">     JSValue prototypeValue = constructor-&gt;get(&amp;state, vm.propertyNames-&gt;prototype);
</span><span class="cx">     if (state.hadException())
</span><span class="cx">         return jsUndefined();
</span><span class="cx">     if (!prototypeValue.isObject())
</span><del>-        return throwTypeError(&amp;state, ASCIILiteral(&quot;Custom element constructor's prototype must be an object&quot;));
</del><ins>+        return throwTypeError(&amp;state, scope, ASCIILiteral(&quot;Custom element constructor's prototype must be an object&quot;));
</ins><span class="cx">     JSObject&amp; prototypeObject = *asObject(prototypeValue);
</span><span class="cx"> 
</span><span class="cx">     QualifiedName name(nullAtom, localName, HTMLNames::xhtmlNamespaceURI);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMBindingcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMBinding.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMBinding.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMBinding.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -338,18 +338,24 @@
</span><span class="cx"> 
</span><span class="cx"> void setDOMException(ExecState* exec, ExceptionCode ec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!ec || exec-&gt;hadException())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    exec-&gt;vm().throwException(exec, createDOMException(exec, ec));
</del><ins>+    throwException(exec, scope, createDOMException(exec, ec));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void setDOMException(JSC::ExecState* exec, const ExceptionCodeWithMessage&amp; ec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!ec.code || exec-&gt;hadException())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    exec-&gt;vm().throwException(exec, createDOMException(exec, ec.code, ec.message));
</del><ins>+    throwException(exec, scope, createDOMException(exec, ec.code, ec.message));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> #undef TRY_TO_CREATE_EXCEPTION
</span><span class="lines">@@ -430,13 +436,16 @@
</span><span class="cx"> 
</span><span class="cx"> static double enforceRange(ExecState&amp; state, double x, double minimum, double maximum)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (std::isnan(x) || std::isinf(x)) {
</span><del>-        throwTypeError(&amp;state, rangeErrorString(x, minimum, maximum));
</del><ins>+        throwTypeError(&amp;state, scope, rangeErrorString(x, minimum, maximum));
</ins><span class="cx">         return 0;
</span><span class="cx">     }
</span><span class="cx">     x = trunc(x);
</span><span class="cx">     if (x &lt; minimum || x &gt; maximum) {
</span><del>-        throwTypeError(&amp;state, rangeErrorString(x, minimum, maximum));
</del><ins>+        throwTypeError(&amp;state, scope, rangeErrorString(x, minimum, maximum));
</ins><span class="cx">         return 0;
</span><span class="cx">     }
</span><span class="cx">     return x;
</span><span class="lines">@@ -475,6 +484,9 @@
</span><span class="cx"> template &lt;typename T&gt;
</span><span class="cx"> static inline T toSmallerInt(ExecState&amp; state, JSValue value, IntegerConversionConfiguration configuration)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     static_assert(std::is_signed&lt;T&gt;::value &amp;&amp; std::is_integral&lt;T&gt;::value, &quot;Should only be used for signed integral types&quot;);
</span><span class="cx"> 
</span><span class="cx">     typedef IntTypeLimits&lt;T&gt; LimitsTrait;
</span><span class="lines">@@ -487,7 +499,7 @@
</span><span class="cx">         case NormalConversion:
</span><span class="cx">             break;
</span><span class="cx">         case EnforceRange:
</span><del>-            throwTypeError(&amp;state);
</del><ins>+            throwTypeError(&amp;state, scope);
</ins><span class="cx">             return 0;
</span><span class="cx">         case Clamp:
</span><span class="cx">             return d &lt; LimitsTrait::minValue ? LimitsTrait::minValue : LimitsTrait::maxValue;
</span><span class="lines">@@ -521,6 +533,9 @@
</span><span class="cx"> template &lt;typename T&gt;
</span><span class="cx"> static inline T toSmallerUInt(ExecState&amp; state, JSValue value, IntegerConversionConfiguration configuration)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     static_assert(std::is_unsigned&lt;T&gt;::value &amp;&amp; std::is_integral&lt;T&gt;::value, &quot;Should only be used for unsigned integral types&quot;);
</span><span class="cx"> 
</span><span class="cx">     typedef IntTypeLimits&lt;T&gt; LimitsTrait;
</span><span class="lines">@@ -533,7 +548,7 @@
</span><span class="cx">         case NormalConversion:
</span><span class="cx">             return static_cast&lt;T&gt;(d);
</span><span class="cx">         case EnforceRange:
</span><del>-            throwTypeError(&amp;state);
</del><ins>+            throwTypeError(&amp;state, scope);
</ins><span class="cx">             return 0;
</span><span class="cx">         case Clamp:
</span><span class="cx">             return LimitsTrait::maxValue;
</span><span class="lines">@@ -762,6 +777,9 @@
</span><span class="cx"> 
</span><span class="cx"> static inline bool canAccessDocument(JSC::ExecState* state, Document* targetDocument, SecurityReportingOption reportingOption)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!targetDocument)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="lines">@@ -772,7 +790,7 @@
</span><span class="cx"> 
</span><span class="cx">     switch (reportingOption) {
</span><span class="cx">     case ThrowSecurityError:
</span><del>-        throwSecurityError(*state, targetDocument-&gt;domWindow()-&gt;crossDomainAccessErrorMessage(active));
</del><ins>+        throwSecurityError(*state, scope, targetDocument-&gt;domWindow()-&gt;crossDomainAccessErrorMessage(active));
</ins><span class="cx">         break;
</span><span class="cx">     case LogSecurityError:
</span><span class="cx">         printErrorMessageForFrame(targetDocument-&gt;frame(), targetDocument-&gt;domWindow()-&gt;crossDomainAccessErrorMessage(active));
</span><span class="lines">@@ -799,9 +817,9 @@
</span><span class="cx">     return target &amp;&amp; canAccessDocument(state, &amp;target-&gt;document(), LogSecurityError);
</span><span class="cx"> }
</span><span class="cx">     
</span><del>-static EncodedJSValue throwTypeError(JSC::ExecState&amp; state, const String&amp; errorMessage)
</del><ins>+static EncodedJSValue throwTypeError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, const String&amp; errorMessage)
</ins><span class="cx"> {
</span><del>-    return throwVMTypeError(&amp;state, errorMessage);
</del><ins>+    return throwVMTypeError(&amp;state, scope, errorMessage);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static void appendArgumentMustBe(StringBuilder&amp; builder, unsigned argumentIndex, const char* argumentName, const char* interfaceName, const char* functionName)
</span><span class="lines">@@ -836,75 +854,75 @@
</span><span class="cx">     context.addConsoleMessage(MessageSource::JS, MessageLevel::Error, makeString(&quot;Deprecated attempt to set property '&quot;, attributeName, &quot;' on a non-&quot;, interfaceName, &quot; object.&quot;));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-void throwNotSupportedError(JSC::ExecState&amp; state, const char* message)
</del><ins>+void throwNotSupportedError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, const char* message)
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(!state.hadException());
</span><span class="cx">     String messageString(message);
</span><del>-    state.vm().throwException(&amp;state, createDOMException(&amp;state, NOT_SUPPORTED_ERR, &amp;messageString));
</del><ins>+    throwException(&amp;state, scope, createDOMException(&amp;state, NOT_SUPPORTED_ERR, &amp;messageString));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void throwInvalidStateError(JSC::ExecState&amp; state, const char* message)
</del><ins>+void throwInvalidStateError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, const char* message)
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(!state.hadException());
</span><span class="cx">     String messageString(message);
</span><del>-    state.vm().throwException(&amp;state, createDOMException(&amp;state, INVALID_STATE_ERR, &amp;messageString));
</del><ins>+    throwException(&amp;state, scope, createDOMException(&amp;state, INVALID_STATE_ERR, &amp;messageString));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void throwSecurityError(JSC::ExecState&amp; state, const String&amp; message)
</del><ins>+void throwSecurityError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, const String&amp; message)
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(!state.hadException());
</span><del>-    state.vm().throwException(&amp;state, createDOMException(&amp;state, SECURITY_ERR, message));
</del><ins>+    throwException(&amp;state, scope, createDOMException(&amp;state, SECURITY_ERR, message));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSC::EncodedJSValue throwArgumentMustBeEnumError(JSC::ExecState&amp; state, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName, const char* expectedValues)
</del><ins>+JSC::EncodedJSValue throwArgumentMustBeEnumError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName, const char* expectedValues)
</ins><span class="cx"> {
</span><span class="cx">     StringBuilder builder;
</span><span class="cx">     appendArgumentMustBe(builder, argumentIndex, argumentName, functionInterfaceName, functionName);
</span><span class="cx">     builder.appendLiteral(&quot;one of: &quot;);
</span><span class="cx">     builder.append(expectedValues);
</span><del>-    return throwVMTypeError(&amp;state, builder.toString());
</del><ins>+    return throwVMTypeError(&amp;state, scope, builder.toString());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSC::EncodedJSValue throwArgumentMustBeFunctionError(JSC::ExecState&amp; state, unsigned argumentIndex, const char* argumentName, const char* interfaceName, const char* functionName)
</del><ins>+JSC::EncodedJSValue throwArgumentMustBeFunctionError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, unsigned argumentIndex, const char* argumentName, const char* interfaceName, const char* functionName)
</ins><span class="cx"> {
</span><span class="cx">     StringBuilder builder;
</span><span class="cx">     appendArgumentMustBe(builder, argumentIndex, argumentName, interfaceName, functionName);
</span><span class="cx">     builder.appendLiteral(&quot;a function&quot;);
</span><del>-    return throwVMTypeError(&amp;state, builder.toString());
</del><ins>+    return throwVMTypeError(&amp;state, scope, builder.toString());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSC::EncodedJSValue throwArgumentTypeError(JSC::ExecState&amp; state, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName, const char* expectedType)
</del><ins>+JSC::EncodedJSValue throwArgumentTypeError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName, const char* expectedType)
</ins><span class="cx"> {
</span><span class="cx">     StringBuilder builder;
</span><span class="cx">     appendArgumentMustBe(builder, argumentIndex, argumentName, functionInterfaceName, functionName);
</span><span class="cx">     builder.appendLiteral(&quot;an instance of &quot;);
</span><span class="cx">     builder.append(expectedType);
</span><del>-    return throwVMTypeError(&amp;state, builder.toString());
</del><ins>+    return throwVMTypeError(&amp;state, scope, builder.toString());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void throwArrayElementTypeError(JSC::ExecState&amp; state)
</del><ins>+void throwArrayElementTypeError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope)
</ins><span class="cx"> {
</span><del>-    throwTypeError(state, ASCIILiteral(&quot;Invalid Array element type&quot;));
</del><ins>+    throwTypeError(state, scope, ASCIILiteral(&quot;Invalid Array element type&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void throwAttributeTypeError(JSC::ExecState&amp; state, const char* interfaceName, const char* attributeName, const char* expectedType)
</del><ins>+void throwAttributeTypeError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, const char* interfaceName, const char* attributeName, const char* expectedType)
</ins><span class="cx"> {
</span><del>-    throwTypeError(state, makeString(&quot;The &quot;, interfaceName, '.', attributeName, &quot; attribute must be an instance of &quot;, expectedType));
</del><ins>+    throwTypeError(state, scope, makeString(&quot;The &quot;, interfaceName, '.', attributeName, &quot; attribute must be an instance of &quot;, expectedType));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSC::EncodedJSValue throwConstructorScriptExecutionContextUnavailableError(JSC::ExecState&amp; state, const char* interfaceName)
</del><ins>+JSC::EncodedJSValue throwConstructorScriptExecutionContextUnavailableError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, const char* interfaceName)
</ins><span class="cx"> {
</span><del>-    return throwVMError(&amp;state, createReferenceError(&amp;state, makeString(interfaceName, &quot; constructor associated execution context is unavailable&quot;)));
</del><ins>+    return throwVMError(&amp;state, scope, createReferenceError(&amp;state, makeString(interfaceName, &quot; constructor associated execution context is unavailable&quot;)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void throwSequenceTypeError(JSC::ExecState&amp; state)
</del><ins>+void throwSequenceTypeError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope)
</ins><span class="cx"> {
</span><del>-    throwTypeError(state, ASCIILiteral(&quot;Value is not a sequence&quot;));
</del><ins>+    throwTypeError(state, scope, ASCIILiteral(&quot;Value is not a sequence&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-void throwNonFiniteTypeError(ExecState&amp; state)
</del><ins>+void throwNonFiniteTypeError(ExecState&amp; state, JSC::ThrowScope&amp; scope)
</ins><span class="cx"> {
</span><del>-    throwTypeError(&amp;state, ASCIILiteral(&quot;The provided value is non-finite&quot;));
</del><ins>+    throwTypeError(&amp;state, scope, ASCIILiteral(&quot;The provided value is non-finite&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> String makeGetterTypeErrorMessage(const char* interfaceName, const char* attributeName)
</span><span class="lines">@@ -912,14 +930,14 @@
</span><span class="cx">     return makeString(&quot;The &quot;, interfaceName, '.', attributeName, &quot; getter can only be used on instances of &quot;, interfaceName);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSC::EncodedJSValue throwGetterTypeError(JSC::ExecState&amp; state, const char* interfaceName, const char* attributeName)
</del><ins>+JSC::EncodedJSValue throwGetterTypeError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, const char* interfaceName, const char* attributeName)
</ins><span class="cx"> {
</span><del>-    return throwVMTypeError(&amp;state, makeGetterTypeErrorMessage(interfaceName, attributeName));
</del><ins>+    return throwVMTypeError(&amp;state, scope, makeGetterTypeErrorMessage(interfaceName, attributeName));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool throwSetterTypeError(JSC::ExecState&amp; state, const char* interfaceName, const char* attributeName)
</del><ins>+bool throwSetterTypeError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, const char* interfaceName, const char* attributeName)
</ins><span class="cx"> {
</span><del>-    throwTypeError(state, makeString(&quot;The &quot;, interfaceName, '.', attributeName, &quot; setter can only be used on instances of &quot;, interfaceName));
</del><ins>+    throwTypeError(state, scope, makeString(&quot;The &quot;, interfaceName, '.', attributeName, &quot; setter can only be used on instances of &quot;, interfaceName));
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -928,9 +946,9 @@
</span><span class="cx">     return makeString(&quot;Can only call &quot;, interfaceName, '.', functionName, &quot; on instances of &quot;, interfaceName);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-EncodedJSValue throwThisTypeError(JSC::ExecState&amp; state, const char* interfaceName, const char* functionName)
</del><ins>+EncodedJSValue throwThisTypeError(JSC::ExecState&amp; state, JSC::ThrowScope&amp; scope, const char* interfaceName, const char* functionName)
</ins><span class="cx"> {
</span><del>-    return throwTypeError(state, makeThisTypeErrorMessage(interfaceName, functionName));
</del><ins>+    return throwTypeError(state, scope, makeThisTypeErrorMessage(interfaceName, functionName));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void callFunctionWithCurrentArguments(JSC::ExecState&amp; state, JSC::JSObject&amp; thisObject, JSC::JSFunction&amp; function)
</span><span class="lines">@@ -955,7 +973,9 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callThrowTypeError(ExecState* exec)
</span><span class="cx"> {
</span><del>-    throwTypeError(exec, ASCIILiteral(&quot;Constructor requires 'new' operator&quot;));
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    throwTypeError(exec, scope, ASCIILiteral(&quot;Constructor requires 'new' operator&quot;));
</ins><span class="cx">     return JSValue::encode(jsNull());
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMBindingh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMBinding.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMBinding.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMBinding.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -113,25 +113,25 @@
</span><span class="cx"> WEBCORE_EXPORT JSC::EncodedJSValue reportDeprecatedGetterError(JSC::ExecState&amp;, const char* interfaceName, const char* attributeName);
</span><span class="cx"> WEBCORE_EXPORT void reportDeprecatedSetterError(JSC::ExecState&amp;, const char* interfaceName, const char* attributeName);
</span><span class="cx"> 
</span><del>-void throwNotSupportedError(JSC::ExecState&amp;, const char* message);
-void throwInvalidStateError(JSC::ExecState&amp;, const char* message);
-void throwArrayElementTypeError(JSC::ExecState&amp;);
-void throwAttributeTypeError(JSC::ExecState&amp;, const char* interfaceName, const char* attributeName, const char* expectedType);
-WEBCORE_EXPORT void throwSequenceTypeError(JSC::ExecState&amp;);
-WEBCORE_EXPORT bool throwSetterTypeError(JSC::ExecState&amp;, const char* interfaceName, const char* attributeName);
-WEBCORE_EXPORT void throwNonFiniteTypeError(JSC::ExecState&amp;);
-void throwSecurityError(JSC::ExecState&amp;, const String&amp; message);
</del><ins>+void throwNotSupportedError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, const char* message);
+void throwInvalidStateError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, const char* message);
+void throwArrayElementTypeError(JSC::ExecState&amp;, JSC::ThrowScope&amp;);
+void throwAttributeTypeError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, const char* interfaceName, const char* attributeName, const char* expectedType);
+WEBCORE_EXPORT void throwSequenceTypeError(JSC::ExecState&amp;, JSC::ThrowScope&amp;);
+WEBCORE_EXPORT bool throwSetterTypeError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, const char* interfaceName, const char* attributeName);
+WEBCORE_EXPORT void throwNonFiniteTypeError(JSC::ExecState&amp;, JSC::ThrowScope&amp;);
+void throwSecurityError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, const String&amp; message);
</ins><span class="cx"> 
</span><del>-WEBCORE_EXPORT JSC::EncodedJSValue throwArgumentMustBeEnumError(JSC::ExecState&amp;, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName, const char* expectedValues);
-JSC::EncodedJSValue throwArgumentMustBeFunctionError(JSC::ExecState&amp;, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName);
-WEBCORE_EXPORT JSC::EncodedJSValue throwArgumentTypeError(JSC::ExecState&amp;, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName, const char* expectedType);
-JSC::EncodedJSValue throwConstructorScriptExecutionContextUnavailableError(JSC::ExecState&amp;, const char* interfaceName);
</del><ins>+WEBCORE_EXPORT JSC::EncodedJSValue throwArgumentMustBeEnumError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName, const char* expectedValues);
+JSC::EncodedJSValue throwArgumentMustBeFunctionError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName);
+WEBCORE_EXPORT JSC::EncodedJSValue throwArgumentTypeError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, unsigned argumentIndex, const char* argumentName, const char* functionInterfaceName, const char* functionName, const char* expectedType);
+JSC::EncodedJSValue throwConstructorScriptExecutionContextUnavailableError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, const char* interfaceName);
</ins><span class="cx"> 
</span><span class="cx"> String makeGetterTypeErrorMessage(const char* interfaceName, const char* attributeName);
</span><span class="cx"> String makeThisTypeErrorMessage(const char* interfaceName, const char* attributeName);
</span><span class="cx"> 
</span><del>-WEBCORE_EXPORT JSC::EncodedJSValue throwGetterTypeError(JSC::ExecState&amp;, const char* interfaceName, const char* attributeName);
-WEBCORE_EXPORT JSC::EncodedJSValue throwThisTypeError(JSC::ExecState&amp;, const char* interfaceName, const char* functionName);
</del><ins>+WEBCORE_EXPORT JSC::EncodedJSValue throwGetterTypeError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, const char* interfaceName, const char* attributeName);
+WEBCORE_EXPORT JSC::EncodedJSValue throwThisTypeError(JSC::ExecState&amp;, JSC::ThrowScope&amp;, const char* interfaceName, const char* functionName);
</ins><span class="cx"> 
</span><span class="cx"> WEBCORE_EXPORT JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject&amp;, const JSC::ClassInfo*);
</span><span class="cx"> WEBCORE_EXPORT JSC::Structure* cacheDOMStructure(JSDOMGlobalObject&amp;, JSC::Structure*, const JSC::ClassInfo*);
</span><span class="lines">@@ -490,9 +490,12 @@
</span><span class="cx"> // Validates that the passed object is a sequence type per section 4.1.13 of the WebIDL spec.
</span><span class="cx"> inline JSC::JSObject* toJSSequence(JSC::ExecState&amp; exec, JSC::JSValue value, unsigned&amp; length)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSC::JSObject* object = value.getObject();
</span><span class="cx">     if (!object) {
</span><del>-        throwSequenceTypeError(exec);
</del><ins>+        throwSequenceTypeError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -501,7 +504,7 @@
</span><span class="cx">         return nullptr;
</span><span class="cx"> 
</span><span class="cx">     if (lengthValue.isUndefinedOrNull()) {
</span><del>-        throwSequenceTypeError(exec);
</del><ins>+        throwSequenceTypeError(exec, scope);
</ins><span class="cx">         return nullptr;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -718,17 +721,22 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename T, typename JST&gt; Vector&lt;RefPtr&lt;T&gt;&gt; toRefPtrNativeArray(JSC::ExecState&amp; exec, JSC::JSValue value)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwSequenceTypeError(exec);
</del><ins>+        throwSequenceTypeError(exec, scope);
</ins><span class="cx">         return Vector&lt;RefPtr&lt;T&gt;&gt;();
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     Vector&lt;RefPtr&lt;T&gt;&gt; result;
</span><del>-    forEachInIterable(&amp;exec, value, [&amp;result](JSC::VM&amp;, JSC::ExecState* state, JSC::JSValue jsValue) {
</del><ins>+    forEachInIterable(&amp;exec, value, [&amp;result](JSC::VM&amp; vm, JSC::ExecState* state, JSC::JSValue jsValue) {
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">         if (jsValue.inherits(JST::info()))
</span><span class="cx">             result.append(JST::toWrapped(jsValue));
</span><span class="cx">         else
</span><del>-            throwArrayElementTypeError(*state);
</del><ins>+            throwArrayElementTypeError(*state, scope);
</ins><span class="cx">     });
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="lines">@@ -735,8 +743,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename T&gt; Vector&lt;T&gt; toNativeArray(JSC::ExecState&amp; exec, JSC::JSValue value)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!value.isObject()) {
</span><del>-        throwSequenceTypeError(exec);
</del><ins>+        throwSequenceTypeError(exec, scope);
</ins><span class="cx">         return Vector&lt;T&gt;();
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMConstructorh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMConstructor.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMConstructor.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMConstructor.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><del>- *  Copyright (C) 2015 Canon Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2015, 2016 Canon Inc. All rights reserved.
+ *  Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -45,7 +46,9 @@
</span><span class="cx"> 
</span><span class="cx">     static JSC::EncodedJSValue JSC_HOST_CALL callThrowTypeError(JSC::ExecState* exec)
</span><span class="cx">     {
</span><del>-        JSC::throwTypeError(exec, ASCIILiteral(&quot;Illegal constructor&quot;));
</del><ins>+        JSC::VM&amp; vm = exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        JSC::throwTypeError(exec, scope, ASCIILiteral(&quot;Illegal constructor&quot;));
</ins><span class="cx">         return JSC::JSValue::encode(JSC::jsNull());
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -226,8 +229,10 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename JSClass&gt; inline JSC::EncodedJSValue JSBuiltinConstructor&lt;JSClass&gt;::callConstructor(JSC::ExecState&amp; state, JSC::JSObject* object)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (!object)
</span><del>-        return throwConstructorScriptExecutionContextUnavailableError(state, info()-&gt;className);
</del><ins>+        return throwConstructorScriptExecutionContextUnavailableError(state, scope, info()-&gt;className);
</ins><span class="cx">     return callConstructor(state, *object);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMConverth"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMConvert.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMConvert.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMConvert.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -73,9 +73,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;typename T, typename JST&gt; inline T* convertWrapperType(JSC::ExecState&amp; state, JSC::JSValue value, IsNullable isNullable)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     T* object = JST::toWrapped(value);
</span><span class="cx">     if (!object &amp;&amp; (isNullable == IsNullable::No || !value.isUndefinedOrNull()))
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, scope);
</ins><span class="cx">     return object;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -275,9 +277,11 @@
</span><span class="cx"> template&lt;typename T&gt; struct Converter&lt;T, typename std::enable_if&lt;std::is_floating_point&lt;T&gt;::value&gt;::type&gt; : DefaultConverter&lt;T&gt; {
</span><span class="cx">     static T convert(JSC::ExecState&amp; state, JSC::JSValue value, ShouldAllowNonFinite allow)
</span><span class="cx">     {
</span><ins>+        JSC::VM&amp; vm = state.vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">         double number = value.toNumber(&amp;state);
</span><span class="cx">         if (allow == ShouldAllowNonFinite::No &amp;&amp; UNLIKELY(!std::isfinite(number)))
</span><del>-            throwNonFiniteTypeError(state);
</del><ins>+            throwNonFiniteTypeError(state, scope);
</ins><span class="cx">         return static_cast&lt;T&gt;(number);
</span><span class="cx">     }
</span><span class="cx"> };
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMIteratorh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMIterator.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMIterator.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMIterator.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2016 Canon, Inc. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -130,9 +131,12 @@
</span><span class="cx"> template&lt;typename JSWrapper&gt;
</span><span class="cx"> JSC::EncodedJSValue iteratorCreate(JSC::ExecState&amp; state, IterationKind kind, const char* propertyName)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto wrapper = JSC::jsDynamicCast&lt;JSWrapper*&gt;(state.thisValue());
</span><span class="cx">     if (UNLIKELY(!wrapper))
</span><del>-        return throwThisTypeError(state, JSWrapper::info()-&gt;className, propertyName);
</del><ins>+        return throwThisTypeError(state, scope, JSWrapper::info()-&gt;className, propertyName);
</ins><span class="cx">     JSDOMGlobalObject&amp; globalObject = *wrapper-&gt;globalObject();
</span><span class="cx">     return JSC::JSValue::encode(JSDOMIterator&lt;JSWrapper&gt;::create(globalObject.vm(), getDOMStructure&lt;JSDOMIterator&lt;JSWrapper&gt;&gt;(globalObject.vm(), globalObject), *wrapper, kind));
</span><span class="cx"> }
</span><span class="lines">@@ -180,9 +184,12 @@
</span><span class="cx"> template&lt;typename JSWrapper&gt;
</span><span class="cx"> JSC::EncodedJSValue iteratorForEach(JSC::ExecState&amp; state, const char* propertyName)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto wrapper = JSC::jsDynamicCast&lt;JSWrapper*&gt;(state.thisValue());
</span><span class="cx">     if (UNLIKELY(!wrapper))
</span><del>-        return throwThisTypeError(state, JSWrapper::info()-&gt;className, propertyName);
</del><ins>+        return throwThisTypeError(state, scope, JSWrapper::info()-&gt;className, propertyName);
</ins><span class="cx"> 
</span><span class="cx">     JSC::JSValue callback = state.argument(0);
</span><span class="cx">     JSC::JSValue thisValue = state.argument(1);
</span><span class="lines">@@ -190,7 +197,7 @@
</span><span class="cx">     JSC::CallData callData;
</span><span class="cx">     JSC::CallType callType = JSC::getCallData(callback, callData);
</span><span class="cx">     if (callType == JSC::CallType::None)
</span><del>-        return throwVMTypeError(&amp;state);
</del><ins>+        return throwVMTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     auto iterator = wrapper-&gt;wrapped().createIterator();
</span><span class="cx">     while (auto value = iterator.next()) {
</span><span class="lines">@@ -226,9 +233,12 @@
</span><span class="cx"> template&lt;typename JSWrapper&gt;
</span><span class="cx"> JSC::EncodedJSValue JSC_HOST_CALL JSDOMIteratorPrototype&lt;JSWrapper&gt;::next(JSC::ExecState* state)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto iterator = JSC::jsDynamicCast&lt;JSDOMIterator&lt;JSWrapper&gt;*&gt;(state-&gt;thisValue());
</span><span class="cx">     if (!iterator)
</span><del>-        return JSC::JSValue::encode(throwTypeError(state, ASCIILiteral(&quot;Cannot call next() on a non-Iterator object&quot;)));
</del><ins>+        return JSC::JSValue::encode(throwTypeError(state, scope, ASCIILiteral(&quot;Cannot call next() on a non-Iterator object&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     return JSC::JSValue::encode(iterator-&gt;next(*state));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDOMWindowCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -75,6 +75,9 @@
</span><span class="cx"> 
</span><span class="cx"> static bool jsDOMWindowGetOwnPropertySlotRestrictedAccess(JSDOMWindow* thisObject, Frame* frame, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot, String&amp; errorMessage)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // We don't want any properties other than &quot;close&quot; and &quot;closed&quot; on a frameless window
</span><span class="cx">     // (i.e. one whose page got closed, or whose iframe got removed).
</span><span class="cx">     // FIXME: This handling for frameless windows duplicates similar behaviour for cross-origin
</span><span class="lines">@@ -135,7 +138,7 @@
</span><span class="cx">         // For any other entries in the static property table, deny access. (Early return also prevents
</span><span class="cx">         // named getter from returning frames with matching names - this seems a little questionable, see
</span><span class="cx">         // FIXME comment on prototype search below.)
</span><del>-        throwSecurityError(*exec, errorMessage);
</del><ins>+        throwSecurityError(*exec, scope, errorMessage);
</ins><span class="cx">         slot.setUndefined();
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="lines">@@ -149,7 +152,7 @@
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    throwSecurityError(*exec, errorMessage);
</del><ins>+    throwSecurityError(*exec, scope, errorMessage);
</ins><span class="cx">     slot.setUndefined();
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="lines">@@ -230,6 +233,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSDOMWindow::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto* thisObject = jsCast&lt;JSDOMWindow*&gt;(cell);
</span><span class="cx">     if (!thisObject-&gt;wrapped().frame())
</span><span class="cx">         return false;
</span><span class="lines">@@ -243,7 +249,7 @@
</span><span class="cx">                 return putResult;
</span><span class="cx">             return false;
</span><span class="cx">         }
</span><del>-        throwSecurityError(*exec, errorMessage);
</del><ins>+        throwSecurityError(*exec, scope, errorMessage);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -434,8 +440,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSDOMWindow::showModalDialog(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     String urlString = valueToStringWithUndefinedOrNullCheck(&amp;state, state.argument(0));
</span><span class="cx">     if (state.hadException())
</span><span class="lines">@@ -455,8 +464,11 @@
</span><span class="cx"> 
</span><span class="cx"> static JSValue handlePostMessage(DOMWindow&amp; impl, ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 2))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     MessagePortArray messagePorts;
</span><span class="cx">     ArrayBufferArray arrayBuffers;
</span><span class="lines">@@ -502,8 +514,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSDOMWindow::setTimeout(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     ContentSecurityPolicy* contentSecurityPolicy = wrapped().document() ? wrapped().document()-&gt;contentSecurityPolicy() : nullptr;
</span><span class="cx">     std::unique_ptr&lt;ScheduledAction&gt; action = ScheduledAction::create(&amp;state, globalObject()-&gt;world(), contentSecurityPolicy);
</span><span class="lines">@@ -524,8 +539,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSDOMWindow::setInterval(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     ContentSecurityPolicy* contentSecurityPolicy = wrapped().document() ? wrapped().document()-&gt;contentSecurityPolicy() : nullptr;
</span><span class="cx">     std::unique_ptr&lt;ScheduledAction&gt; action = ScheduledAction::create(&amp;state, globalObject()-&gt;world(), contentSecurityPolicy);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDataCueCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDataCueCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDataCueCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDataCueCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2014 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2014, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -49,10 +49,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL constructJSDataCue(ExecState&amp; exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     DOMConstructorObject* castedThis = jsCast&lt;DOMConstructorObject*&gt;(exec.callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     if (exec.argumentCount() &lt; 3)
</span><del>-        return throwVMError(&amp;exec, createNotEnoughArgumentsError(&amp;exec));
</del><ins>+        return throwVMError(&amp;exec, scope, createNotEnoughArgumentsError(&amp;exec));
</ins><span class="cx"> 
</span><span class="cx">     double startTime(exec.uncheckedArgument(0).toNumber(&amp;exec));
</span><span class="cx">     if (UNLIKELY(exec.hadException()))
</span><span class="lines">@@ -64,13 +67,13 @@
</span><span class="cx"> 
</span><span class="cx">     ScriptExecutionContext* context = castedThis-&gt;scriptExecutionContext();
</span><span class="cx">     if (!context)
</span><del>-        return throwConstructorScriptExecutionContextUnavailableError(exec, &quot;DataCue&quot;);
</del><ins>+        return throwConstructorScriptExecutionContextUnavailableError(exec, scope, &quot;DataCue&quot;);
</ins><span class="cx"> 
</span><span class="cx">     String type;
</span><span class="cx"> #if ENABLE(DATACUE_VALUE)
</span><span class="cx">     if (exec.argumentCount() &gt; 3) {
</span><span class="cx">         if (!exec.uncheckedArgument(3).isString())
</span><del>-            return throwArgumentTypeError(exec, 3, &quot;type&quot;, &quot;DataCue&quot;, nullptr, &quot;DOMString&quot;);
</del><ins>+            return throwArgumentTypeError(exec, scope, 3, &quot;type&quot;, &quot;DataCue&quot;, nullptr, &quot;DOMString&quot;);
</ins><span class="cx">         type = exec.uncheckedArgument(3).getString(&amp;exec);
</span><span class="cx">     }
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDictionarycpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDictionary.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDictionary.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDictionary.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2011 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2011, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -179,9 +179,12 @@
</span><span class="cx"> 
</span><span class="cx"> void JSDictionary::convertValue(ExecState* state, JSValue value, RefPtr&lt;DOMWindow&gt;&amp; result)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto* window = JSDOMWindow::toWrapped(*state, value);
</span><span class="cx">     if (UNLIKELY(!window) &amp;&amp; !value.isUndefinedOrNull()) {
</span><del>-        throwVMTypeError(state, &quot;Dictionary member is not of type Window&quot;);
</del><ins>+        throwVMTypeError(state, scope, &quot;Dictionary member is not of type Window&quot;);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     result = window;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSDocumentCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDocumentCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDocumentCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSDocumentCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2007, 2008, 2009, 2011 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2007-2009, 2011, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * This library is free software; you can redistribute it and/or
</span><span class="cx">  * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -130,12 +130,15 @@
</span><span class="cx"> #if ENABLE(TOUCH_EVENTS)
</span><span class="cx"> JSValue JSDocument::createTouchList(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto touchList = TouchList::create();
</span><span class="cx"> 
</span><span class="cx">     for (size_t i = 0; i &lt; state.argumentCount(); ++i) {
</span><span class="cx">         auto* item = JSTouch::toWrapped(state.uncheckedArgument(i));
</span><span class="cx">         if (!item)
</span><del>-            return JSValue::decode(throwArgumentTypeError(state, i, &quot;touches&quot;, &quot;Document&quot;, &quot;createTouchList&quot;, &quot;Touch&quot;));
</del><ins>+            return JSValue::decode(throwArgumentTypeError(state, scope, i, &quot;touches&quot;, &quot;Document&quot;, &quot;createTouchList&quot;, &quot;Touch&quot;));
</ins><span class="cx"> 
</span><span class="cx">         touchList-&gt;append(*item);
</span><span class="cx">     }
</span><span class="lines">@@ -145,8 +148,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSDocument::getCSSCanvasContext(JSC::ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 4))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     auto contextId = state.uncheckedArgument(0).toWTFString(&amp;state);
</span><span class="cx">     if (UNLIKELY(state.hadException()))
</span><span class="cx">         return jsUndefined();
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSFileCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSFileCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSFileCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSFileCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -43,17 +43,20 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL constructJSFile(ExecState&amp; exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto* constructor = jsCast&lt;DOMConstructorObject*&gt;(exec.callee());
</span><span class="cx">     ASSERT(constructor);
</span><span class="cx"> 
</span><span class="cx">     ScriptExecutionContext* context = constructor-&gt;scriptExecutionContext();
</span><span class="cx">     if (!context)
</span><del>-        return throwConstructorScriptExecutionContextUnavailableError(exec, &quot;File&quot;);
</del><ins>+        return throwConstructorScriptExecutionContextUnavailableError(exec, scope, &quot;File&quot;);
</ins><span class="cx">     ASSERT(context-&gt;isDocument());
</span><span class="cx"> 
</span><span class="cx">     JSValue arg = exec.argument(0);
</span><span class="cx">     if (arg.isUndefinedOrNull())
</span><del>-        return throwArgumentTypeError(exec, 0, &quot;fileBits&quot;, &quot;File&quot;, nullptr, &quot;sequence&quot;);
</del><ins>+        return throwArgumentTypeError(exec, scope, 0, &quot;fileBits&quot;, &quot;File&quot;, nullptr, &quot;sequence&quot;);
</ins><span class="cx"> 
</span><span class="cx">     unsigned blobPartsLength = 0;
</span><span class="cx">     JSObject* blobParts = toJSSequence(exec, arg, blobPartsLength);
</span><span class="lines">@@ -63,7 +66,7 @@
</span><span class="cx"> 
</span><span class="cx">     arg = exec.argument(1);
</span><span class="cx">     if (arg.isUndefined())
</span><del>-        return throwArgumentTypeError(exec, 1, &quot;filename&quot;, &quot;File&quot;, nullptr, &quot;DOMString&quot;);
</del><ins>+        return throwArgumentTypeError(exec, scope, 1, &quot;filename&quot;, &quot;File&quot;, nullptr, &quot;DOMString&quot;);
</ins><span class="cx"> 
</span><span class="cx">     String filename = arg.toWTFString(&amp;exec).replace('/', ':');
</span><span class="cx">     if (exec.hadException())
</span><span class="lines">@@ -76,7 +79,7 @@
</span><span class="cx">     if (!arg.isUndefinedOrNull()) {
</span><span class="cx">         JSObject* filePropertyBagObject = arg.getObject();
</span><span class="cx">         if (!filePropertyBagObject)
</span><del>-            return throwArgumentTypeError(exec, 2, &quot;options&quot;, &quot;File&quot;, nullptr, &quot;FilePropertyBag&quot;);
</del><ins>+            return throwArgumentTypeError(exec, scope, 2, &quot;options&quot;, &quot;File&quot;, nullptr, &quot;FilePropertyBag&quot;);
</ins><span class="cx"> 
</span><span class="cx">         // Create the dictionary wrapper from the initializer object.
</span><span class="cx">         JSDictionary dictionary(&amp;exec, filePropertyBagObject);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLAllCollectionCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLAllCollectionCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2009 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2009, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -104,8 +104,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHTMLAllCollection::item(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     String argument = state.uncheckedArgument(0).toWTFString(&amp;state);
</span><span class="cx">     if (Optional&lt;uint32_t&gt; index = parseIndex(*argument.impl()))
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLCanvasElementCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2007 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2007, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -71,8 +71,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHTMLCanvasElement::getContext(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     HTMLCanvasElement&amp; canvas = wrapped();
</span><span class="cx">     const String&amp; contextId = state.uncheckedArgument(0).toWTFString(&amp;state);
</span><span class="lines">@@ -94,8 +97,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHTMLCanvasElement::probablySupportsContext(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     HTMLCanvasElement&amp; canvas = wrapped();
</span><span class="cx">     const String&amp; contextId = state.uncheckedArgument(0).toWTFString(&amp;state);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLDocumentCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLDocumentCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2007-2009, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -152,6 +152,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHTMLDocument::open(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // For compatibility with other browsers, pass open calls with more than 2 parameters to the window.
</span><span class="cx">     if (state.argumentCount() &gt; 2) {
</span><span class="cx">         if (Frame* frame = wrapped().frame()) {
</span><span class="lines">@@ -161,7 +164,7 @@
</span><span class="cx">                 CallData callData;
</span><span class="cx">                 CallType callType = ::getCallData(function, callData);
</span><span class="cx">                 if (callType == CallType::None)
</span><del>-                    return throwTypeError(&amp;state);
</del><ins>+                    return throwTypeError(&amp;state, scope);
</ins><span class="cx">                 return JSC::call(&amp;state, function, callType, callData, wrapper, ArgList(&amp;state));
</span><span class="cx">             }
</span><span class="cx">         }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLElementCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLElementCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLElementCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLElementCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -43,12 +43,15 @@
</span><span class="cx"> #if ENABLE(CUSTOM_ELEMENTS)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL constructJSHTMLElement(ExecState&amp; exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto* jsConstructor = jsCast&lt;DOMConstructorObject*&gt;(exec.callee());
</span><span class="cx">     ASSERT(jsConstructor);
</span><span class="cx"> 
</span><span class="cx">     auto* context = jsConstructor-&gt;scriptExecutionContext();
</span><span class="cx">     if (!context)
</span><del>-        return throwConstructorScriptExecutionContextUnavailableError(exec, &quot;HTMLElement&quot;);
</del><ins>+        return throwConstructorScriptExecutionContextUnavailableError(exec, scope, &quot;HTMLElement&quot;);
</ins><span class="cx">     ASSERT(context-&gt;isDocument());
</span><span class="cx"> 
</span><span class="cx">     auto&amp; document = downcast&lt;Document&gt;(*context);
</span><span class="lines">@@ -55,18 +58,17 @@
</span><span class="cx"> 
</span><span class="cx">     auto* window = document.domWindow();
</span><span class="cx">     if (!window)
</span><del>-        return throwVMTypeError(&amp;exec, ASCIILiteral(&quot;new.target is not a valid custom element constructor&quot;));
</del><ins>+        return throwVMTypeError(&amp;exec, scope, ASCIILiteral(&quot;new.target is not a valid custom element constructor&quot;));
</ins><span class="cx"> 
</span><span class="cx">     auto* registry = window-&gt;customElementRegistry();
</span><span class="cx">     if (!registry)
</span><del>-        return throwVMTypeError(&amp;exec, ASCIILiteral(&quot;new.target is not a valid custom element constructor&quot;));
</del><ins>+        return throwVMTypeError(&amp;exec, scope, ASCIILiteral(&quot;new.target is not a valid custom element constructor&quot;));
</ins><span class="cx"> 
</span><del>-    VM&amp; vm = exec.vm();
</del><span class="cx">     JSValue newTargetValue = exec.thisValue();
</span><span class="cx">     JSObject* newTarget = newTargetValue.getObject();
</span><span class="cx">     auto* elementInterface = registry-&gt;findInterface(newTarget);
</span><span class="cx">     if (!elementInterface)
</span><del>-        return throwVMTypeError(&amp;exec, ASCIILiteral(&quot;new.target does not define a custom element&quot;));
</del><ins>+        return throwVMTypeError(&amp;exec, scope, ASCIILiteral(&quot;new.target does not define a custom element&quot;));
</ins><span class="cx"> 
</span><span class="cx">     if (!elementInterface-&gt;isUpgradingElement()) {
</span><span class="cx">         auto* globalObject = jsConstructor-&gt;globalObject();
</span><span class="lines">@@ -84,7 +86,7 @@
</span><span class="cx"> 
</span><span class="cx">     Element* elementToUpgrade = elementInterface-&gt;lastElementInConstructionStack();
</span><span class="cx">     if (!elementToUpgrade) {
</span><del>-        throwInvalidStateError(exec, ASCIILiteral(&quot;Cannot instantiate a custom element inside its own constrcutor during upgrades&quot;));
</del><ins>+        throwInvalidStateError(exec, scope, ASCIILiteral(&quot;Cannot instantiate a custom element inside its own constrcutor during upgrades&quot;));
</ins><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLFormControlsCollectionCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLFormControlsCollectionCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLFormControlsCollectionCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLFormControlsCollectionCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2007-2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * This library is free software; you can redistribute it and/or
</span><span class="cx">  * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -56,8 +56,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHTMLFormControlsCollection::namedItem(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     JSValue value = namedItems(state, this, Identifier::fromString(&amp;state, state.uncheckedArgument(0).toString(&amp;state)-&gt;value(&amp;state)));
</span><span class="cx">     return value.isUndefined() ? jsNull() : value;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHTMLInputElementCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLInputElementCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLInputElementCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHTMLInputElementCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -35,9 +35,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHTMLInputElement::selectionStart(ExecState&amp; state) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     HTMLInputElement&amp; input = wrapped();
</span><span class="cx">     if (!input.canHaveSelection())
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     return jsNumber(input.selectionStart());
</span><span class="cx"> }
</span><span class="lines">@@ -44,9 +47,12 @@
</span><span class="cx"> 
</span><span class="cx"> void JSHTMLInputElement::setSelectionStart(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     HTMLInputElement&amp; input = wrapped();
</span><span class="cx">     if (!input.canHaveSelection())
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     input.setSelectionStart(value.toInt32(&amp;state));
</span><span class="cx"> }
</span><span class="lines">@@ -53,9 +59,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHTMLInputElement::selectionEnd(ExecState&amp; state) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     HTMLInputElement&amp; input = wrapped();
</span><span class="cx">     if (!input.canHaveSelection())
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     return jsNumber(input.selectionEnd());
</span><span class="cx"> }
</span><span class="lines">@@ -62,9 +71,12 @@
</span><span class="cx"> 
</span><span class="cx"> void JSHTMLInputElement::setSelectionEnd(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     HTMLInputElement&amp; input = wrapped();
</span><span class="cx">     if (!input.canHaveSelection())
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     input.setSelectionEnd(value.toInt32(&amp;state));
</span><span class="cx"> }
</span><span class="lines">@@ -71,9 +83,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHTMLInputElement::selectionDirection(ExecState&amp; state) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     HTMLInputElement&amp; input = wrapped();
</span><span class="cx">     if (!input.canHaveSelection())
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     return jsStringWithCache(&amp;state, input.selectionDirection());
</span><span class="cx"> }
</span><span class="lines">@@ -80,9 +95,12 @@
</span><span class="cx"> 
</span><span class="cx"> void JSHTMLInputElement::setSelectionDirection(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     HTMLInputElement&amp; input = wrapped();
</span><span class="cx">     if (!input.canHaveSelection()) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, scope);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -91,12 +109,15 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHTMLInputElement::setSelectionRange(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 2))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     HTMLInputElement&amp; input = wrapped();
</span><span class="cx">     if (!input.canHaveSelection())
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     int start = state.uncheckedArgument(0).toInt32(&amp;state);
</span><span class="cx">     int end = state.uncheckedArgument(1).toInt32(&amp;state);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSHistoryCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHistoryCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHistoryCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSHistoryCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -55,9 +55,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHistory::pushState(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto argCount = state.argumentCount();
</span><span class="cx">     if (UNLIKELY(argCount &lt; 2))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     auto historyState = SerializedScriptValue::create(&amp;state, state.uncheckedArgument(0), 0, 0);
</span><span class="cx">     if (state.hadException())
</span><span class="lines">@@ -86,9 +89,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSHistory::replaceState(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     auto argCount = state.argumentCount();
</span><span class="cx">     if (UNLIKELY(argCount &lt; 2))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     auto historyState = SerializedScriptValue::create(&amp;state, state.uncheckedArgument(0), 0, 0);
</span><span class="cx">     if (state.hadException())
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSIDBDatabaseCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSIDBDatabaseCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSIDBDatabaseCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSIDBDatabaseCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2012 Michael Pruett &lt;michael@68k.org&gt;
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions are
</span><span class="lines">@@ -47,8 +48,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSIDBDatabase::createObjectStore(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 1)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     String name = state.argument(0).toString(&amp;state)-&gt;value(&amp;state);
</span><span class="cx">     if (state.hadException())
</span><span class="lines">@@ -56,7 +60,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSValue optionsValue = state.argument(1);
</span><span class="cx">     if (!optionsValue.isUndefinedOrNull() &amp;&amp; !optionsValue.isObject())
</span><del>-        return throwTypeError(&amp;state, &quot;Not an object.&quot;);
</del><ins>+        return throwTypeError(&amp;state, scope, &quot;Not an object.&quot;);
</ins><span class="cx"> 
</span><span class="cx">     IDBKeyPath keyPath;
</span><span class="cx">     bool autoIncrement = false;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSImageConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSImageConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSImageConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSImageConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2004-2008, 2010, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -46,10 +46,13 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; EncodedJSValue JSImageConstructor::construct(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSImageConstructor* jsConstructor = jsCast&lt;JSImageConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     Document* document = jsConstructor-&gt;document();
</span><span class="cx">     if (!document)
</span><del>-        return throwVMError(state, createReferenceError(state, &quot;Image constructor associated document is unavailable&quot;));
</del><ins>+        return throwVMError(state, scope, createReferenceError(state, &quot;Image constructor associated document is unavailable&quot;));
</ins><span class="cx"> 
</span><span class="cx">     // Calling toJS on the document causes the JS document wrapper to be
</span><span class="cx">     // added to the window object. This is done to ensure that JSDocument::visit
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSLocationCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSLocationCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSLocationCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSLocationCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -33,6 +33,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     Frame* frame = wrapped().frame();
</span><span class="cx">     if (!frame) {
</span><span class="cx">         slot.setUndefined();
</span><span class="lines">@@ -55,7 +58,7 @@
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    throwSecurityError(*exec, message);
</del><ins>+    throwSecurityError(*exec, scope, message);
</ins><span class="cx">     slot.setUndefined();
</span><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="lines">@@ -62,6 +65,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSLocation::putDelegate(ExecState* exec, PropertyName propertyName, JSValue, PutPropertySlot&amp;, bool&amp; putResult)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     putResult = false;
</span><span class="cx">     Frame* frame = wrapped().frame();
</span><span class="cx">     if (!frame)
</span><span class="lines">@@ -78,7 +84,7 @@
</span><span class="cx">     // but not when assigning the individual pieces, since that might inadvertently
</span><span class="cx">     // disclose other parts of the original location.
</span><span class="cx">     if (propertyName != exec-&gt;propertyNames().href) {
</span><del>-        throwSecurityError(*exec, errorMessage);
</del><ins>+        throwSecurityError(*exec, scope, errorMessage);
</ins><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx">     return false;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMediaDevicesCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMediaDevicesCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMediaDevicesCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMediaDevicesCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -358,8 +358,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSMediaDevices::getUserMedia(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return JSValue::decode(throwVMError(&amp;state, createNotEnoughArgumentsError(&amp;state)));
</del><ins>+        return JSValue::decode(throwVMError(&amp;state, scope, createNotEnoughArgumentsError(&amp;state)));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto constraintsDictionary = Dictionary(&amp;state, state.uncheckedArgument(0));
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMediaStreamTrackCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMediaStreamTrackCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMediaStreamTrackCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMediaStreamTrackCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -41,10 +41,13 @@
</span><span class="cx"> 
</span><span class="cx"> JSC::JSValue JSMediaStreamTrack::getSettings(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = state.thisValue();
</span><span class="cx">     JSMediaStreamTrack* castedThis = jsDynamicCast&lt;JSMediaStreamTrack*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return JSValue::decode(throwThisTypeError(state, &quot;MediaStreamTrack&quot;, &quot;getSettings&quot;));
</del><ins>+        return JSValue::decode(throwThisTypeError(state, scope, &quot;MediaStreamTrack&quot;, &quot;getSettings&quot;));
</ins><span class="cx"> 
</span><span class="cx">     JSObject* object = constructEmptyObject(&amp;state);
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="lines">@@ -102,10 +105,13 @@
</span><span class="cx"> 
</span><span class="cx"> JSC::JSValue JSMediaStreamTrack::getCapabilities(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = state.thisValue();
</span><span class="cx">     JSMediaStreamTrack* castedThis = jsDynamicCast&lt;JSMediaStreamTrack*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return JSValue::decode(throwThisTypeError(state, &quot;MediaStreamTrack&quot;, &quot;getSettings&quot;));
</del><ins>+        return JSValue::decode(throwThisTypeError(state, scope, &quot;MediaStreamTrack&quot;, &quot;getSettings&quot;));
</ins><span class="cx"> 
</span><span class="cx">     JSObject* object = constructEmptyObject(&amp;state);
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMessagePortCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMessagePortCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMessagePortCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMessagePortCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2008-2009, 2016 Apple Inc. All Rights Reserved.
</ins><span class="cx">  * Copyright (C) 2011 Google Inc. All Rights Reserved.
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -59,6 +59,9 @@
</span><span class="cx"> 
</span><span class="cx"> void fillMessagePortArray(JSC::ExecState&amp; state, JSC::JSValue value, MessagePortArray&amp; portArray, ArrayBufferArray&amp; arrayBuffers)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // Convert from the passed-in JS array-like object to a MessagePortArray.
</span><span class="cx">     // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
</span><span class="cx">     if (value.isUndefinedOrNull()) {
</span><span class="lines">@@ -95,7 +98,7 @@
</span><span class="cx">             if (RefPtr&lt;ArrayBuffer&gt; arrayBuffer = toArrayBuffer(value))
</span><span class="cx">                 arrayBuffers.append(WTFMove(arrayBuffer));
</span><span class="cx">             else {
</span><del>-                throwTypeError(&amp;state);
</del><ins>+                throwTypeError(&amp;state, scope);
</ins><span class="cx">                 return;
</span><span class="cx">             }
</span><span class="cx">         }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMessagePortCustomh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMessagePortCustom.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMessagePortCustom.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMessagePortCustom.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2009 Google Inc. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions are
</span><span class="lines">@@ -50,8 +51,11 @@
</span><span class="cx">     template &lt;typename T&gt;
</span><span class="cx">     inline JSC::JSValue handlePostMessage(JSC::ExecState&amp; state, T* impl)
</span><span class="cx">     {
</span><ins>+        JSC::VM&amp; vm = state.vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">         if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-            return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+            return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">         MessagePortArray portArray;
</span><span class="cx">         ArrayBufferArray arrayBufferArray;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMockContentFilterSettingsCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMockContentFilterSettingsCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMockContentFilterSettingsCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMockContentFilterSettingsCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -58,6 +58,9 @@
</span><span class="cx"> 
</span><span class="cx"> void JSMockContentFilterSettings::setDecisionPoint(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     uint8_t nativeValue { convert&lt;uint8_t&gt;(state, value, EnforceRange) };
</span><span class="cx">     if (state.hadException())
</span><span class="cx">         return;
</span><span class="lines">@@ -74,7 +77,7 @@
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    throwTypeError(&amp;state, String::format(&quot;%u is not a valid decisionPoint value.&quot;, nativeValue));
</del><ins>+    throwTypeError(&amp;state, scope, String::format(&quot;%u is not a valid decisionPoint value.&quot;, nativeValue));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static inline JSValue toJSValue(Decision decision)
</span><span class="lines">@@ -91,6 +94,9 @@
</span><span class="cx"> 
</span><span class="cx"> static inline Decision toDecision(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     uint8_t nativeValue { convert&lt;uint8_t&gt;(state, value, EnforceRange) };
</span><span class="cx">     if (state.hadException())
</span><span class="cx">         return Decision::Allow;
</span><span class="lines">@@ -102,7 +108,7 @@
</span><span class="cx">         return decision;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    throwTypeError(&amp;state, String::format(&quot;%u is not a valid decision value.&quot;, nativeValue));
</del><ins>+    throwTypeError(&amp;state, scope, String::format(&quot;%u is not a valid decision value.&quot;, nativeValue));
</ins><span class="cx">     return Decision::Allow;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSModuleLoadercpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSModuleLoader.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSModuleLoader.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSModuleLoader.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -103,6 +103,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSC::JSValue JSModuleLoader::evaluate(JSC::JSGlobalObject*, JSC::ExecState* exec, JSC::JSModuleLoader*, JSC::JSValue moduleKeyValue, JSC::JSValue moduleRecordValue)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     // FIXME: Currently, we only support JSModuleRecord.
</span><span class="cx">     // Once the reflective part of the module loader is supported, we will handle arbitrary values.
</span><span class="cx">     // https://whatwg.github.io/loader/#registry-prototype-provide
</span><span class="lines">@@ -116,10 +119,10 @@
</span><span class="cx">     else if (moduleKeyValue.isString())
</span><span class="cx">         sourceUrl = URL(URL(), asString(moduleKeyValue)-&gt;value(exec));
</span><span class="cx">     else
</span><del>-        return JSC::throwTypeError(exec, ASCIILiteral(&quot;Module key is not Symbol or String.&quot;));
</del><ins>+        return JSC::throwTypeError(exec, scope, ASCIILiteral(&quot;Module key is not Symbol or String.&quot;));
</ins><span class="cx"> 
</span><span class="cx">     if (!sourceUrl.isValid())
</span><del>-        return JSC::throwTypeError(exec, ASCIILiteral(&quot;Module key is an invalid URL.&quot;));
</del><ins>+        return JSC::throwTypeError(exec, scope, ASCIILiteral(&quot;Module key is an invalid URL.&quot;));
</ins><span class="cx"> 
</span><span class="cx">     // FIXME: Implement evaluating module code.
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSMutationObserverCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMutationObserverCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMutationObserverCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSMutationObserverCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2011 Google Inc. All rights reserved.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions are
</span><span class="lines">@@ -44,19 +45,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL constructJSMutationObserver(ExecState&amp; exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (exec.argumentCount() &lt; 1)
</span><del>-        return throwVMError(&amp;exec, createNotEnoughArgumentsError(&amp;exec));
</del><ins>+        return throwVMError(&amp;exec, scope, createNotEnoughArgumentsError(&amp;exec));
</ins><span class="cx"> 
</span><span class="cx">     JSObject* object = exec.uncheckedArgument(0).getObject();
</span><span class="cx">     CallData callData;
</span><span class="cx">     if (!object || object-&gt;methodTable()-&gt;getCallData(object, callData) == CallType::None)
</span><del>-        return throwArgumentTypeError(exec, 0, &quot;callback&quot;, &quot;MutationObserver&quot;, nullptr, &quot;MutationCallback&quot;);
</del><ins>+        return throwArgumentTypeError(exec, scope, 0, &quot;callback&quot;, &quot;MutationObserver&quot;, nullptr, &quot;MutationCallback&quot;);
</ins><span class="cx"> 
</span><span class="cx">     DOMConstructorObject* jsConstructor = jsCast&lt;DOMConstructorObject*&gt;(exec.callee());
</span><span class="cx">     auto callback = JSMutationCallback::create(object, jsConstructor-&gt;globalObject());
</span><span class="cx">     JSObject* jsObserver = asObject(toJSNewlyCreated(&amp;exec, jsConstructor-&gt;globalObject(), MutationObserver::create(WTFMove(callback))));
</span><span class="cx">     PrivateName propertyName;
</span><del>-    jsObserver-&gt;putDirect(jsConstructor-&gt;globalObject()-&gt;vm(), propertyName, object);
</del><ins>+    jsObserver-&gt;putDirect(vm, propertyName, object);
</ins><span class="cx">     return JSValue::encode(jsObserver);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSNodeCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSNodeCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSNodeCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSNodeCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2007, 2009, 2010 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2007, 2009-2010, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -112,13 +112,16 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSNode::insertBefore(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 2))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     JSValue newChildValue = state.uncheckedArgument(0);
</span><span class="cx">     auto* newChild = JSNode::toWrapped(newChildValue);
</span><span class="cx">     if (UNLIKELY(!newChild))
</span><del>-        return JSValue::decode(throwArgumentTypeError(state, 0, &quot;node&quot;, &quot;Node&quot;, &quot;insertBefore&quot;, &quot;Node&quot;));
</del><ins>+        return JSValue::decode(throwArgumentTypeError(state, scope, 0, &quot;node&quot;, &quot;Node&quot;, &quot;insertBefore&quot;, &quot;Node&quot;));
</ins><span class="cx"> 
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     if (UNLIKELY(!wrapped().insertBefore(*newChild, JSNode::toWrapped(state.uncheckedArgument(1)), ec))) {
</span><span class="lines">@@ -132,8 +135,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSNode::replaceChild(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 2))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     auto* newChild = JSNode::toWrapped(state.uncheckedArgument(0));
</span><span class="cx">     JSValue oldChildValue = state.uncheckedArgument(1);
</span><span class="lines">@@ -140,8 +146,8 @@
</span><span class="cx">     auto* oldChild = JSNode::toWrapped(oldChildValue);
</span><span class="cx">     if (UNLIKELY(!newChild || !oldChild)) {
</span><span class="cx">         if (!newChild)
</span><del>-            return JSValue::decode(throwArgumentTypeError(state, 0, &quot;node&quot;, &quot;Node&quot;, &quot;replaceChild&quot;, &quot;Node&quot;));
-        return JSValue::decode(throwArgumentTypeError(state, 1, &quot;child&quot;, &quot;Node&quot;, &quot;replaceChild&quot;, &quot;Node&quot;));
</del><ins>+            return JSValue::decode(throwArgumentTypeError(state, scope, 0, &quot;node&quot;, &quot;Node&quot;, &quot;replaceChild&quot;, &quot;Node&quot;));
+        return JSValue::decode(throwArgumentTypeError(state, scope, 1, &quot;child&quot;, &quot;Node&quot;, &quot;replaceChild&quot;, &quot;Node&quot;));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -156,10 +162,13 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSNode::removeChild(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue childValue = state.argument(0);
</span><span class="cx">     auto* child = JSNode::toWrapped(childValue);
</span><span class="cx">     if (UNLIKELY(!child))
</span><del>-        return JSValue::decode(throwArgumentTypeError(state, 0, &quot;child&quot;, &quot;Node&quot;, &quot;removeChild&quot;, &quot;Node&quot;));
</del><ins>+        return JSValue::decode(throwArgumentTypeError(state, scope, 0, &quot;child&quot;, &quot;Node&quot;, &quot;removeChild&quot;, &quot;Node&quot;));
</ins><span class="cx"> 
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     if (UNLIKELY(!wrapped().removeChild(*child, ec))) {
</span><span class="lines">@@ -173,10 +182,13 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSNode::appendChild(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue newChildValue = state.argument(0);
</span><span class="cx">     auto newChild = JSNode::toWrapped(newChildValue);
</span><span class="cx">     if (UNLIKELY(!newChild))
</span><del>-        return JSValue::decode(throwArgumentTypeError(state, 0, &quot;node&quot;, &quot;Node&quot;, &quot;appendChild&quot;, &quot;Node&quot;));
</del><ins>+        return JSValue::decode(throwArgumentTypeError(state, scope, 0, &quot;node&quot;, &quot;Node&quot;, &quot;appendChild&quot;, &quot;Node&quot;));
</ins><span class="cx"> 
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     if (UNLIKELY(!wrapped().appendChild(*newChild, ec))) {
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSNodeFilterCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -42,7 +42,9 @@
</span><span class="cx"> {
</span><span class="cx">     Ref&lt;JSNodeFilter&gt; protectedThis(*this);
</span><span class="cx"> 
</span><del>-    JSLockHolder lock(m_data-&gt;globalObject()-&gt;vm());
</del><ins>+    VM&amp; vm = m_data-&gt;globalObject()-&gt;vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     ExecState* state = m_data-&gt;globalObject()-&gt;globalExec();
</span><span class="cx">     MarkedArgumentBuffer args;
</span><span class="lines">@@ -54,7 +56,7 @@
</span><span class="cx">     JSValue value = m_data-&gt;invokeCallback(args, JSCallbackData::CallbackType::FunctionOrObject, Identifier::fromString(state, &quot;acceptNode&quot;), returnedException);
</span><span class="cx">     if (returnedException) {
</span><span class="cx">         // Rethrow exception.
</span><del>-        state-&gt;vm().throwException(state, returnedException);
</del><ins>+        throwException(state, scope, returnedException);
</ins><span class="cx"> 
</span><span class="cx">         return NodeFilter::FILTER_REJECT;
</span><span class="cx">     }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSPluginElementFunctionscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSPluginElementFunctions.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2004-2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -96,10 +96,12 @@
</span><span class="cx">     
</span><span class="cx"> EncodedJSValue pluginElementPropertyGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSHTMLElement* thisObject = jsDynamicCast&lt;JSHTMLElement*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (!thisObject)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     JSObject* scriptObject = pluginScriptObject(exec, thisObject);
</span><span class="cx">     if (!scriptObject)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSReadableStreamPrivateConstructorscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSReadableStreamPrivateConstructors.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSReadableStreamPrivateConstructors.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSReadableStreamPrivateConstructors.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 2015 Canon Inc. All rights reserved.
</span><ins>+ *  Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -36,14 +37,19 @@
</span><span class="cx"> // Public JS ReadableStreamReder and ReadableStreamDefaultController constructor callbacks.
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL constructJSReadableStreamDefaultController(ExecState&amp; exec)
</span><span class="cx"> {
</span><del>-    return throwVMTypeError(&amp;exec, ASCIILiteral(&quot;ReadableStreamDefaultController constructor should not be called directly&quot;));
</del><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    return throwVMTypeError(&amp;exec, scope, ASCIILiteral(&quot;ReadableStreamDefaultController constructor should not be called directly&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL constructJSReadableStreamDefaultReader(ExecState&amp; exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    
</ins><span class="cx">     JSReadableStream* stream = jsDynamicCast&lt;JSReadableStream*&gt;(exec.argument(0));
</span><span class="cx">     if (!stream)
</span><del>-        return throwArgumentTypeError(exec, 0, &quot;stream&quot;, &quot;ReadableStreamReader&quot;, nullptr, &quot;ReadableStream&quot;);
</del><ins>+        return throwArgumentTypeError(exec, scope, 0, &quot;stream&quot;, &quot;ReadableStreamReader&quot;, nullptr, &quot;ReadableStream&quot;);
</ins><span class="cx"> 
</span><span class="cx">     JSValue jsFunction = stream-&gt;get(&amp;exec, Identifier::fromString(&amp;exec, &quot;getReader&quot;));
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSSVGLengthCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSSVGLengthCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSSVGLengthCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSSVGLengthCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">     Copyright (C) 2008 Nikolas Zimmermann &lt;zimmermann@kde.org&gt;
</span><ins>+    Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx"> 
</span><span class="cx">     This library is free software; you can redistribute it and/or
</span><span class="cx">     modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -47,6 +48,9 @@
</span><span class="cx"> 
</span><span class="cx"> void JSSVGLength::setValue(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (wrapped().isReadOnly()) {
</span><span class="cx">         setDOMException(&amp;state, NO_MODIFICATION_ALLOWED_ERR);
</span><span class="cx">         return;
</span><span class="lines">@@ -53,7 +57,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!value.isUndefinedOrNull() &amp;&amp; !value.isNumber() &amp;&amp; !value.isBoolean()) {
</span><del>-        throwVMTypeError(&amp;state);
</del><ins>+        throwVMTypeError(&amp;state, scope);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -72,6 +76,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSSVGLength::convertToSpecifiedUnits(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (wrapped().isReadOnly()) {
</span><span class="cx">         setDOMException(&amp;state, NO_MODIFICATION_ALLOWED_ERR);
</span><span class="cx">         return jsUndefined();
</span><span class="lines">@@ -80,7 +87,7 @@
</span><span class="cx">     SVGLength&amp; podImp = wrapped().propertyReference();
</span><span class="cx"> 
</span><span class="cx">     if (state.argumentCount() &lt; 1)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     unsigned short unitType = state.uncheckedArgument(0).toUInt32(&amp;state);
</span><span class="cx">     if (state.hadException())
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSWebGL2RenderingContextCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebGL2RenderingContextCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebGL2RenderingContextCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebGL2RenderingContextCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -97,8 +97,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebGL2RenderingContext::getIndexedParameter(ExecState&amp; exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (exec.argumentCount() != 2)
</span><del>-        return exec.vm().throwException(&amp;exec, createNotEnoughArgumentsError(&amp;exec));
</del><ins>+        return throwException(&amp;exec, scope, createNotEnoughArgumentsError(&amp;exec));
</ins><span class="cx"> 
</span><span class="cx">     WebGL2RenderingContext&amp; context = wrapped();
</span><span class="cx">     unsigned pname = exec.uncheckedArgument(0).toInt32(&amp;exec);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSWebGLRenderingContextBaseCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebGLRenderingContextBaseCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebGLRenderingContextBaseCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebGLRenderingContextBaseCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2015 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -170,8 +170,11 @@
</span><span class="cx"> 
</span><span class="cx"> static JSValue getObjectParameter(JSWebGLRenderingContextBase* obj, ExecState&amp; state, ObjectType objectType)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() != 2)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     WebGLRenderingContextBase&amp; context = obj-&gt;wrapped();
</span><span class="lines">@@ -270,13 +273,16 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebGLRenderingContextBase::getAttachedShaders(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 1)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     WebGLRenderingContextBase&amp; context = wrapped();
</span><span class="cx">     WebGLProgram* program = JSWebGLProgram::toWrapped(state.uncheckedArgument(0));
</span><span class="cx">     if (!program &amp;&amp; !state.uncheckedArgument(0).isUndefinedOrNull())
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx">     Vector&lt;RefPtr&lt;WebGLShader&gt;&gt; shaders;
</span><span class="cx">     bool succeed = context.getAttachedShaders(program, shaders, ec);
</span><span class="cx">     if (ec) {
</span><span class="lines">@@ -293,8 +299,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebGLRenderingContextBase::getExtension(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 1)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     
</span><span class="cx">     WebGLRenderingContextBase&amp; context = wrapped();
</span><span class="cx">     const String name = state.uncheckedArgument(0).toString(&amp;state)-&gt;value(&amp;state);
</span><span class="lines">@@ -311,8 +320,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebGLRenderingContextBase::getFramebufferAttachmentParameter(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() != 3)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     WebGLRenderingContextBase&amp; context = wrapped();
</span><span class="lines">@@ -335,8 +347,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebGLRenderingContextBase::getParameter(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() != 1)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     WebGLRenderingContextBase&amp; context = wrapped();
</span><span class="lines">@@ -353,14 +368,17 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebGLRenderingContextBase::getProgramParameter(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() != 2)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     WebGLRenderingContextBase&amp; context = wrapped();
</span><span class="cx">     WebGLProgram* program = JSWebGLProgram::toWrapped(state.uncheckedArgument(0));
</span><span class="cx">     if (!program &amp;&amp; !state.uncheckedArgument(0).isUndefinedOrNull())
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx">     unsigned pname = state.uncheckedArgument(1).toInt32(&amp;state);
</span><span class="cx">     if (state.hadException())
</span><span class="cx">         return jsUndefined();
</span><span class="lines">@@ -379,13 +397,16 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebGLRenderingContextBase::getShaderParameter(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() != 2)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     WebGLRenderingContextBase&amp; context = wrapped();
</span><span class="cx">     if (!state.uncheckedArgument(0).isUndefinedOrNull() &amp;&amp; !state.uncheckedArgument(0).inherits(JSWebGLShader::info()))
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx">     WebGLShader* shader = JSWebGLShader::toWrapped(state.uncheckedArgument(0));
</span><span class="cx">     unsigned pname = state.uncheckedArgument(1).toInt32(&amp;state);
</span><span class="cx">     if (state.hadException())
</span><span class="lines">@@ -417,17 +438,20 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebGLRenderingContextBase::getUniform(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() != 2)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     WebGLRenderingContextBase&amp; context = wrapped();
</span><span class="cx">     WebGLProgram* program = JSWebGLProgram::toWrapped(state.uncheckedArgument(0));
</span><span class="cx">     if (!program &amp;&amp; !state.uncheckedArgument(0).isUndefinedOrNull())
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx">     WebGLUniformLocation* location = JSWebGLUniformLocation::toWrapped(state.uncheckedArgument(1));
</span><span class="cx">     if (!location &amp;&amp; !state.uncheckedArgument(1).isUndefinedOrNull())
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx">     WebGLGetInfo info = context.getUniform(program, location, ec);
</span><span class="cx">     if (ec) {
</span><span class="cx">         setDOMException(&amp;state, ec);
</span><span class="lines">@@ -488,8 +512,11 @@
</span><span class="cx"> 
</span><span class="cx"> static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState&amp; state, WebGLRenderingContextBase&amp; context)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() != 2)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     
</span><span class="cx">     WebGLUniformLocation* location = 0;
</span><span class="cx">     long index = -1;
</span><span class="lines">@@ -497,7 +524,7 @@
</span><span class="cx">     if (functionForUniform(f)) {
</span><span class="cx">         location = JSWebGLUniformLocation::toWrapped(state.uncheckedArgument(0));
</span><span class="cx">         if (!location &amp;&amp; !state.uncheckedArgument(0).isUndefinedOrNull())
</span><del>-            return throwTypeError(&amp;state);
</del><ins>+            return throwTypeError(&amp;state, scope);
</ins><span class="cx">     } else
</span><span class="cx">         index = state.uncheckedArgument(0).toInt32(&amp;state);
</span><span class="cx">     
</span><span class="lines">@@ -543,7 +570,7 @@
</span><span class="cx">     
</span><span class="cx">     Vector&lt;float, 64&gt; array;
</span><span class="cx">     if (!toVector(state, state.uncheckedArgument(1), array))
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx">     
</span><span class="cx">     switch (f) {
</span><span class="cx">     case f_uniform1v:
</span><span class="lines">@@ -578,12 +605,15 @@
</span><span class="cx"> 
</span><span class="cx"> static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState&amp; state, WebGLRenderingContextBase&amp; context)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() != 2)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     
</span><span class="cx">     WebGLUniformLocation* location = JSWebGLUniformLocation::toWrapped(state.uncheckedArgument(0));
</span><span class="cx">     if (!location &amp;&amp; !state.uncheckedArgument(0).isUndefinedOrNull())
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx">     
</span><span class="cx">     RefPtr&lt;Int32Array&gt; webGLArray = toInt32Array(state.uncheckedArgument(1));
</span><span class="cx">     
</span><span class="lines">@@ -613,7 +643,7 @@
</span><span class="cx">     
</span><span class="cx">     Vector&lt;int, 64&gt; array;
</span><span class="cx">     if (!toVector(state, state.uncheckedArgument(1), array))
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx">     
</span><span class="cx">     switch (f) {
</span><span class="cx">     case f_uniform1v:
</span><span class="lines">@@ -638,12 +668,15 @@
</span><span class="cx"> 
</span><span class="cx"> static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState&amp; state, WebGLRenderingContextBase&amp; context)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() != 3)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx">     
</span><span class="cx">     WebGLUniformLocation* location = JSWebGLUniformLocation::toWrapped(state.uncheckedArgument(0));
</span><span class="cx">     if (!location &amp;&amp; !state.uncheckedArgument(0).isUndefinedOrNull())
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx">     
</span><span class="cx">     bool transpose = state.uncheckedArgument(1).toBoolean(&amp;state);
</span><span class="cx">     if (state.hadException())
</span><span class="lines">@@ -671,7 +704,7 @@
</span><span class="cx">     
</span><span class="cx">     Vector&lt;float, 64&gt; array;
</span><span class="cx">     if (!toVector(state, state.uncheckedArgument(2), array))
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx">     
</span><span class="cx">     switch (f) {
</span><span class="cx">     case f_uniformMatrix2fv:
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSWebKitSubtleCryptoCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebKitSubtleCryptoCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebKitSubtleCryptoCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWebKitSubtleCryptoCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -77,6 +77,9 @@
</span><span class="cx"> 
</span><span class="cx"> static bool cryptoKeyFormatFromJSValue(ExecState&amp; state, JSValue value, CryptoKeyFormat&amp; result)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     String keyFormatString = value.toString(&amp;state)-&gt;value(&amp;state);
</span><span class="cx">     if (state.hadException())
</span><span class="cx">         return false;
</span><span class="lines">@@ -89,7 +92,7 @@
</span><span class="cx">     else if (keyFormatString == &quot;jwk&quot;)
</span><span class="cx">         result = CryptoKeyFormat::JWK;
</span><span class="cx">     else {
</span><del>-        throwTypeError(&amp;state, ASCIILiteral(&quot;Unknown key format&quot;));
</del><ins>+        throwTypeError(&amp;state, scope, ASCIILiteral(&quot;Unknown key format&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     return true;
</span><span class="lines">@@ -97,8 +100,11 @@
</span><span class="cx"> 
</span><span class="cx"> static bool cryptoKeyUsagesFromJSValue(ExecState&amp; state, JSValue value, CryptoKeyUsage&amp; result)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!isJSArray(value)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -132,8 +138,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebKitSubtleCrypto::encrypt(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 3)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     auto algorithm = createAlgorithmFromJSValue(state, state.uncheckedArgument(0));
</span><span class="cx">     if (!algorithm) {
</span><span class="lines">@@ -149,7 +158,7 @@
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));
</span><span class="cx">     if (!key)
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     if (!key-&gt;allows(CryptoKeyUsageEncrypt)) {
</span><span class="cx">         wrapped().document()-&gt;addConsoleMessage(MessageSource::JS, MessageLevel::Error, ASCIILiteral(&quot;Key usages do not include 'encrypt'&quot;));
</span><span class="lines">@@ -185,8 +194,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebKitSubtleCrypto::decrypt(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 3)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     auto algorithm = createAlgorithmFromJSValue(state, state.uncheckedArgument(0));
</span><span class="cx">     if (!algorithm) {
</span><span class="lines">@@ -202,7 +214,7 @@
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));
</span><span class="cx">     if (!key)
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     if (!key-&gt;allows(CryptoKeyUsageDecrypt)) {
</span><span class="cx">         wrapped().document()-&gt;addConsoleMessage(MessageSource::JS, MessageLevel::Error, ASCIILiteral(&quot;Key usages do not include 'decrypt'&quot;));
</span><span class="lines">@@ -237,8 +249,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebKitSubtleCrypto::sign(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 3)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     auto algorithm = createAlgorithmFromJSValue(state, state.uncheckedArgument(0));
</span><span class="cx">     if (!algorithm) {
</span><span class="lines">@@ -254,7 +269,7 @@
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));
</span><span class="cx">     if (!key)
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     if (!key-&gt;allows(CryptoKeyUsageSign)) {
</span><span class="cx">         wrapped().document()-&gt;addConsoleMessage(MessageSource::JS, MessageLevel::Error, ASCIILiteral(&quot;Key usages do not include 'sign'&quot;));
</span><span class="lines">@@ -289,8 +304,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebKitSubtleCrypto::verify(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 4)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     auto algorithm = createAlgorithmFromJSValue(state, state.uncheckedArgument(0));
</span><span class="cx">     if (!algorithm) {
</span><span class="lines">@@ -306,7 +324,7 @@
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));
</span><span class="cx">     if (!key)
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     if (!key-&gt;allows(CryptoKeyUsageVerify)) {
</span><span class="cx">         wrapped().document()-&gt;addConsoleMessage(MessageSource::JS, MessageLevel::Error, ASCIILiteral(&quot;Key usages do not include 'verify'&quot;));
</span><span class="lines">@@ -347,8 +365,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebKitSubtleCrypto::digest(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 2)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     auto algorithm = createAlgorithmFromJSValue(state, state.uncheckedArgument(0));
</span><span class="cx">     if (!algorithm) {
</span><span class="lines">@@ -389,8 +410,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebKitSubtleCrypto::generateKey(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 1)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     auto algorithm = createAlgorithmFromJSValue(state, state.uncheckedArgument(0));
</span><span class="cx">     if (!algorithm) {
</span><span class="lines">@@ -445,6 +469,9 @@
</span><span class="cx"> 
</span><span class="cx"> static void importKey(ExecState&amp; state, CryptoKeyFormat keyFormat, CryptoOperationData data, RefPtr&lt;CryptoAlgorithm&gt; algorithm, RefPtr&lt;CryptoAlgorithmParameters&gt; parameters, bool extractable, CryptoKeyUsage keyUsages, CryptoAlgorithm::KeyCallback callback, CryptoAlgorithm::VoidCallback failureCallback)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     std::unique_ptr&lt;CryptoKeySerialization&gt; keySerialization;
</span><span class="cx">     switch (keyFormat) {
</span><span class="cx">     case CryptoKeyFormat::Raw:
</span><span class="lines">@@ -453,7 +480,7 @@
</span><span class="cx">     case CryptoKeyFormat::JWK: {
</span><span class="cx">         String jwkString = String::fromUTF8(data.first, data.second);
</span><span class="cx">         if (jwkString.isNull()) {
</span><del>-            throwTypeError(&amp;state, ASCIILiteral(&quot;JWK JSON serialization is not valid UTF-8&quot;));
</del><ins>+            throwTypeError(&amp;state, scope, ASCIILiteral(&quot;JWK JSON serialization is not valid UTF-8&quot;));
</ins><span class="cx">             return;
</span><span class="cx">         }
</span><span class="cx">         keySerialization = std::make_unique&lt;JSCryptoKeySerializationJWK&gt;(&amp;state, jwkString);
</span><span class="lines">@@ -462,7 +489,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     default:
</span><del>-        throwTypeError(&amp;state, ASCIILiteral(&quot;Unsupported key format for import&quot;));
</del><ins>+        throwTypeError(&amp;state, scope, ASCIILiteral(&quot;Unsupported key format for import&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -471,7 +498,7 @@
</span><span class="cx">     Optional&lt;CryptoAlgorithmPair&gt; reconciledResult = keySerialization-&gt;reconcileAlgorithm(algorithm.get(), parameters.get());
</span><span class="cx">     if (!reconciledResult) {
</span><span class="cx">         if (!state.hadException())
</span><del>-            throwTypeError(&amp;state, ASCIILiteral(&quot;Algorithm specified in key is not compatible with one passed to importKey as argument&quot;));
</del><ins>+            throwTypeError(&amp;state, scope, ASCIILiteral(&quot;Algorithm specified in key is not compatible with one passed to importKey as argument&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     if (state.hadException())
</span><span class="lines">@@ -480,7 +507,7 @@
</span><span class="cx">     algorithm = reconciledResult-&gt;algorithm;
</span><span class="cx">     parameters = reconciledResult-&gt;parameters;
</span><span class="cx">     if (!algorithm) {
</span><del>-        throwTypeError(&amp;state, ASCIILiteral(&quot;Neither key nor function argument has crypto algorithm specified&quot;));
</del><ins>+        throwTypeError(&amp;state, scope, ASCIILiteral(&quot;Neither key nor function argument has crypto algorithm specified&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     ASSERT(parameters);
</span><span class="lines">@@ -505,8 +532,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebKitSubtleCrypto::importKey(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 3)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     CryptoKeyFormat keyFormat;
</span><span class="cx">     if (!cryptoKeyFormatFromJSValue(state, state.argument(0), keyFormat)) {
</span><span class="lines">@@ -568,8 +598,11 @@
</span><span class="cx"> 
</span><span class="cx"> static void exportKey(ExecState&amp; state, CryptoKeyFormat keyFormat, const CryptoKey&amp; key, CryptoAlgorithm::VectorCallback callback, CryptoAlgorithm::VoidCallback failureCallback)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!key.extractable()) {
</span><del>-        throwTypeError(&amp;state, ASCIILiteral(&quot;Key is not extractable&quot;));
</del><ins>+        throwTypeError(&amp;state, scope, ASCIILiteral(&quot;Key is not extractable&quot;));
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -593,7 +626,7 @@
</span><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx">     default:
</span><del>-        throwTypeError(&amp;state, ASCIILiteral(&quot;Unsupported key format for export&quot;));
</del><ins>+        throwTypeError(&amp;state, scope, ASCIILiteral(&quot;Unsupported key format for export&quot;));
</ins><span class="cx">         break;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -600,8 +633,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebKitSubtleCrypto::exportKey(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 2)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     CryptoKeyFormat keyFormat;
</span><span class="cx">     if (!cryptoKeyFormatFromJSValue(state, state.argument(0), keyFormat)) {
</span><span class="lines">@@ -611,7 +647,7 @@
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));
</span><span class="cx">     if (!key)
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     JSPromiseDeferred* promiseDeferred = JSPromiseDeferred::create(&amp;state, globalObject());
</span><span class="cx">     DeferredWrapper wrapper(&amp;state, globalObject(), promiseDeferred);
</span><span class="lines">@@ -631,8 +667,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebKitSubtleCrypto::wrapKey(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 4)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     CryptoKeyFormat keyFormat;
</span><span class="cx">     if (!cryptoKeyFormatFromJSValue(state, state.argument(0), keyFormat)) {
</span><span class="lines">@@ -642,11 +681,11 @@
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;CryptoKey&gt; key = JSCryptoKey::toWrapped(state.uncheckedArgument(1));
</span><span class="cx">     if (!key)
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     RefPtr&lt;CryptoKey&gt; wrappingKey = JSCryptoKey::toWrapped(state.uncheckedArgument(2));
</span><span class="cx">     if (!key)
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     if (!wrappingKey-&gt;allows(CryptoKeyUsageWrapKey)) {
</span><span class="cx">         wrapped().document()-&gt;addConsoleMessage(MessageSource::JS, MessageLevel::Error, ASCIILiteral(&quot;Key usages do not include 'wrapKey'&quot;));
</span><span class="lines">@@ -700,8 +739,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWebKitSubtleCrypto::unwrapKey(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (state.argumentCount() &lt; 5)
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     CryptoKeyFormat keyFormat;
</span><span class="cx">     if (!cryptoKeyFormatFromJSValue(state, state.argument(0), keyFormat)) {
</span><span class="lines">@@ -717,7 +759,7 @@
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;CryptoKey&gt; unwrappingKey = JSCryptoKey::toWrapped(state.uncheckedArgument(2));
</span><span class="cx">     if (!unwrappingKey)
</span><del>-        return throwTypeError(&amp;state);
</del><ins>+        return throwTypeError(&amp;state, scope);
</ins><span class="cx"> 
</span><span class="cx">     if (!unwrappingKey-&gt;allows(CryptoKeyUsageUnwrapKey)) {
</span><span class="cx">         wrapped().document()-&gt;addConsoleMessage(MessageSource::JS, MessageLevel::Error, ASCIILiteral(&quot;Key usages do not include 'unwrapKey'&quot;));
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSWorkerCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWorkerCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWorkerCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWorkerCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2008-2009, 2016 Apple Inc. All Rights Reserved.
</ins><span class="cx">  * Copyright (C) 2011 Google Inc. All Rights Reserved.
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -47,10 +47,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL constructJSWorker(ExecState&amp; exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     DOMConstructorObject* jsConstructor = jsCast&lt;DOMConstructorObject*&gt;(exec.callee());
</span><span class="cx"> 
</span><span class="cx">     if (!exec.argumentCount())
</span><del>-        return throwVMError(&amp;exec, createNotEnoughArgumentsError(&amp;exec));
</del><ins>+        return throwVMError(&amp;exec, scope, createNotEnoughArgumentsError(&amp;exec));
</ins><span class="cx"> 
</span><span class="cx">     String scriptURL = exec.uncheckedArgument(0).toWTFString(&amp;exec);
</span><span class="cx">     if (exec.hadException())
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsJSWorkerGlobalScopeCustomcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWorkerGlobalScopeCustom.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWorkerGlobalScopeCustom.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/JSWorkerGlobalScopeCustom.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2009, 2011 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2008-2009, 2011, 2016 Apple Inc. All Rights Reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -80,8 +80,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWorkerGlobalScope::setTimeout(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     std::unique_ptr&lt;ScheduledAction&gt; action = ScheduledAction::create(&amp;state, globalObject()-&gt;world(), wrapped().contentSecurityPolicy());
</span><span class="cx">     if (state.hadException())
</span><span class="lines">@@ -94,8 +97,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSWorkerGlobalScope::setInterval(ExecState&amp; state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (UNLIKELY(state.argumentCount() &lt; 1))
</span><del>-        return state.vm().throwException(&amp;state, createNotEnoughArgumentsError(&amp;state));
</del><ins>+        return throwException(&amp;state, scope, createNotEnoughArgumentsError(&amp;state));
</ins><span class="cx"> 
</span><span class="cx">     std::unique_ptr&lt;ScheduledAction&gt; action = ScheduledAction::create(&amp;state, globalObject()-&gt;world(), wrapped().contentSecurityPolicy());
</span><span class="cx">     if (state.hadException())
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsReadableStreamDefaultControllercpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/ReadableStreamDefaultController.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/ReadableStreamDefaultController.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/ReadableStreamDefaultController.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  * Copyright (C) 2016 Canon Inc.
</span><ins>+ * Copyright (C) 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted, provided that the following conditions
</span><span class="lines">@@ -47,7 +48,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSC::JSValue ReadableStreamDefaultController::invoke(JSC::ExecState&amp; state, JSC::JSObject&amp; object, const char* propertyName, JSC::JSValue parameter)
</span><span class="cx"> {
</span><del>-    JSC::JSLockHolder lock(&amp;state);
</del><ins>+    JSC::VM&amp; vm = state.vm();
+    JSC::JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     auto function = object.get(&amp;state, JSC::Identifier::fromString(&amp;state, propertyName));
</span><span class="cx">     if (state.hadException())
</span><span class="lines">@@ -55,7 +58,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (!function.isFunction()) {
</span><span class="cx">         if (!function.isUndefined())
</span><del>-            throwTypeError(&amp;state, ASCIILiteral(&quot;ReadableStream trying to call a property that is not callable&quot;));
</del><ins>+            throwTypeError(&amp;state, scope, ASCIILiteral(&quot;ReadableStream trying to call a property that is not callable&quot;));
</ins><span class="cx">         return JSC::jsUndefined();
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsSerializedScriptValuecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/SerializedScriptValue.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/SerializedScriptValue.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/SerializedScriptValue.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -394,7 +394,9 @@
</span><span class="cx"> 
</span><span class="cx">     void throwStackOverflow()
</span><span class="cx">     {
</span><del>-        m_exec-&gt;vm().throwException(m_exec, createStackOverflowError(m_exec));
</del><ins>+        VM&amp; vm = m_exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        throwException(m_exec, scope, createStackOverflowError(m_exec));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void fail()
</span><span class="lines">@@ -1570,7 +1572,9 @@
</span><span class="cx"> 
</span><span class="cx">     void throwValidationError()
</span><span class="cx">     {
</span><del>-        throwTypeError(m_exec, ASCIILiteral(&quot;Unable to deserialize data.&quot;));
</del><ins>+        VM&amp; vm = m_exec-&gt;vm();
+        auto scope = DECLARE_THROW_SCOPE(vm);
+        throwTypeError(m_exec, scope, ASCIILiteral(&quot;Unable to deserialize data.&quot;));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     bool isValid() const { return m_version &lt;= CurrentVersion; }
</span><span class="lines">@@ -2756,15 +2760,18 @@
</span><span class="cx"> 
</span><span class="cx"> void SerializedScriptValue::maybeThrowExceptionIfSerializationFailed(ExecState* exec, SerializationReturnCode code)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (code == SuccessfullyCompleted)
</span><span class="cx">         return;
</span><span class="cx">     
</span><span class="cx">     switch (code) {
</span><span class="cx">     case StackOverflowError:
</span><del>-        exec-&gt;vm().throwException(exec, createStackOverflowError(exec));
</del><ins>+        throwException(exec, scope, createStackOverflowError(exec));
</ins><span class="cx">         break;
</span><span class="cx">     case ValidationError:
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Unable to deserialize data.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Unable to deserialize data.&quot;));
</ins><span class="cx">         break;
</span><span class="cx">     case DataCloneError:
</span><span class="cx">         setDOMException(exec, DATA_CLONE_ERR);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsjsWorkerScriptControllercpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/WorkerScriptController.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/WorkerScriptController.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/js/WorkerScriptController.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2008, 2016 Apple Inc. All Rights Reserved.
</ins><span class="cx">  * Copyright (C) 2011, 2012 Google Inc. All Rights Reserved.
</span><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -126,11 +126,12 @@
</span><span class="cx">     initScriptIfNeeded();
</span><span class="cx"> 
</span><span class="cx">     ExecState* exec = m_workerGlobalScopeWrapper-&gt;globalExec();
</span><del>-    JSLockHolder lock(exec);
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    JSLockHolder lock(vm);
+    auto scope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx"> 
</span><span class="cx">     JSC::evaluate(exec, sourceCode.jsSourceCode(), m_workerGlobalScopeWrapper-&gt;globalThis(), returnedException);
</span><span class="cx"> 
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     if ((returnedException &amp;&amp; isTerminatedExecutionException(returnedException)) || isTerminatingExecution()) {
</span><span class="cx">         forbidExecution();
</span><span class="cx">         return;
</span><span class="lines">@@ -143,7 +144,7 @@
</span><span class="cx">         String sourceURL = sourceCode.url().string();
</span><span class="cx">         Deprecated::ScriptValue error;
</span><span class="cx">         if (m_workerGlobalScope-&gt;sanitizeScriptError(errorMessage, lineNumber, columnNumber, sourceURL, error, sourceCode.cachedScript())) {
</span><del>-            vm.throwException(exec, createError(exec, errorMessage.impl()));
</del><ins>+            throwException(exec, scope, createError(exec, errorMessage.impl()));
</ins><span class="cx">             returnedException = vm.exception();
</span><span class="cx">             vm.clearException();
</span><span class="cx">         }
</span><span class="lines">@@ -153,7 +154,9 @@
</span><span class="cx"> void WorkerScriptController::setException(JSC::Exception* exception)
</span><span class="cx"> {
</span><span class="cx">     JSC::ExecState* exec = m_workerGlobalScopeWrapper-&gt;globalExec();
</span><del>-    exec-&gt;vm().throwException(exec, exception);
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    throwException(exec, scope, exception);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void WorkerScriptController::scheduleExecutionTermination()
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -904,9 +904,11 @@
</span><span class="cx"> 
</span><span class="cx">         $result .= &quot;template&lt;&gt; $className convert&lt;$className&gt;(ExecState&amp; state, JSValue value)\n&quot;;
</span><span class="cx">         $result .= &quot;{\n&quot;;
</span><ins>+        $result .= &quot;    VM&amp; vm = state.vm();\n&quot;;
+        $result .= &quot;    auto throwScope = DECLARE_THROW_SCOPE(vm);\n&quot;;
</ins><span class="cx">         $result .= &quot;    auto result = parse&lt;$className&gt;(state, value);\n&quot;;
</span><span class="cx">         $result .= &quot;    if (UNLIKELY(!result)) {\n&quot;;
</span><del>-        $result .= &quot;        throwTypeError(&amp;state);\n&quot;;
</del><ins>+        $result .= &quot;        throwTypeError(&amp;state, throwScope);\n&quot;;
</ins><span class="cx">         $result .= &quot;        return { };\n&quot;;
</span><span class="cx">         $result .= &quot;    }\n&quot;;
</span><span class="cx">         $result .= &quot;    return result.value();\n&quot;;
</span><span class="lines">@@ -1009,11 +1011,13 @@
</span><span class="cx"> 
</span><span class="cx">         $result .= &quot;template&lt;&gt; Optional&lt;$className&gt; convertDictionary&lt;$className&gt;(ExecState&amp; state, JSValue value)\n&quot;;
</span><span class="cx">         $result .= &quot;{\n&quot;;
</span><ins>+        $result .= &quot;    VM&amp; vm = state.vm();\n&quot;;
+        $result .= &quot;    auto throwScope = DECLARE_THROW_SCOPE(vm);\n&quot;;
</ins><span class="cx">         $result .= &quot;    if (value.isUndefinedOrNull())\n&quot; if $defaultValues;
</span><span class="cx">         $result .= &quot;        return $className { &quot; . $defaultValues . &quot; };\n&quot; if $defaultValues;
</span><span class="cx">         $result .= &quot;    auto* object = value.getObject();\n&quot;;
</span><span class="cx">         $result .= &quot;    if (UNLIKELY(!object || object-&gt;type() == RegExpObjectType)) {\n&quot;;
</span><del>-        $result .= &quot;        throwTypeError(&amp;state);\n&quot;;
</del><ins>+        $result .= &quot;        throwTypeError(&amp;state, throwScope);\n&quot;;
</ins><span class="cx">         $result .= &quot;        return Nullopt;\n&quot;;
</span><span class="cx">         $result .= &quot;    }\n&quot;;
</span><span class="cx"> 
</span><span class="lines">@@ -1941,6 +1945,9 @@
</span><span class="cx">     }
</span><span class="cx">     push(@implContent, &lt;&lt;END);    
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;($maxArgCount, state-&gt;argumentCount());
</span><span class="cx"> END
</span><span class="cx"> 
</span><span class="lines">@@ -2015,9 +2022,9 @@
</span><span class="cx">     }
</span><span class="cx">     my $minArgCount = GetFunctionLength($function);
</span><span class="cx">     if ($minArgCount &gt; 0) {
</span><del>-        push(@implContent, &quot;    return argsCount &lt; $minArgCount ? throwVMError(state, createNotEnoughArgumentsError(state)) : throwVMTypeError(state);\n&quot;)
</del><ins>+        push(@implContent, &quot;    return argsCount &lt; $minArgCount ? throwVMError(state, throwScope, createNotEnoughArgumentsError(state)) : throwVMTypeError(state, throwScope);\n&quot;)
</ins><span class="cx">     } else {
</span><del>-        push(@implContent, &quot;    return throwVMTypeError(state);\n&quot;)
</del><ins>+        push(@implContent, &quot;    return throwVMTypeError(state, throwScope);\n&quot;)
</ins><span class="cx">     }
</span><span class="cx">     push(@implContent, &quot;}\n&quot;);
</span><span class="cx">     push(@implContent, &quot;#endif\n&quot;) if $conditionalString;
</span><span class="lines">@@ -2810,7 +2817,9 @@
</span><span class="cx">             push(@implContent, &quot;EncodedJSValue ${getFunctionName}(ExecState* state, EncodedJSValue thisValue, PropertyName)\n&quot;);
</span><span class="cx">             push(@implContent, &quot;{\n&quot;);
</span><span class="cx"> 
</span><del>-            push(@implContent, &quot;    UNUSED_PARAM(state);\n&quot;);
</del><ins>+            push(@implContent, &quot;    VM&amp; vm = state-&gt;vm();\n&quot;);
+            push(@implContent, &quot;    auto throwScope = DECLARE_THROW_SCOPE(vm);\n&quot;);
+            push(@implContent, &quot;    UNUSED_PARAM(throwScope);\n&quot;);
</ins><span class="cx">             push(@implContent, &quot;    UNUSED_PARAM(thisValue);\n&quot;);
</span><span class="cx"> 
</span><span class="cx">             if (!$attribute-&gt;isStatic || $attribute-&gt;signature-&gt;type =~ /Constructor$/) {
</span><span class="lines">@@ -2826,7 +2835,7 @@
</span><span class="cx">                 if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;LenientThis&quot;}) {
</span><span class="cx">                     push(@implContent, &quot;        return JSValue::encode(jsUndefined());\n&quot;);
</span><span class="cx">                 } else {
</span><del>-                    push(@implContent, &quot;        return throwGetterTypeError(*state, \&quot;$visibleInterfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
</del><ins>+                    push(@implContent, &quot;        return throwGetterTypeError(*state, throwScope, \&quot;$visibleInterfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
</ins><span class="cx">                 }
</span><span class="cx">                 push(@implContent, &quot;    }\n&quot;);
</span><span class="cx">             }
</span><span class="lines">@@ -3007,9 +3016,11 @@
</span><span class="cx"> 
</span><span class="cx">             push(@implContent, &quot;EncodedJSValue ${constructorFunctionName}(ExecState* state, EncodedJSValue thisValue, PropertyName)\n&quot;);
</span><span class="cx">             push(@implContent, &quot;{\n&quot;);
</span><ins>+            push(@implContent, &quot;    VM&amp; vm = state-&gt;vm();\n&quot;);
+            push(@implContent, &quot;    auto throwScope = DECLARE_THROW_SCOPE(vm);\n&quot;);
</ins><span class="cx">             push(@implContent, &quot;    ${className}Prototype* domObject = jsDynamicCast&lt;${className}Prototype*&gt;(JSValue::decode(thisValue));\n&quot;);
</span><span class="cx">             push(@implContent, &quot;    if (UNLIKELY(!domObject))\n&quot;);
</span><del>-            push(@implContent, &quot;        return throwVMTypeError(state);\n&quot;);
</del><ins>+            push(@implContent, &quot;        return throwVMTypeError(state, throwScope);\n&quot;);
</ins><span class="cx"> 
</span><span class="cx">             if (!$interface-&gt;extendedAttributes-&gt;{&quot;NoInterfaceObject&quot;}) {
</span><span class="cx">                 push(@implContent, &quot;    return JSValue::encode(${className}::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));\n&quot;);
</span><span class="lines">@@ -3026,10 +3037,12 @@
</span><span class="cx"> 
</span><span class="cx">         push(@implContent, &quot;bool ${constructorFunctionName}(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)\n&quot;);
</span><span class="cx">         push(@implContent, &quot;{\n&quot;);
</span><ins>+        push(@implContent, &quot;    VM&amp; vm = state-&gt;vm();\n&quot;);
+        push(@implContent, &quot;    auto throwScope = DECLARE_THROW_SCOPE(vm);\n&quot;);
</ins><span class="cx">         push(@implContent, &quot;    JSValue value = JSValue::decode(encodedValue);\n&quot;);
</span><span class="cx">         push(@implContent, &quot;    ${className}Prototype* domObject = jsDynamicCast&lt;${className}Prototype*&gt;(JSValue::decode(thisValue));\n&quot;);
</span><span class="cx">         push(@implContent, &quot;    if (UNLIKELY(!domObject)) {\n&quot;);
</span><del>-        push(@implContent, &quot;        throwVMTypeError(state);\n&quot;);
</del><ins>+        push(@implContent, &quot;        throwVMTypeError(state, throwScope);\n&quot;);
</ins><span class="cx">         push(@implContent, &quot;        return false;\n&quot;);
</span><span class="cx">         push(@implContent, &quot;    }\n&quot;);
</span><span class="cx"> 
</span><span class="lines">@@ -3109,6 +3122,9 @@
</span><span class="cx"> 
</span><span class="cx">             push(@implContent, &quot;bool ${putFunctionName}(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)\n&quot;);
</span><span class="cx">             push(@implContent, &quot;{\n&quot;);
</span><ins>+            push(@implContent, &quot;    VM&amp; vm = state-&gt;vm();\n&quot;);
+            push(@implContent, &quot;    auto throwScope = DECLARE_THROW_SCOPE(vm);\n&quot;);
+            push(@implContent, &quot;    UNUSED_PARAM(throwScope);&quot;);
</ins><span class="cx">             push(@implContent, &quot;    JSValue value = JSValue::decode(encodedValue);\n&quot;);
</span><span class="cx">             push(@implContent, &quot;    UNUSED_PARAM(thisValue);\n&quot;) if !$attribute-&gt;isStatic;
</span><span class="cx">             if (!$attribute-&gt;isStatic) {
</span><span class="lines">@@ -3121,7 +3137,7 @@
</span><span class="cx">                 if ($attribute-&gt;signature-&gt;extendedAttributes-&gt;{&quot;LenientThis&quot;}) {
</span><span class="cx">                     push(@implContent, &quot;        return false;\n&quot;);
</span><span class="cx">                 } else {
</span><del>-                    push(@implContent, &quot;        return throwSetterTypeError(*state, \&quot;$visibleInterfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
</del><ins>+                    push(@implContent, &quot;        return throwSetterTypeError(*state, throwScope, \&quot;$visibleInterfaceName\&quot;, \&quot;$name\&quot;);\n&quot;);
</ins><span class="cx">                 }
</span><span class="cx">                 push(@implContent, &quot;    }\n&quot;);
</span><span class="cx">             }
</span><span class="lines">@@ -3210,7 +3226,7 @@
</span><span class="cx">                         push(@implContent, &quot;            return false;\n&quot;);
</span><span class="cx">                     }
</span><span class="cx">                     push(@implContent, &quot;        if (UNLIKELY(!nativeValue)) {\n&quot;);
</span><del>-                    push(@implContent, &quot;            throwAttributeTypeError(*state, \&quot;$visibleInterfaceName\&quot;, \&quot;$name\&quot;, \&quot;$type\&quot;);\n&quot;);
</del><ins>+                    push(@implContent, &quot;            throwAttributeTypeError(*state, throwScope, \&quot;$visibleInterfaceName\&quot;, \&quot;$name\&quot;, \&quot;$type\&quot;);\n&quot;);
</ins><span class="cx">                     push(@implContent, &quot;            return false;\n&quot;);
</span><span class="cx">                     push(@implContent, &quot;        }\n&quot;);
</span><span class="cx">                     push(@implContent, &quot;    }\n&quot;);
</span><span class="lines">@@ -3229,7 +3245,7 @@
</span><span class="cx"> 
</span><span class="cx">                 if ($shouldPassByReference) {
</span><span class="cx">                     push(@implContent, &quot;    if (UNLIKELY(!nativeValue)) {\n&quot;);
</span><del>-                    push(@implContent, &quot;        throwAttributeTypeError(*state, \&quot;$visibleInterfaceName\&quot;, \&quot;$name\&quot;, \&quot;$type\&quot;);\n&quot;);
</del><ins>+                    push(@implContent, &quot;        throwAttributeTypeError(*state, throwScope, \&quot;$visibleInterfaceName\&quot;, \&quot;$name\&quot;, \&quot;$type\&quot;);\n&quot;);
</ins><span class="cx">                     push(@implContent, &quot;        return false;\n&quot;);
</span><span class="cx">                     push(@implContent, &quot;    }\n&quot;);
</span><span class="cx">                 }
</span><span class="lines">@@ -3397,6 +3413,10 @@
</span><span class="cx"> 
</span><span class="cx">             $implIncludes{&quot;&lt;runtime/Error.h&gt;&quot;} = 1;
</span><span class="cx"> 
</span><ins>+            push(@implContent, &quot;    VM&amp; vm = state-&gt;vm();\n&quot;);
+            push(@implContent, &quot;    auto throwScope = DECLARE_THROW_SCOPE(vm);\n&quot;);
+            push(@implContent, &quot;    UNUSED_PARAM(throwScope);\n&quot;);
+
</ins><span class="cx">             if ($function-&gt;signature-&gt;extendedAttributes-&gt;{&quot;CEReactions&quot;}) {
</span><span class="cx">                 push(@implContent, &quot;#if ENABLE(CUSTOM_ELEMENTS)\n&quot;);
</span><span class="cx">                 push(@implContent, &quot;    CustomElementReactionStack customElementReactionStack;\n&quot;);
</span><span class="lines">@@ -3716,7 +3736,7 @@
</span><span class="cx">     if ($interface-&gt;extendedAttributes-&gt;{&quot;CustomProxyToJSObject&quot;}) {
</span><span class="cx">         push(@implContent, &quot;    $className* castedThis = to${className}(state-&gt;thisValue().toThis(state, NotStrictMode));\n&quot;);
</span><span class="cx">         push(@implContent, &quot;    if (UNLIKELY(!castedThis))\n&quot;);
</span><del>-        push(@implContent, &quot;        return throwVMTypeError(state);\n&quot;);
</del><ins>+        push(@implContent, &quot;        return throwVMTypeError(state, throwScope);\n&quot;);
</ins><span class="cx">     } else {
</span><span class="cx">         push(@implContent, &quot;    JSValue thisValue = state-&gt;thisValue();\n&quot;);
</span><span class="cx">         my $castingHelper = GetCastingHelperForThisObject($interface);
</span><span class="lines">@@ -3732,7 +3752,7 @@
</span><span class="cx">         my $visibleInterfaceName = $codeGenerator-&gt;GetVisibleInterfaceName($interface);
</span><span class="cx">         my $domFunctionName = $function-&gt;signature-&gt;name;
</span><span class="cx">         push(@implContent, &quot;    if (UNLIKELY(!castedThis))\n&quot;);
</span><del>-        push(@implContent, &quot;        return throwThisTypeError(*state, \&quot;$visibleInterfaceName\&quot;, \&quot;$domFunctionName\&quot;);\n&quot;);
</del><ins>+        push(@implContent, &quot;        return throwThisTypeError(*state, throwScope, \&quot;$visibleInterfaceName\&quot;, \&quot;$domFunctionName\&quot;);\n&quot;);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     push(@implContent, &quot;    ASSERT_GC_OBJECT_INHERITS(castedThis, ${className}::info());\n&quot;) unless $interface-&gt;name eq &quot;EventTarget&quot;;
</span><span class="lines">@@ -3800,7 +3820,7 @@
</span><span class="cx">     if ($numMandatoryParams &gt;= 1)
</span><span class="cx">     {
</span><span class="cx">         push(@$outputArray, &quot;    if (UNLIKELY(state-&gt;argumentCount() &lt; $numMandatoryParams))\n&quot;);
</span><del>-        push(@$outputArray, &quot;        return throwVMError(state, createNotEnoughArgumentsError(state));\n&quot;);
</del><ins>+        push(@$outputArray, &quot;        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));\n&quot;);
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -3922,7 +3942,7 @@
</span><span class="cx">                 } else {
</span><span class="cx">                     push(@$outputArray, &quot;        if (!state-&gt;uncheckedArgument($argumentIndex).isObject())\n&quot;);
</span><span class="cx">                 }
</span><del>-                push(@$outputArray, &quot;            return throwArgumentMustBeFunctionError(*state, $argumentIndex, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName);\n&quot;);
</del><ins>+                push(@$outputArray, &quot;            return throwArgumentMustBeFunctionError(*state, throwScope, $argumentIndex, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName);\n&quot;);
</ins><span class="cx">                 if ($function-&gt;isStatic) {
</span><span class="cx">                     AddToImplIncludes(&quot;CallbackFunction.h&quot;);
</span><span class="cx">                     push(@$outputArray, &quot;        $name = createFunctionOnlyCallback&lt;${callbackClassName}&gt;(state, jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject()), state-&gt;uncheckedArgument($argumentIndex));\n&quot;);
</span><span class="lines">@@ -3936,7 +3956,7 @@
</span><span class="cx">                 } else {
</span><span class="cx">                     push(@$outputArray, &quot;    if (UNLIKELY(!state-&gt;argument($argumentIndex).isObject()))\n&quot;);
</span><span class="cx">                 }
</span><del>-                push(@$outputArray, &quot;        return throwArgumentMustBeFunctionError(*state, $argumentIndex, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName);\n&quot;);
</del><ins>+                push(@$outputArray, &quot;        return throwArgumentMustBeFunctionError(*state, throwScope, $argumentIndex, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName);\n&quot;);
</ins><span class="cx">                 if ($function-&gt;isStatic) {
</span><span class="cx">                     AddToImplIncludes(&quot;CallbackFunction.h&quot;);
</span><span class="cx">                     push(@$outputArray, &quot;    auto $name = createFunctionOnlyCallback&lt;${callbackClassName}&gt;(state, jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject()), state-&gt;uncheckedArgument($argumentIndex));\n&quot;);
</span><span class="lines">@@ -3954,7 +3974,7 @@
</span><span class="cx">                 push(@$outputArray, &quot;    for (unsigned i = $argumentIndex, count = state-&gt;argumentCount(); i &lt; count; ++i) {\n&quot;);
</span><span class="cx">                 push(@$outputArray, &quot;        auto* item = JS${type}::toWrapped(state-&gt;uncheckedArgument(i));\n&quot;);
</span><span class="cx">                 push(@$outputArray, &quot;        if (!item)\n&quot;);
</span><del>-                push(@$outputArray, &quot;            return throwArgumentTypeError(*state, i, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName, \&quot;$type\&quot;);\n&quot;);
</del><ins>+                push(@$outputArray, &quot;            return throwArgumentTypeError(*state, throwScope, i, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName, \&quot;$type\&quot;);\n&quot;);
</ins><span class="cx">                 push(@$outputArray, &quot;        $name.uncheckedAppend(item);\n&quot;);
</span><span class="cx">                 push(@$outputArray, &quot;    }\n&quot;)
</span><span class="cx">             } else {
</span><span class="lines">@@ -3997,7 +4017,7 @@
</span><span class="cx">             push(@$outputArray, &quot;$indent    if (UNLIKELY(state-&gt;hadException()))\n&quot;);
</span><span class="cx">             push(@$outputArray, &quot;$indent        return JSValue::encode(jsUndefined());\n&quot;);
</span><span class="cx">             push(@$outputArray, &quot;$indent    if (UNLIKELY(!$optionalValue))\n&quot;);
</span><del>-            push(@$outputArray, &quot;$indent        return throwArgumentMustBeEnumError(*state, $argumentIndex, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName, expectedEnumerationValues&lt;$className&gt;());\n&quot;);
</del><ins>+            push(@$outputArray, &quot;$indent        return throwArgumentMustBeEnumError(*state, throwScope, $argumentIndex, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName, expectedEnumerationValues&lt;$className&gt;());\n&quot;);
</ins><span class="cx">             push(@$outputArray, &quot;$indent    $name = optionalValue.value();\n&quot;) if $optionalValue ne $name;
</span><span class="cx"> 
</span><span class="cx">             push(@$outputArray, &quot;    }\n&quot;) if $indent ne &quot;&quot;;
</span><span class="lines">@@ -4021,7 +4041,7 @@
</span><span class="cx">                     push(@$outputArray, &quot;            return JSValue::encode(jsUndefined());\n&quot;);
</span><span class="cx">                 }
</span><span class="cx">                 push(@$outputArray, &quot;        if (UNLIKELY(!$name))\n&quot;);
</span><del>-                push(@$outputArray, &quot;            return throwArgumentTypeError(*state, $argumentIndex, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName, \&quot;$type\&quot;);\n&quot;);
</del><ins>+                push(@$outputArray, &quot;            return throwArgumentTypeError(*state, throwScope, $argumentIndex, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName, \&quot;$type\&quot;);\n&quot;);
</ins><span class="cx">                 push(@$outputArray, &quot;    }\n&quot;);
</span><span class="cx">                 $value = &quot;WTFMove($name)&quot;;
</span><span class="cx">             } else {
</span><span class="lines">@@ -4067,7 +4087,7 @@
</span><span class="cx"> 
</span><span class="cx">             if ($shouldPassByReference) {
</span><span class="cx">                 push(@$outputArray, &quot;    if (UNLIKELY(!$name))\n&quot;);
</span><del>-                push(@$outputArray, &quot;        return throwArgumentTypeError(*state, $argumentIndex, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName, \&quot;$type\&quot;);\n&quot;);
</del><ins>+                push(@$outputArray, &quot;        return throwArgumentTypeError(*state, throwScope, $argumentIndex, \&quot;$name\&quot;, \&quot;$visibleInterfaceName\&quot;, $quotedFunctionName, \&quot;$type\&quot;);\n&quot;);
</ins><span class="cx">                 $value = $isTearOff ? &quot;$name-&gt;propertyReference()&quot; : &quot;*$name&quot;;
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="lines">@@ -5243,14 +5263,16 @@
</span><span class="cx">             push(@$outputArray, &lt;&lt;END);
</span><span class="cx"> template&lt;&gt; EncodedJSValue JSC_HOST_CALL ${constructorClassName}::construct(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto* jsConstructor = jsCast&lt;${constructorClassName}*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(jsConstructor);
</span><span class="cx"> 
</span><span class="cx">     if (!jsConstructor-&gt;scriptExecutionContext())
</span><del>-        return throwConstructorScriptExecutionContextUnavailableError(*state, \&quot;${visibleInterfaceName}\&quot;);
</del><ins>+        return throwConstructorScriptExecutionContextUnavailableError(*state, throwScope, \&quot;${visibleInterfaceName}\&quot;);
</ins><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx"> 
</span><span class="cx">     AtomicString eventType = state-&gt;uncheckedArgument(0).toString(state)-&gt;toAtomicString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -5327,6 +5349,9 @@
</span><span class="cx">             }
</span><span class="cx"> 
</span><span class="cx">             push(@$outputArray, &quot;{\n&quot;);
</span><ins>+            push(@$outputArray, &quot;    VM&amp; vm = state-&gt;vm();\n&quot;);
+            push(@$outputArray, &quot;    auto throwScope = DECLARE_THROW_SCOPE(vm);\n&quot;);
+            push(@$outputArray, &quot;    UNUSED_PARAM(throwScope);\n&quot;);
</ins><span class="cx">             push(@$outputArray, &quot;    auto* castedThis = jsCast&lt;${constructorClassName}*&gt;(state-&gt;callee());\n&quot;);
</span><span class="cx">             push(@$outputArray, &quot;    ASSERT(castedThis);\n&quot;);
</span><span class="cx"> 
</span><span class="lines">@@ -5356,7 +5381,7 @@
</span><span class="cx">                 push(@constructorArgList, &quot;*context&quot;);
</span><span class="cx">                 push(@$outputArray, &quot;    ScriptExecutionContext* context = castedThis-&gt;scriptExecutionContext();\n&quot;);
</span><span class="cx">                 push(@$outputArray, &quot;    if (UNLIKELY(!context))\n&quot;);
</span><del>-                push(@$outputArray, &quot;        return throwConstructorScriptExecutionContextUnavailableError(*state, \&quot;${visibleInterfaceName}\&quot;);\n&quot;);
</del><ins>+                push(@$outputArray, &quot;        return throwConstructorScriptExecutionContextUnavailableError(*state, throwScope, \&quot;${visibleInterfaceName}\&quot;);\n&quot;);
</ins><span class="cx">             }
</span><span class="cx">             if ($codeGenerator-&gt;ExtendedAttributeContains($interface-&gt;extendedAttributes-&gt;{&quot;ConstructorCallWith&quot;}, &quot;Document&quot;)) {
</span><span class="cx">                 $implIncludes{&quot;Document.h&quot;} = 1;
</span><span class="lines">@@ -5363,7 +5388,7 @@
</span><span class="cx">                 push(@constructorArgList, &quot;document&quot;);
</span><span class="cx">                 push(@$outputArray, &quot;    ScriptExecutionContext* context = castedThis-&gt;scriptExecutionContext();\n&quot;);
</span><span class="cx">                 push(@$outputArray, &quot;    if (UNLIKELY(!context))\n&quot;);
</span><del>-                push(@$outputArray, &quot;        return throwConstructorScriptExecutionContextUnavailableError(*state, \&quot;${visibleInterfaceName}\&quot;);\n&quot;);
</del><ins>+                push(@$outputArray, &quot;        return throwConstructorScriptExecutionContextUnavailableError(*state, throwScope, \&quot;${visibleInterfaceName}\&quot;);\n&quot;);
</ins><span class="cx">                 push(@$outputArray, &quot;    ASSERT(context-&gt;isDocument());\n&quot;);
</span><span class="cx">                 push(@$outputArray, &quot;    auto&amp; document = downcast&lt;Document&gt;(*context);\n&quot;);
</span><span class="cx">             }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSInterfaceNamecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -117,18 +117,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsInterfaceNameConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSInterfaceNamePrototype* domObject = jsDynamicCast&lt;JSInterfaceNamePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSInterfaceName::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSInterfaceNameConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSInterfaceNamePrototype* domObject = jsDynamicCast&lt;JSInterfaceNamePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -142,12 +142,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestActiveDOMObjectExcitingAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestActiveDOMObject*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestActiveDOMObject&quot;, &quot;excitingAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestActiveDOMObject&quot;, &quot;excitingAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     if (!BindingSecurity::shouldAllowAccessToFrame(state, castedThis-&gt;wrapped().frame(), ThrowSecurityError))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -159,18 +161,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestActiveDOMObjectConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestActiveDOMObjectPrototype* domObject = jsDynamicCast&lt;JSTestActiveDOMObjectPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestActiveDOMObject::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestActiveDOMObjectConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestActiveDOMObjectPrototype* domObject = jsDynamicCast&lt;JSTestActiveDOMObjectPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -184,19 +190,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestActiveDOMObjectPrototypeFunctionExcitingFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestActiveDOMObject*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestActiveDOMObject&quot;, &quot;excitingFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestActiveDOMObject&quot;, &quot;excitingFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestActiveDOMObject::info());
</span><span class="cx">     if (!BindingSecurity::shouldAllowAccessToFrame(state, castedThis-&gt;wrapped().frame(), ThrowSecurityError))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto nextChild = JSNode::toWrapped(state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(!nextChild))
</span><del>-        return throwArgumentTypeError(*state, 0, &quot;nextChild&quot;, &quot;TestActiveDOMObject&quot;, &quot;excitingFunction&quot;, &quot;Node&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 0, &quot;nextChild&quot;, &quot;TestActiveDOMObject&quot;, &quot;excitingFunction&quot;, &quot;Node&quot;);
</ins><span class="cx">     impl.excitingFunction(*nextChild);
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -203,14 +212,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestActiveDOMObjectPrototypeFunctionPostMessage(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestActiveDOMObject*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestActiveDOMObject&quot;, &quot;postMessage&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestActiveDOMObject&quot;, &quot;postMessage&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestActiveDOMObject::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto message = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -123,18 +123,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestClassWithJSBuiltinConstructorConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestClassWithJSBuiltinConstructorPrototype* domObject = jsDynamicCast&lt;JSTestClassWithJSBuiltinConstructorPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestClassWithJSBuiltinConstructor::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestClassWithJSBuiltinConstructorConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestClassWithJSBuiltinConstructorPrototype* domObject = jsDynamicCast&lt;JSTestClassWithJSBuiltinConstructorPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestCustomConstructorWithNoInterfaceObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -123,9 +123,11 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestCustomConstructorWithNoInterfaceObjectConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestCustomConstructorWithNoInterfaceObjectPrototype* domObject = jsDynamicCast&lt;JSTestCustomConstructorWithNoInterfaceObjectPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     JSValue constructor = JSTestCustomConstructorWithNoInterfaceObjectConstructor::create(state-&gt;vm(), JSTestCustomConstructorWithNoInterfaceObjectConstructor::createStructure(state-&gt;vm(), *domObject-&gt;globalObject(), domObject-&gt;globalObject()-&gt;objectPrototype()), *jsCast&lt;JSDOMGlobalObject*&gt;(domObject-&gt;globalObject()));
</span><span class="cx">     // Shadowing constructor property to ensure reusing the same constructor object
</span><span class="cx">     domObject-&gt;putDirect(state-&gt;vm(), state-&gt;propertyNames().constructor, constructor, DontEnum | ReadOnly);
</span><span class="lines">@@ -134,10 +136,12 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestCustomConstructorWithNoInterfaceObjectConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestCustomConstructorWithNoInterfaceObjectPrototype* domObject = jsDynamicCast&lt;JSTestCustomConstructorWithNoInterfaceObjectPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -160,18 +160,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestCustomNamedGetterConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestCustomNamedGetterPrototype* domObject = jsDynamicCast&lt;JSTestCustomNamedGetterPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestCustomNamedGetter::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestCustomNamedGetterConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestCustomNamedGetterPrototype* domObject = jsDynamicCast&lt;JSTestCustomNamedGetterPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -185,14 +189,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestCustomNamedGetterPrototypeFunctionAnotherFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestCustomNamedGetter*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestCustomNamedGetter&quot;, &quot;anotherFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestCustomNamedGetter&quot;, &quot;anotherFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestCustomNamedGetter::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto str = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -73,14 +73,16 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; EncodedJSValue JSC_HOST_CALL JSTestEventConstructorConstructor::construct(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto* jsConstructor = jsCast&lt;JSTestEventConstructorConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(jsConstructor);
</span><span class="cx"> 
</span><span class="cx">     if (!jsConstructor-&gt;scriptExecutionContext())
</span><del>-        return throwConstructorScriptExecutionContextUnavailableError(*state, &quot;TestEventConstructor&quot;);
</del><ins>+        return throwConstructorScriptExecutionContextUnavailableError(*state, throwScope, &quot;TestEventConstructor&quot;);
</ins><span class="cx"> 
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx"> 
</span><span class="cx">     AtomicString eventType = state-&gt;uncheckedArgument(0).toString(state)-&gt;toAtomicString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -179,12 +181,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestEventConstructorAttr1(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestEventConstructor*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestEventConstructor&quot;, &quot;attr1&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestEventConstructor&quot;, &quot;attr1&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.attr1());
</span><span class="lines">@@ -194,12 +198,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestEventConstructorAttr2(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestEventConstructor*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestEventConstructor&quot;, &quot;attr2&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestEventConstructor&quot;, &quot;attr2&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.attr2());
</span><span class="lines">@@ -210,12 +216,14 @@
</span><span class="cx"> #if ENABLE(SPECIAL_EVENT)
</span><span class="cx"> EncodedJSValue jsTestEventConstructorAttr3(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestEventConstructor*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestEventConstructor&quot;, &quot;attr3&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestEventConstructor&quot;, &quot;attr3&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.attr3());
</span><span class="lines">@@ -226,18 +234,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestEventConstructorConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestEventConstructorPrototype* domObject = jsDynamicCast&lt;JSTestEventConstructorPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestEventConstructor::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestEventConstructorConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestEventConstructorPrototype* domObject = jsDynamicCast&lt;JSTestEventConstructorPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestEventTargetcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -160,18 +160,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestEventTargetConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestEventTargetPrototype* domObject = jsDynamicCast&lt;JSTestEventTargetPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestEventTarget::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestEventTargetConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestEventTargetPrototype* domObject = jsDynamicCast&lt;JSTestEventTargetPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -198,14 +202,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestEventTargetPrototypeFunctionItem(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestEventTarget*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestEventTarget&quot;, &quot;item&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestEventTarget&quot;, &quot;item&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestEventTarget::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto index = convert&lt;uint32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestExceptioncpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -134,12 +134,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestExceptionName(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestException*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestException&quot;, &quot;name&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestException&quot;, &quot;name&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.name());
</span><span class="lines">@@ -149,18 +151,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestExceptionConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestExceptionPrototype* domObject = jsDynamicCast&lt;JSTestExceptionPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestException::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestExceptionConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestExceptionPrototype* domObject = jsDynamicCast&lt;JSTestExceptionPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -117,18 +117,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestGenerateIsReachableConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestGenerateIsReachablePrototype* domObject = jsDynamicCast&lt;JSTestGenerateIsReachablePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestGenerateIsReachable::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestGenerateIsReachableConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestGenerateIsReachablePrototype* domObject = jsDynamicCast&lt;JSTestGenerateIsReachablePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -179,12 +179,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestGlobalObjectRegularAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestGlobalObject&quot;, &quot;regularAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;regularAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.regularAttribute());
</span><span class="lines">@@ -194,12 +196,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestGlobalObjectPublicAndPrivateAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestGlobalObject&quot;, &quot;publicAndPrivateAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;publicAndPrivateAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.publicAndPrivateAttribute());
</span><span class="lines">@@ -210,12 +214,14 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> EncodedJSValue jsTestGlobalObjectPublicAndPrivateConditionalAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestGlobalObject&quot;, &quot;publicAndPrivateConditionalAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;publicAndPrivateConditionalAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.publicAndPrivateConditionalAttribute());
</span><span class="lines">@@ -227,12 +233,14 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> EncodedJSValue jsTestGlobalObjectEnabledAtRuntimeAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestGlobalObject&quot;, &quot;enabledAtRuntimeAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;enabledAtRuntimeAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.enabledAtRuntimeAttribute());
</span><span class="lines">@@ -243,18 +251,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestGlobalObjectConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestGlobalObjectPrototype* domObject = jsDynamicCast&lt;JSTestGlobalObjectPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestGlobalObject::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestGlobalObjectConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestGlobalObjectPrototype* domObject = jsDynamicCast&lt;JSTestGlobalObjectPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -263,11 +275,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestGlobalObjectRegularAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestGlobalObject* castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestGlobalObject&quot;, &quot;regularAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;regularAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -280,11 +294,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestGlobalObjectPublicAndPrivateAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestGlobalObject* castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestGlobalObject&quot;, &quot;publicAndPrivateAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;publicAndPrivateAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -298,11 +314,13 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> bool setJSTestGlobalObjectPublicAndPrivateConditionalAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestGlobalObject* castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestGlobalObject&quot;, &quot;publicAndPrivateConditionalAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;publicAndPrivateConditionalAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -317,11 +335,13 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> bool setJSTestGlobalObjectEnabledAtRuntimeAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestGlobalObject* castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestGlobalObject&quot;, &quot;enabledAtRuntimeAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;enabledAtRuntimeAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -340,14 +360,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestGlobalObjectInstanceFunctionRegularOperation(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestGlobalObject&quot;, &quot;regularOperation&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;regularOperation&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestGlobalObject::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto testParam = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -358,14 +381,17 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> static inline EncodedJSValue jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestGlobalObject&quot;, &quot;enabledAtRuntimeOperation&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;enabledAtRuntimeOperation&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestGlobalObject::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto testParam = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -378,14 +404,17 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> static inline EncodedJSValue jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestGlobalObject&quot;, &quot;enabledAtRuntimeOperation&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;enabledAtRuntimeOperation&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestGlobalObject::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto testParam = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -398,6 +427,9 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());
</span><span class="cx">     if (argsCount == 1) {
</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);
</span><span class="lines">@@ -409,7 +441,7 @@
</span><span class="cx">         return jsTestGlobalObjectInstanceFunctionEnabledAtRuntimeOperation1(state);
</span><span class="cx"> #endif
</span><span class="cx">     }
</span><del>-    return argsCount &lt; 1 ? throwVMError(state, createNotEnoughArgumentsError(state)) : throwVMTypeError(state);
</del><ins>+    return argsCount &lt; 1 ? throwVMError(state, throwScope, createNotEnoughArgumentsError(state)) : throwVMTypeError(state, throwScope);
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="lines">@@ -416,10 +448,13 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestGlobalObjectInstanceFunctionTestPrivateFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestGlobalObject*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestGlobalObject&quot;, &quot;testPrivateFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestGlobalObject&quot;, &quot;testPrivateFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestGlobalObject::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     impl.testPrivateFunction();
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestInterfacecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -222,10 +222,13 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; EncodedJSValue JSC_HOST_CALL JSTestInterfaceConstructor::construct(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestInterfaceConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto str1 = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -235,7 +238,7 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     ScriptExecutionContext* context = castedThis-&gt;scriptExecutionContext();
</span><span class="cx">     if (UNLIKELY(!context))
</span><del>-        return throwConstructorScriptExecutionContextUnavailableError(*state, &quot;TestInterface&quot;);
</del><ins>+        return throwConstructorScriptExecutionContextUnavailableError(*state, throwScope, &quot;TestInterface&quot;);
</ins><span class="cx">     auto object = TestInterface::create(*context, WTFMove(str1), WTFMove(str2), ec);
</span><span class="cx">     if (UNLIKELY(ec)) {
</span><span class="cx">         setDOMException(state, ec);
</span><span class="lines">@@ -412,7 +415,9 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> EncodedJSValue jsTestInterfaceConstructorImplementsStaticReadOnlyAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue result = jsNumber(TestInterface::implementsStaticReadOnlyAttr());
</span><span class="cx">     return JSValue::encode(result);
</span><span class="lines">@@ -423,7 +428,9 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> EncodedJSValue jsTestInterfaceConstructorImplementsStaticAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue result = jsStringWithCache(state, TestInterface::implementsStaticAttr());
</span><span class="cx">     return JSValue::encode(result);
</span><span class="lines">@@ -434,12 +441,14 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> EncodedJSValue jsTestInterfaceImplementsStr1(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestInterface&quot;, &quot;implementsStr1&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsStr1&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.implementsStr1());
</span><span class="lines">@@ -451,12 +460,14 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> EncodedJSValue jsTestInterfaceImplementsStr2(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestInterface&quot;, &quot;implementsStr2&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsStr2&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.implementsStr2());
</span><span class="lines">@@ -468,12 +479,14 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> EncodedJSValue jsTestInterfaceImplementsStr3(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestInterface&quot;, &quot;implementsStr3&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsStr3&quot;);
</ins><span class="cx">     }
</span><span class="cx">     return JSValue::encode(castedThis-&gt;implementsStr3(*state));
</span><span class="cx"> }
</span><span class="lines">@@ -483,12 +496,14 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> EncodedJSValue jsTestInterfaceImplementsNode(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestInterface&quot;, &quot;implementsNode&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsNode&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.implementsNode());
</span><span class="lines">@@ -500,7 +515,9 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> EncodedJSValue jsTestInterfaceConstructorSupplementalStaticReadOnlyAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue result = jsNumber(WebCore::TestSupplemental::supplementalStaticReadOnlyAttr());
</span><span class="cx">     return JSValue::encode(result);
</span><span class="lines">@@ -511,7 +528,9 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> EncodedJSValue jsTestInterfaceConstructorSupplementalStaticAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue result = jsStringWithCache(state, WebCore::TestSupplemental::supplementalStaticAttr());
</span><span class="cx">     return JSValue::encode(result);
</span><span class="lines">@@ -522,12 +541,14 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> EncodedJSValue jsTestInterfaceSupplementalStr1(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalStr1&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalStr1&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, WebCore::TestSupplemental::supplementalStr1(impl));
</span><span class="lines">@@ -539,12 +560,14 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> EncodedJSValue jsTestInterfaceSupplementalStr2(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalStr2&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalStr2&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, WebCore::TestSupplemental::supplementalStr2(impl));
</span><span class="lines">@@ -556,12 +579,14 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> EncodedJSValue jsTestInterfaceSupplementalStr3(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalStr3&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalStr3&quot;);
</ins><span class="cx">     }
</span><span class="cx">     return JSValue::encode(castedThis-&gt;supplementalStr3(*state));
</span><span class="cx"> }
</span><span class="lines">@@ -571,12 +596,14 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> EncodedJSValue jsTestInterfaceSupplementalNode(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalNode&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalNode&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), WebCore::TestSupplemental::supplementalNode(impl));
</span><span class="lines">@@ -587,18 +614,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestInterfaceConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestInterfacePrototype* domObject = jsDynamicCast&lt;JSTestInterfacePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestInterface::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestInterfaceConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestInterfacePrototype* domObject = jsDynamicCast&lt;JSTestInterfacePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -630,7 +661,9 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> bool setJSTestInterfaceConstructorImplementsStaticAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return false;
</span><span class="lines">@@ -643,11 +676,13 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> bool setJSTestInterfaceImplementsStr2(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestInterface&quot;, &quot;implementsStr2&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsStr2&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -662,11 +697,13 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> bool setJSTestInterfaceImplementsStr3(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestInterface&quot;, &quot;implementsStr3&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsStr3&quot;);
</ins><span class="cx">     }
</span><span class="cx">     castedThis-&gt;setImplementsStr3(*state, value);
</span><span class="cx">     return true;
</span><span class="lines">@@ -677,16 +714,18 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> bool setJSTestInterfaceImplementsNode(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestInterface&quot;, &quot;implementsNode&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsNode&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSNode::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestInterface&quot;, &quot;implementsNode&quot;, &quot;Node&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsNode&quot;, &quot;Node&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     impl.setImplementsNode(*nativeValue);
</span><span class="lines">@@ -698,7 +737,9 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> bool setJSTestInterfaceConstructorSupplementalStaticAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return false;
</span><span class="lines">@@ -711,11 +752,13 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> bool setJSTestInterfaceSupplementalStr2(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalStr2&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalStr2&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -730,11 +773,13 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> bool setJSTestInterfaceSupplementalStr3(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalStr3&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalStr3&quot;);
</ins><span class="cx">     }
</span><span class="cx">     castedThis-&gt;setSupplementalStr3(*state, value);
</span><span class="cx">     return true;
</span><span class="lines">@@ -745,16 +790,18 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> bool setJSTestInterfaceSupplementalNode(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestInterface* castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalNode&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalNode&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSNode::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalNode&quot;, &quot;Node&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalNode&quot;, &quot;Node&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     WebCore::TestSupplemental::setSupplementalNode(impl, *nativeValue);
</span><span class="lines">@@ -771,10 +818,13 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionImplementsMethod1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestInterface&quot;, &quot;implementsMethod1&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsMethod1&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestInterface::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     impl.implementsMethod1();
</span><span class="lines">@@ -786,14 +836,17 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionImplementsMethod2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestInterface&quot;, &quot;implementsMethod2&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsMethod2&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestInterface::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="cx">     if (!context)
</span><span class="lines">@@ -803,7 +856,7 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto objArg = JSTestObj::toWrapped(state-&gt;argument(1));
</span><span class="cx">     if (UNLIKELY(!objArg))
</span><del>-        return throwArgumentTypeError(*state, 1, &quot;objArg&quot;, &quot;TestInterface&quot;, &quot;implementsMethod2&quot;, &quot;TestObj&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 1, &quot;objArg&quot;, &quot;TestInterface&quot;, &quot;implementsMethod2&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.implementsMethod2(*context, WTFMove(strArg), *objArg, ec));
</span><span class="cx"> 
</span><span class="cx">     setDOMException(state, ec);
</span><span class="lines">@@ -815,10 +868,13 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionImplementsMethod3(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestInterface&quot;, &quot;implementsMethod3&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;implementsMethod3&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestInterface::info());
</span><span class="cx">     return JSValue::encode(castedThis-&gt;implementsMethod3(*state));
</span><span class="cx"> }
</span><span class="lines">@@ -828,6 +884,9 @@
</span><span class="cx"> #if ENABLE(Condition22) || ENABLE(Condition23)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestInterfaceConstructorFunctionImplementsMethod4(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     TestInterface::implementsMethod4();
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -837,10 +896,13 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalMethod1&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalMethod1&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestInterface::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     WebCore::TestSupplemental::supplementalMethod1(impl);
</span><span class="lines">@@ -852,14 +914,17 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalMethod2&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalMethod2&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestInterface::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="cx">     if (!context)
</span><span class="lines">@@ -869,7 +934,7 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto objArg = JSTestObj::toWrapped(state-&gt;argument(1));
</span><span class="cx">     if (UNLIKELY(!objArg))
</span><del>-        return throwArgumentTypeError(*state, 1, &quot;objArg&quot;, &quot;TestInterface&quot;, &quot;supplementalMethod2&quot;, &quot;TestObj&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 1, &quot;objArg&quot;, &quot;TestInterface&quot;, &quot;supplementalMethod2&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), WebCore::TestSupplemental::supplementalMethod2(impl, *context, WTFMove(strArg), *objArg, ec));
</span><span class="cx"> 
</span><span class="cx">     setDOMException(state, ec);
</span><span class="lines">@@ -881,10 +946,13 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod3(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestInterface*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestInterface&quot;, &quot;supplementalMethod3&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestInterface&quot;, &quot;supplementalMethod3&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestInterface::info());
</span><span class="cx">     return JSValue::encode(castedThis-&gt;supplementalMethod3(*state));
</span><span class="cx"> }
</span><span class="lines">@@ -894,6 +962,9 @@
</span><span class="cx"> #if ENABLE(Condition11) || ENABLE(Condition12)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestInterfaceConstructorFunctionSupplementalMethod4(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     WebCore::TestSupplemental::supplementalMethod4();
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestIterablecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -131,18 +131,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestIterableConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestIterablePrototype* domObject = jsDynamicCast&lt;JSTestIterablePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestIterable::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestIterableConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestIterablePrototype* domObject = jsDynamicCast&lt;JSTestIterablePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestJSBuiltinConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -134,12 +134,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestJSBuiltinConstructorTestAttributeCustom(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestJSBuiltinConstructor*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestJSBuiltinConstructor&quot;, &quot;testAttributeCustom&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestJSBuiltinConstructor&quot;, &quot;testAttributeCustom&quot;);
</ins><span class="cx">     }
</span><span class="cx">     return JSValue::encode(castedThis-&gt;testAttributeCustom(*state));
</span><span class="cx"> }
</span><span class="lines">@@ -147,12 +149,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestJSBuiltinConstructorTestAttributeRWCustom(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestJSBuiltinConstructor*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestJSBuiltinConstructor&quot;, &quot;testAttributeRWCustom&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestJSBuiltinConstructor&quot;, &quot;testAttributeRWCustom&quot;);
</ins><span class="cx">     }
</span><span class="cx">     return JSValue::encode(castedThis-&gt;testAttributeRWCustom(*state));
</span><span class="cx"> }
</span><span class="lines">@@ -160,18 +164,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestJSBuiltinConstructorConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestJSBuiltinConstructorPrototype* domObject = jsDynamicCast&lt;JSTestJSBuiltinConstructorPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestJSBuiltinConstructor::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestJSBuiltinConstructorConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestJSBuiltinConstructorPrototype* domObject = jsDynamicCast&lt;JSTestJSBuiltinConstructorPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -180,11 +188,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestJSBuiltinConstructorTestAttributeRWCustom(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestJSBuiltinConstructor* castedThis = jsDynamicCast&lt;JSTestJSBuiltinConstructor*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestJSBuiltinConstructor&quot;, &quot;testAttributeRWCustom&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestJSBuiltinConstructor&quot;, &quot;testAttributeRWCustom&quot;);
</ins><span class="cx">     }
</span><span class="cx">     castedThis-&gt;setTestAttributeRWCustom(*state, value);
</span><span class="cx">     return true;
</span><span class="lines">@@ -198,10 +208,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestJSBuiltinConstructorPrototypeFunctionTestCustomFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestJSBuiltinConstructor*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestJSBuiltinConstructor&quot;, &quot;testCustomFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestJSBuiltinConstructor&quot;, &quot;testCustomFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestJSBuiltinConstructor::info());
</span><span class="cx">     return JSValue::encode(castedThis-&gt;testCustomFunction(*state));
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenercpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -125,18 +125,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestMediaQueryListListenerConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestMediaQueryListListenerPrototype* domObject = jsDynamicCast&lt;JSTestMediaQueryListListenerPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestMediaQueryListListener::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestMediaQueryListListenerConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestMediaQueryListListenerPrototype* domObject = jsDynamicCast&lt;JSTestMediaQueryListListenerPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -150,16 +154,19 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestMediaQueryListListenerPrototypeFunctionMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestMediaQueryListListener*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestMediaQueryListListener&quot;, &quot;method&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestMediaQueryListListener&quot;, &quot;method&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestMediaQueryListListener::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     if (UNLIKELY(!state-&gt;argument(0).isFunction()))
</span><del>-        return throwArgumentMustBeFunctionError(*state, 0, &quot;listener&quot;, &quot;TestMediaQueryListListener&quot;, &quot;method&quot;);
</del><ins>+        return throwArgumentMustBeFunctionError(*state, throwScope, 0, &quot;listener&quot;, &quot;TestMediaQueryListListener&quot;, &quot;method&quot;);
</ins><span class="cx">     auto listener = JSMediaQueryListListener::create(asObject(state-&gt;uncheckedArgument(0)), castedThis-&gt;globalObject());
</span><span class="cx">     impl.method(WTFMove(listener));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestNamedConstructorcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -82,10 +82,13 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; EncodedJSValue JSC_HOST_CALL JSTestNamedConstructorNamedConstructor::construct(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestNamedConstructorNamedConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto str1 = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -159,18 +162,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestNamedConstructorConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestNamedConstructorPrototype* domObject = jsDynamicCast&lt;JSTestNamedConstructorPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestNamedConstructor::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestNamedConstructorConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestNamedConstructorPrototype* domObject = jsDynamicCast&lt;JSTestNamedConstructorPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestNodecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -79,6 +79,9 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; EncodedJSValue JSC_HOST_CALL JSTestNodeConstructor::construct(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestNodeConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     auto object = TestNode::create();
</span><span class="lines">@@ -161,12 +164,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestNodeName(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestNode*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestNode&quot;, &quot;name&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestNode&quot;, &quot;name&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.name());
</span><span class="lines">@@ -176,18 +181,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestNodeConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestNodePrototype* domObject = jsDynamicCast&lt;JSTestNodePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestNode::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestNodeConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestNodePrototype* domObject = jsDynamicCast&lt;JSTestNodePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -196,11 +205,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestNodeName(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestNode* castedThis = jsDynamicCast&lt;JSTestNode*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestNode&quot;, &quot;name&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestNode&quot;, &quot;name&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestNondeterministiccpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -146,12 +146,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestNondeterministicNondeterministicReadonlyAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestNondeterministic*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestNondeterministic&quot;, &quot;nondeterministicReadonlyAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestNondeterministic&quot;, &quot;nondeterministicReadonlyAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx"> #if ENABLE(WEB_REPLAY)
</span><span class="cx">     JSGlobalObject* globalObject = state-&gt;lexicalGlobalObject();
</span><span class="lines">@@ -181,12 +183,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestNondeterministicNondeterministicWriteableAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestNondeterministic*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestNondeterministic&quot;, &quot;nondeterministicWriteableAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestNondeterministic&quot;, &quot;nondeterministicWriteableAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx"> #if ENABLE(WEB_REPLAY)
</span><span class="cx">     JSGlobalObject* globalObject = state-&gt;lexicalGlobalObject();
</span><span class="lines">@@ -216,12 +220,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestNondeterministicNondeterministicExceptionAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestNondeterministic*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestNondeterministic&quot;, &quot;nondeterministicExceptionAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestNondeterministic&quot;, &quot;nondeterministicExceptionAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx"> #if ENABLE(WEB_REPLAY)
</span><span class="cx">     JSGlobalObject* globalObject = state-&gt;lexicalGlobalObject();
</span><span class="lines">@@ -251,12 +257,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestNondeterministicNondeterministicGetterExceptionAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestNondeterministic*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestNondeterministic&quot;, &quot;nondeterministicGetterExceptionAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestNondeterministic&quot;, &quot;nondeterministicGetterExceptionAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx"> #if ENABLE(WEB_REPLAY)
</span><span class="lines">@@ -290,12 +298,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestNondeterministicNondeterministicSetterExceptionAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestNondeterministic*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestNondeterministic&quot;, &quot;nondeterministicSetterExceptionAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestNondeterministic&quot;, &quot;nondeterministicSetterExceptionAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx"> #if ENABLE(WEB_REPLAY)
</span><span class="cx">     JSGlobalObject* globalObject = state-&gt;lexicalGlobalObject();
</span><span class="lines">@@ -325,18 +335,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestNondeterministicConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestNondeterministicPrototype* domObject = jsDynamicCast&lt;JSTestNondeterministicPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestNondeterministic::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestNondeterministicConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestNondeterministicPrototype* domObject = jsDynamicCast&lt;JSTestNondeterministicPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -345,11 +359,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestNondeterministicNondeterministicWriteableAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestNondeterministic* castedThis = jsDynamicCast&lt;JSTestNondeterministic*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestNondeterministic&quot;, &quot;nondeterministicWriteableAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestNondeterministic&quot;, &quot;nondeterministicWriteableAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -362,11 +378,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestNondeterministicNondeterministicExceptionAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestNondeterministic* castedThis = jsDynamicCast&lt;JSTestNondeterministic*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestNondeterministic&quot;, &quot;nondeterministicExceptionAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestNondeterministic&quot;, &quot;nondeterministicExceptionAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -379,11 +397,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestNondeterministicNondeterministicGetterExceptionAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestNondeterministic* castedThis = jsDynamicCast&lt;JSTestNondeterministic*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestNondeterministic&quot;, &quot;nondeterministicGetterExceptionAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestNondeterministic&quot;, &quot;nondeterministicGetterExceptionAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -396,11 +416,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestNondeterministicNondeterministicSetterExceptionAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestNondeterministic* castedThis = jsDynamicCast&lt;JSTestNondeterministic*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestNondeterministic&quot;, &quot;nondeterministicSetterExceptionAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestNondeterministic&quot;, &quot;nondeterministicSetterExceptionAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -420,10 +442,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestNondeterministicPrototypeFunctionNondeterministicZeroArgFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestNondeterministic*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestNondeterministic&quot;, &quot;nondeterministicZeroArgFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestNondeterministic&quot;, &quot;nondeterministicZeroArgFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestNondeterministic::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestObjcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -130,9 +130,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; TestObj::EnumType convert&lt;TestObj::EnumType&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto result = parse&lt;TestObj::EnumType&gt;(state, value);
</span><span class="cx">     if (UNLIKELY(!result)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return { };
</span><span class="cx">     }
</span><span class="cx">     return result.value();
</span><span class="lines">@@ -181,9 +183,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; TestObj::Optional convert&lt;TestObj::Optional&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto result = parse&lt;TestObj::Optional&gt;(state, value);
</span><span class="cx">     if (UNLIKELY(!result)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return { };
</span><span class="cx">     }
</span><span class="cx">     return result.value();
</span><span class="lines">@@ -224,9 +228,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; AlternateEnumName convert&lt;AlternateEnumName&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto result = parse&lt;AlternateEnumName&gt;(state, value);
</span><span class="cx">     if (UNLIKELY(!result)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return { };
</span><span class="cx">     }
</span><span class="cx">     return result.value();
</span><span class="lines">@@ -265,9 +271,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; TestObj::EnumA convert&lt;TestObj::EnumA&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto result = parse&lt;TestObj::EnumA&gt;(state, value);
</span><span class="cx">     if (UNLIKELY(!result)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return { };
</span><span class="cx">     }
</span><span class="cx">     return result.value();
</span><span class="lines">@@ -308,9 +316,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; TestObj::EnumB convert&lt;TestObj::EnumB&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto result = parse&lt;TestObj::EnumB&gt;(state, value);
</span><span class="cx">     if (UNLIKELY(!result)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return { };
</span><span class="cx">     }
</span><span class="cx">     return result.value();
</span><span class="lines">@@ -351,9 +361,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; TestObj::EnumC convert&lt;TestObj::EnumC&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto result = parse&lt;TestObj::EnumC&gt;(state, value);
</span><span class="cx">     if (UNLIKELY(!result)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return { };
</span><span class="cx">     }
</span><span class="cx">     return result.value();
</span><span class="lines">@@ -396,9 +408,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; TestObj::Kind convert&lt;TestObj::Kind&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto result = parse&lt;TestObj::Kind&gt;(state, value);
</span><span class="cx">     if (UNLIKELY(!result)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return { };
</span><span class="cx">     }
</span><span class="cx">     return result.value();
</span><span class="lines">@@ -439,9 +453,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; TestObj::Size convert&lt;TestObj::Size&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto result = parse&lt;TestObj::Size&gt;(state, value);
</span><span class="cx">     if (UNLIKELY(!result)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return { };
</span><span class="cx">     }
</span><span class="cx">     return result.value();
</span><span class="lines">@@ -482,9 +498,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; TestObj::Confidence convert&lt;TestObj::Confidence&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto result = parse&lt;TestObj::Confidence&gt;(state, value);
</span><span class="cx">     if (UNLIKELY(!result)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return { };
</span><span class="cx">     }
</span><span class="cx">     return result.value();
</span><span class="lines">@@ -497,11 +515,13 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; Optional&lt;TestObj::Dictionary&gt; convertDictionary&lt;TestObj::Dictionary&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (value.isUndefinedOrNull())
</span><span class="cx">         return TestObj::Dictionary { { }, TestObj::EnumType::EnumValue1, TestObj::EnumType::EmptyString, &quot;defaultString&quot;, { }, false, { }, { }, { }, { }, 0, 0, { }, { }, 0, 0, { }, { }, { }, 0, { }, 0, { }, 0, { }, 0, { }, 0, nullptr, jsUndefined(), jsUndefined(), { } };
</span><span class="cx">     auto* object = value.getObject();
</span><span class="cx">     if (UNLIKELY(!object || object-&gt;type() == RegExpObjectType)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return Nullopt;
</span><span class="cx">     }
</span><span class="cx">     auto enumerationValueWithoutDefault = convertOptional&lt;TestObj::EnumType&gt;(state, object-&gt;get(&amp;state, Identifier::fromString(&amp;state, &quot;enumerationValueWithoutDefault&quot;)));
</span><span class="lines">@@ -603,9 +623,11 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; Optional&lt;TestObj::DictionaryThatShouldNotTolerateNull&gt; convertDictionary&lt;TestObj::DictionaryThatShouldNotTolerateNull&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     auto* object = value.getObject();
</span><span class="cx">     if (UNLIKELY(!object || object-&gt;type() == RegExpObjectType)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return Nullopt;
</span><span class="cx">     }
</span><span class="cx">     auto requiredEnumerationValue = convert&lt;TestObj::EnumType&gt;(state, object-&gt;get(&amp;state, Identifier::fromString(&amp;state, &quot;requiredEnumerationValue&quot;)));
</span><span class="lines">@@ -623,11 +645,13 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; Optional&lt;TestObj::DictionaryThatShouldTolerateNull&gt; convertDictionary&lt;TestObj::DictionaryThatShouldTolerateNull&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (value.isUndefinedOrNull())
</span><span class="cx">         return TestObj::DictionaryThatShouldTolerateNull { { }, { } };
</span><span class="cx">     auto* object = value.getObject();
</span><span class="cx">     if (UNLIKELY(!object || object-&gt;type() == RegExpObjectType)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return Nullopt;
</span><span class="cx">     }
</span><span class="cx">     auto enumerationValue = convertOptional&lt;TestObj::EnumType&gt;(state, object-&gt;get(&amp;state, Identifier::fromString(&amp;state, &quot;enumerationValue&quot;)));
</span><span class="lines">@@ -639,11 +663,13 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; Optional&lt;AlternateDictionaryName&gt; convertDictionary&lt;AlternateDictionaryName&gt;(ExecState&amp; state, JSValue value)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state.vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     if (value.isUndefinedOrNull())
</span><span class="cx">         return AlternateDictionaryName { { }, { } };
</span><span class="cx">     auto* object = value.getObject();
</span><span class="cx">     if (UNLIKELY(!object || object-&gt;type() == RegExpObjectType)) {
</span><del>-        throwTypeError(&amp;state);
</del><ins>+        throwTypeError(&amp;state, throwScope);
</ins><span class="cx">         return Nullopt;
</span><span class="cx">     }
</span><span class="cx">     auto enumerationValue = convertOptional&lt;TestObj::EnumType&gt;(state, object-&gt;get(&amp;state, Identifier::fromString(&amp;state, &quot;enumerationValue&quot;)));
</span><span class="lines">@@ -1102,19 +1128,22 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; EncodedJSValue JSC_HOST_CALL JSTestObjConstructor::construct(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestObjConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     if (UNLIKELY(!state-&gt;argument(0).isObject()))
</span><del>-        return throwArgumentMustBeFunctionError(*state, 0, &quot;testCallback&quot;, &quot;TestObject&quot;, nullptr);
</del><ins>+        return throwArgumentMustBeFunctionError(*state, throwScope, 0, &quot;testCallback&quot;, &quot;TestObject&quot;, nullptr);
</ins><span class="cx">     auto testCallback = JSTestCallback::create(asObject(state-&gt;uncheckedArgument(0)), castedThis-&gt;globalObject());
</span><span class="cx">     if (UNLIKELY(!state-&gt;argument(1).isFunction()))
</span><del>-        return throwArgumentMustBeFunctionError(*state, 1, &quot;testCallbackFunction&quot;, &quot;TestObject&quot;, nullptr);
</del><ins>+        return throwArgumentMustBeFunctionError(*state, throwScope, 1, &quot;testCallbackFunction&quot;, &quot;TestObject&quot;, nullptr);
</ins><span class="cx">     auto testCallbackFunction = JSTestCallbackFunction::create(asObject(state-&gt;uncheckedArgument(1)), castedThis-&gt;globalObject());
</span><span class="cx">     ScriptExecutionContext* context = castedThis-&gt;scriptExecutionContext();
</span><span class="cx">     if (UNLIKELY(!context))
</span><del>-        return throwConstructorScriptExecutionContextUnavailableError(*state, &quot;TestObject&quot;);
</del><ins>+        return throwConstructorScriptExecutionContextUnavailableError(*state, throwScope, &quot;TestObject&quot;);
</ins><span class="cx">     ASSERT(context-&gt;isDocument());
</span><span class="cx">     auto&amp; document = downcast&lt;Document&gt;(*context);
</span><span class="cx">     auto object = TestObj::create(document, *testCallback, *testCallbackFunction);
</span><span class="lines">@@ -1495,12 +1524,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReadOnlyLongAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;readOnlyLongAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;readOnlyLongAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.readOnlyLongAttr());
</span><span class="lines">@@ -1510,12 +1541,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReadOnlyStringAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;readOnlyStringAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;readOnlyStringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.readOnlyStringAttr());
</span><span class="lines">@@ -1525,12 +1558,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReadOnlyTestObjAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;readOnlyTestObjAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;readOnlyTestObjAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.readOnlyTestObjAttr());
</span><span class="lines">@@ -1540,7 +1575,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjConstructorStaticReadOnlyLongAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue result = jsNumber(TestObj::staticReadOnlyLongAttr());
</span><span class="cx">     return JSValue::encode(result);
</span><span class="lines">@@ -1549,7 +1586,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjConstructorStaticStringAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue result = jsStringWithCache(state, TestObj::staticStringAttr());
</span><span class="cx">     return JSValue::encode(result);
</span><span class="lines">@@ -1558,12 +1597,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjConstructorTestSubObj(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;TestSubObj&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;TestSubObj&quot;);
</ins><span class="cx">     }
</span><span class="cx">     return JSValue::encode(JSTestSubObj::getConstructor(state-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="lines">@@ -1571,12 +1612,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjTestSubObjEnabledBySettingConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;TestSubObjEnabledBySetting&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;TestSubObjEnabledBySetting&quot;);
</ins><span class="cx">     }
</span><span class="cx">     if (UNLIKELY(!castedThis-&gt;wrapped().frame()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -1589,12 +1632,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjEnumAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;enumAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;enumAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.enumAttr());
</span><span class="lines">@@ -1604,12 +1649,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjByteAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;byteAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;byteAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.byteAttr());
</span><span class="lines">@@ -1619,12 +1666,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjOctetAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;octetAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;octetAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.octetAttr());
</span><span class="lines">@@ -1634,12 +1683,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjShortAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;shortAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;shortAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.shortAttr());
</span><span class="lines">@@ -1649,12 +1700,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjClampedShortAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;clampedShortAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;clampedShortAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.clampedShortAttr());
</span><span class="lines">@@ -1664,12 +1717,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjEnforceRangeShortAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;enforceRangeShortAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;enforceRangeShortAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.enforceRangeShortAttr());
</span><span class="lines">@@ -1679,12 +1734,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjUnsignedShortAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;unsignedShortAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;unsignedShortAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.unsignedShortAttr());
</span><span class="lines">@@ -1694,12 +1751,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjLongAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;longAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;longAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.longAttr());
</span><span class="lines">@@ -1709,12 +1768,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjLongLongAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;longLongAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;longLongAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.longLongAttr());
</span><span class="lines">@@ -1724,12 +1785,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjUnsignedLongLongAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;unsignedLongLongAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;unsignedLongLongAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.unsignedLongLongAttr());
</span><span class="lines">@@ -1739,12 +1802,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjStringAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;stringAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.stringAttr());
</span><span class="lines">@@ -1754,12 +1819,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjUsvstringAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;usvstringAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;usvstringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.usvstringAttr());
</span><span class="lines">@@ -1769,12 +1836,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjTestObjAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;testObjAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testObjAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.testObjAttr());
</span><span class="lines">@@ -1784,12 +1853,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjTestNullableObjAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;testNullableObjAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testNullableObjAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.testNullableObjAttr());
</span><span class="lines">@@ -1799,7 +1870,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjLenientTestObjAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="lines">@@ -1814,12 +1887,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjUnforgeableAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;unforgeableAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;unforgeableAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.unforgeableAttr());
</span><span class="lines">@@ -1829,12 +1904,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjStringAttrTreatingNullAsEmptyString(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;stringAttrTreatingNullAsEmptyString&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringAttrTreatingNullAsEmptyString&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.stringAttrTreatingNullAsEmptyString());
</span><span class="lines">@@ -1844,12 +1921,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjUsvstringAttrTreatingNullAsEmptyString(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;usvstringAttrTreatingNullAsEmptyString&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;usvstringAttrTreatingNullAsEmptyString&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.usvstringAttrTreatingNullAsEmptyString());
</span><span class="lines">@@ -1859,12 +1938,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjImplementationEnumAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;implementationEnumAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;implementationEnumAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.implementationEnumAttr());
</span><span class="lines">@@ -1874,12 +1955,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjXMLObjAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;XMLObjAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;XMLObjAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.xmlObjAttr());
</span><span class="lines">@@ -1889,12 +1972,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjCreate(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;create&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;create&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsBoolean(impl.isCreate());
</span><span class="lines">@@ -1904,12 +1989,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedStringAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedStringAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedStringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.attributeWithoutSynchronization(WebCore::HTMLNames::reflectedstringattrAttr));
</span><span class="lines">@@ -1919,12 +2006,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedUSVStringAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedUSVStringAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedUSVStringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.attributeWithoutSynchronization(WebCore::HTMLNames::reflectedusvstringattrAttr));
</span><span class="lines">@@ -1934,12 +2023,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedIntegralAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedIntegralAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedIntegralAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.getIntegralAttribute(WebCore::HTMLNames::reflectedintegralattrAttr));
</span><span class="lines">@@ -1949,12 +2040,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedUnsignedIntegralAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedUnsignedIntegralAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedUnsignedIntegralAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(std::max(0, impl.getIntegralAttribute(WebCore::HTMLNames::reflectedunsignedintegralattrAttr)));
</span><span class="lines">@@ -1964,12 +2057,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedBooleanAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedBooleanAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedBooleanAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsBoolean(impl.hasAttributeWithoutSynchronization(WebCore::HTMLNames::reflectedbooleanattrAttr));
</span><span class="lines">@@ -1979,12 +2074,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedURLAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedURLAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedURLAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.getURLAttribute(WebCore::HTMLNames::reflectedurlattrAttr));
</span><span class="lines">@@ -1994,12 +2091,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedUSVURLAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedUSVURLAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedUSVURLAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.getURLAttribute(WebCore::HTMLNames::reflectedusvurlattrAttr));
</span><span class="lines">@@ -2009,12 +2108,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedStringAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedStringAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedStringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.attributeWithoutSynchronization(WebCore::HTMLNames::customContentStringAttrAttr));
</span><span class="lines">@@ -2024,12 +2125,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedCustomIntegralAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedCustomIntegralAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedCustomIntegralAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.getIntegralAttribute(WebCore::HTMLNames::customContentIntegralAttrAttr));
</span><span class="lines">@@ -2039,12 +2142,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedCustomBooleanAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedCustomBooleanAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedCustomBooleanAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsBoolean(impl.hasAttributeWithoutSynchronization(WebCore::HTMLNames::customContentBooleanAttrAttr));
</span><span class="lines">@@ -2054,12 +2159,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReflectedCustomURLAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedCustomURLAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedCustomURLAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.getURLAttribute(WebCore::HTMLNames::customContentURLAttrAttr));
</span><span class="lines">@@ -2070,12 +2177,14 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> EncodedJSValue jsTestObjEnabledAtRuntimeAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;enabledAtRuntimeAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;enabledAtRuntimeAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.enabledAtRuntimeAttribute());
</span><span class="lines">@@ -2086,12 +2195,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjTypedArrayAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;typedArrayAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;typedArrayAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.typedArrayAttr());
</span><span class="lines">@@ -2101,12 +2212,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjAttrWithGetterException(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;attrWithGetterException&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attrWithGetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="lines">@@ -2118,12 +2231,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjAttrWithGetterExceptionWithMessage(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;attrWithGetterExceptionWithMessage&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attrWithGetterExceptionWithMessage&quot;);
</ins><span class="cx">     }
</span><span class="cx">     ExceptionCodeWithMessage ec;
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="lines">@@ -2135,12 +2250,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjAttrWithSetterException(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;attrWithSetterException&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attrWithSetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.attrWithSetterException());
</span><span class="lines">@@ -2150,12 +2267,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjAttrWithSetterExceptionWithMessage(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;attrWithSetterExceptionWithMessage&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attrWithSetterExceptionWithMessage&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.attrWithSetterExceptionWithMessage());
</span><span class="lines">@@ -2165,12 +2284,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjStringAttrWithGetterException(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;stringAttrWithGetterException&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringAttrWithGetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="lines">@@ -2182,12 +2303,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjStringAttrWithSetterException(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;stringAttrWithSetterException&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringAttrWithSetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.stringAttrWithSetterException());
</span><span class="lines">@@ -2197,12 +2320,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjCustomAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;customAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;customAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     return JSValue::encode(castedThis-&gt;customAttr(*state));
</span><span class="cx"> }
</span><span class="lines">@@ -2210,12 +2335,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjOnfoo(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;onfoo&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;onfoo&quot;);
</ins><span class="cx">     }
</span><span class="cx">     UNUSED_PARAM(state);
</span><span class="cx">     return JSValue::encode(eventHandlerAttribute(castedThis-&gt;wrapped(), eventNames().fooEvent));
</span><span class="lines">@@ -2224,12 +2351,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjOnwebkitfoo(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;onwebkitfoo&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;onwebkitfoo&quot;);
</ins><span class="cx">     }
</span><span class="cx">     UNUSED_PARAM(state);
</span><span class="cx">     return JSValue::encode(eventHandlerAttribute(castedThis-&gt;wrapped(), eventNames().fooEvent));
</span><span class="lines">@@ -2238,12 +2367,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjWithScriptStateAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptStateAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptStateAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.withScriptStateAttribute(*state));
</span><span class="lines">@@ -2253,12 +2384,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjWithCallWithAndSetterCallWithAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;withCallWithAndSetterCallWithAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withCallWithAndSetterCallWithAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.withCallWithAndSetterCallWithAttribute(*state));
</span><span class="lines">@@ -2268,12 +2401,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjWithScriptExecutionContextAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="cx">     if (!context)
</span><span class="lines">@@ -2286,12 +2421,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjWithScriptStateAttributeRaises(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptStateAttributeRaises&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptStateAttributeRaises&quot;);
</ins><span class="cx">     }
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="lines">@@ -2303,12 +2440,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjWithScriptExecutionContextAttributeRaises(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttributeRaises&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttributeRaises&quot;);
</ins><span class="cx">     }
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -2323,12 +2462,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="cx">     if (!context)
</span><span class="lines">@@ -2341,12 +2482,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttributeRaises&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttributeRaises&quot;);
</ins><span class="cx">     }
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -2361,12 +2504,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateWithSpacesAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateWithSpacesAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="cx">     if (!context)
</span><span class="lines">@@ -2379,12 +2524,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptArgumentsAndCallStackAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptArgumentsAndCallStackAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.withScriptArgumentsAndCallStackAttribute());
</span><span class="lines">@@ -2395,12 +2542,14 @@
</span><span class="cx"> #if ENABLE(Condition1)
</span><span class="cx"> EncodedJSValue jsTestObjConditionalAttr1(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr1&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr1&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.conditionalAttr1());
</span><span class="lines">@@ -2412,12 +2561,14 @@
</span><span class="cx"> #if ENABLE(Condition1) &amp;&amp; ENABLE(Condition2)
</span><span class="cx"> EncodedJSValue jsTestObjConditionalAttr2(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr2&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr2&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.conditionalAttr2());
</span><span class="lines">@@ -2429,12 +2580,14 @@
</span><span class="cx"> #if ENABLE(Condition1) || ENABLE(Condition2)
</span><span class="cx"> EncodedJSValue jsTestObjConditionalAttr3(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr3&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr3&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.conditionalAttr3());
</span><span class="lines">@@ -2446,12 +2599,14 @@
</span><span class="cx"> #if ENABLE(Condition1)
</span><span class="cx"> EncodedJSValue jsTestObjConditionalAttr4Constructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr4&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr4&quot;);
</ins><span class="cx">     }
</span><span class="cx">     return JSValue::encode(JSTestObjectA::getConstructor(state-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="lines">@@ -2461,12 +2616,14 @@
</span><span class="cx"> #if ENABLE(Condition1) &amp;&amp; ENABLE(Condition2)
</span><span class="cx"> EncodedJSValue jsTestObjConditionalAttr5Constructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr5&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr5&quot;);
</ins><span class="cx">     }
</span><span class="cx">     return JSValue::encode(JSTestObjectB::getConstructor(state-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="lines">@@ -2476,12 +2633,14 @@
</span><span class="cx"> #if ENABLE(Condition1) || ENABLE(Condition2)
</span><span class="cx"> EncodedJSValue jsTestObjConditionalAttr6Constructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr6&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr6&quot;);
</ins><span class="cx">     }
</span><span class="cx">     return JSValue::encode(JSTestObjectC::getConstructor(state-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="lines">@@ -2490,12 +2649,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjCachedAttribute1(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;cachedAttribute1&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;cachedAttribute1&quot;);
</ins><span class="cx">     }
</span><span class="cx">     if (JSValue cachedValue = castedThis-&gt;m_cachedAttribute1.get())
</span><span class="cx">         return JSValue::encode(cachedValue);
</span><span class="lines">@@ -2508,12 +2669,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjCachedAttribute2(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;cachedAttribute2&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;cachedAttribute2&quot;);
</ins><span class="cx">     }
</span><span class="cx">     if (JSValue cachedValue = castedThis-&gt;m_cachedAttribute2.get())
</span><span class="cx">         return JSValue::encode(cachedValue);
</span><span class="lines">@@ -2526,12 +2689,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjAnyAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;anyAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;anyAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = impl.anyAttribute();
</span><span class="lines">@@ -2541,12 +2706,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjContentDocument(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;contentDocument&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;contentDocument&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     return JSValue::encode(shouldAllowAccessToNode(state, impl.contentDocument()) ? toJS(state, castedThis-&gt;globalObject(), impl.contentDocument()) : jsNull());
</span><span class="lines">@@ -2555,12 +2722,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjMutablePoint(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;mutablePoint&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;mutablePoint&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), SVGStaticPropertyTearOff&lt;TestObj, SVGPoint&gt;::create(impl, impl.mutablePoint(), &amp;TestObj::updateMutablePoint));
</span><span class="lines">@@ -2570,12 +2739,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjImmutablePoint(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;immutablePoint&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;immutablePoint&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), SVGPropertyTearOff&lt;SVGPoint&gt;::create(impl.immutablePoint()));
</span><span class="lines">@@ -2585,12 +2756,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjStrawberry(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;strawberry&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;strawberry&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.blueberry());
</span><span class="lines">@@ -2600,12 +2773,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjDescription(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;description&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;description&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.description());
</span><span class="lines">@@ -2615,12 +2790,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjId(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;id&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;id&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.id());
</span><span class="lines">@@ -2630,12 +2807,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjHash(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;hash&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;hash&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.hash());
</span><span class="lines">@@ -2645,12 +2824,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjReplaceableAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;replaceableAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;replaceableAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.replaceableAttribute());
</span><span class="lines">@@ -2660,12 +2841,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjNullableDoubleAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableDoubleAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableDoubleAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toNullableJSNumber(impl.nullableDoubleAttribute());
</span><span class="lines">@@ -2675,12 +2858,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjNullableLongAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableLongAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableLongAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toNullableJSNumber(impl.nullableLongAttribute());
</span><span class="lines">@@ -2690,12 +2875,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjNullableBooleanAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableBooleanAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableBooleanAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsBoolean(impl.nullableBooleanAttribute());
</span><span class="lines">@@ -2705,12 +2892,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjNullableStringAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableStringAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableStringAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringOrNull(state, impl.nullableStringAttribute());
</span><span class="lines">@@ -2720,12 +2909,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjNullableLongSettableAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableLongSettableAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableLongSettableAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toNullableJSNumber(impl.nullableLongSettableAttribute());
</span><span class="lines">@@ -2735,12 +2926,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjNullableStringSettableAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableStringSettableAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableStringSettableAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringOrNull(state, impl.nullableStringSettableAttribute());
</span><span class="lines">@@ -2750,12 +2943,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjNullableUSVStringSettableAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableUSVStringSettableAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableUSVStringSettableAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringOrNull(state, impl.nullableUSVStringSettableAttribute());
</span><span class="lines">@@ -2765,12 +2960,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjNullableStringValue(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableStringValue&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableStringValue&quot;);
</ins><span class="cx">     }
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="lines">@@ -2782,12 +2979,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;attribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.attribute());
</span><span class="lines">@@ -2797,12 +2996,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjAttributeWithReservedEnumType(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;attributeWithReservedEnumType&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attributeWithReservedEnumType&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.attributeWithReservedEnumType());
</span><span class="lines">@@ -2812,12 +3013,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjPutForwardsAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;putForwardsAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;putForwardsAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.putForwardsAttribute());
</span><span class="lines">@@ -2827,12 +3030,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjPutForwardsNullableAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;putForwardsNullableAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;putForwardsNullableAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.putForwardsNullableAttribute());
</span><span class="lines">@@ -2842,12 +3047,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjStringifierAttribute(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestObject&quot;, &quot;stringifierAttribute&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringifierAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.stringifierAttribute());
</span><span class="lines">@@ -2857,18 +3064,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestObjConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestObjPrototype* domObject = jsDynamicCast&lt;JSTestObjPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestObj::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestObjPrototype* domObject = jsDynamicCast&lt;JSTestObjPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -2877,7 +3088,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjConstructorStaticStringAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return false;
</span><span class="lines">@@ -2888,11 +3101,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjTestSubObjEnabledBySettingConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;TestSubObjEnabledBySetting&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;TestSubObjEnabledBySetting&quot;);
</ins><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor.
</span><span class="cx">     return castedThis-&gt;putDirect(state-&gt;vm(), Identifier::fromString(state, &quot;TestSubObjEnabledBySetting&quot;), value);
</span><span class="lines">@@ -2901,11 +3116,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjEnumAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;enumAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;enumAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = parse&lt;TestObj::EnumType&gt;(*state, value);
</span><span class="lines">@@ -2920,11 +3137,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjByteAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;byteAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;byteAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int8_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -2937,11 +3156,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjOctetAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;octetAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;octetAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;uint8_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -2954,11 +3175,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjShortAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;shortAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;shortAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int16_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -2971,11 +3194,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjClampedShortAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;clampedShortAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;clampedShortAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int16_t&gt;(*state, value, Clamp);
</span><span class="lines">@@ -2988,11 +3213,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjEnforceRangeShortAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;enforceRangeShortAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;enforceRangeShortAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int16_t&gt;(*state, value, EnforceRange);
</span><span class="lines">@@ -3005,11 +3232,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjUnsignedShortAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;unsignedShortAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;unsignedShortAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;uint16_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3022,11 +3251,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjLongAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;longAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;longAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3039,11 +3270,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjLongLongAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;longLongAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;longLongAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int64_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3056,11 +3289,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjUnsignedLongLongAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;unsignedLongLongAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;unsignedLongLongAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;uint64_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3073,11 +3308,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjStringAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;stringAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -3090,11 +3327,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjUsvstringAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;usvstringAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;usvstringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = valueToUSVString(state, value);
</span><span class="lines">@@ -3107,16 +3346,18 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjTestObjAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;testObjAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testObjAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;testObjAttr&quot;, &quot;TestObj&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testObjAttr&quot;, &quot;TestObj&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     impl.setTestObjAttr(*nativeValue);
</span><span class="lines">@@ -3126,11 +3367,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjTestNullableObjAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;testNullableObjAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testNullableObjAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     TestObj* nativeValue = nullptr;
</span><span class="lines">@@ -3137,7 +3380,7 @@
</span><span class="cx">     if (!value.isUndefinedOrNull()) {
</span><span class="cx">         nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">         if (UNLIKELY(!nativeValue)) {
</span><del>-            throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;testNullableObjAttr&quot;, &quot;TestObj&quot;);
</del><ins>+            throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testNullableObjAttr&quot;, &quot;TestObj&quot;);
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -3148,7 +3391,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjLenientTestObjAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><span class="lines">@@ -3157,7 +3402,7 @@
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;lenientTestObjAttr&quot;, &quot;TestObj&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;lenientTestObjAttr&quot;, &quot;TestObj&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     impl.setLenientTestObjAttr(*nativeValue);
</span><span class="lines">@@ -3167,11 +3412,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjStringAttrTreatingNullAsEmptyString(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;stringAttrTreatingNullAsEmptyString&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringAttrTreatingNullAsEmptyString&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = valueToStringTreatingNullAsEmptyString(state, value);
</span><span class="lines">@@ -3184,11 +3431,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjUsvstringAttrTreatingNullAsEmptyString(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;usvstringAttrTreatingNullAsEmptyString&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;usvstringAttrTreatingNullAsEmptyString&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = valueToUSVStringTreatingNullAsEmptyString(state, value);
</span><span class="lines">@@ -3201,11 +3450,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjImplementationEnumAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;implementationEnumAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;implementationEnumAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = parse&lt;AlternateEnumName&gt;(*state, value);
</span><span class="lines">@@ -3220,16 +3471,18 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjXMLObjAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;XMLObjAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;XMLObjAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;XMLObjAttr&quot;, &quot;TestObj&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;XMLObjAttr&quot;, &quot;TestObj&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     impl.setXMLObjAttr(*nativeValue);
</span><span class="lines">@@ -3239,11 +3492,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjCreate(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;create&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;create&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toBoolean(state);
</span><span class="lines">@@ -3256,11 +3511,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedStringAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedStringAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedStringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -3273,11 +3530,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedUSVStringAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedUSVStringAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedUSVStringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = valueToUSVString(state, value);
</span><span class="lines">@@ -3290,11 +3549,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedIntegralAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedIntegralAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedIntegralAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3307,11 +3568,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedUnsignedIntegralAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedUnsignedIntegralAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedUnsignedIntegralAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;uint32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3324,11 +3587,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedBooleanAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedBooleanAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedBooleanAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toBoolean(state);
</span><span class="lines">@@ -3341,11 +3606,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedURLAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedURLAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedURLAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -3358,11 +3625,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedUSVURLAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedUSVURLAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedUSVURLAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = valueToUSVString(state, value);
</span><span class="lines">@@ -3375,11 +3644,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedStringAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedStringAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedStringAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -3392,11 +3663,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedCustomIntegralAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedCustomIntegralAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedCustomIntegralAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3409,11 +3682,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedCustomBooleanAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedCustomBooleanAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedCustomBooleanAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toBoolean(state);
</span><span class="lines">@@ -3426,11 +3701,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReflectedCustomURLAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;reflectedCustomURLAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;reflectedCustomURLAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -3444,11 +3721,13 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> bool setJSTestObjEnabledAtRuntimeAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;enabledAtRuntimeAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;enabledAtRuntimeAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -3462,11 +3741,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjTypedArrayAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;typedArrayAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;typedArrayAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = toFloat32Array(value);
</span><span class="lines">@@ -3473,7 +3754,7 @@
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return false;
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;typedArrayAttr&quot;, &quot;Float32Array&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;typedArrayAttr&quot;, &quot;Float32Array&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     impl.setTypedArrayAttr(nativeValue.get());
</span><span class="lines">@@ -3483,11 +3764,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjAttrWithGetterException(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;attrWithGetterException&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attrWithGetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3500,11 +3783,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjAttrWithGetterExceptionWithMessage(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;attrWithGetterExceptionWithMessage&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attrWithGetterExceptionWithMessage&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3517,11 +3802,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjAttrWithSetterException(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;attrWithSetterException&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attrWithSetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -3536,11 +3823,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjAttrWithSetterExceptionWithMessage(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;attrWithSetterExceptionWithMessage&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attrWithSetterExceptionWithMessage&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCodeWithMessage ec;
</span><span class="lines">@@ -3555,11 +3844,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjStringAttrWithGetterException(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;stringAttrWithGetterException&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringAttrWithGetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -3572,11 +3863,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjStringAttrWithSetterException(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;stringAttrWithSetterException&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringAttrWithSetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -3591,11 +3884,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjCustomAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;customAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;customAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     castedThis-&gt;setCustomAttr(*state, value);
</span><span class="cx">     return true;
</span><span class="lines">@@ -3604,11 +3899,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjOnfoo(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;onfoo&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;onfoo&quot;);
</ins><span class="cx">     }
</span><span class="cx">     setEventHandlerAttribute(*state, *castedThis, castedThis-&gt;wrapped(), eventNames().fooEvent, value);
</span><span class="cx">     return true;
</span><span class="lines">@@ -3617,11 +3914,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjOnwebkitfoo(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;onwebkitfoo&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;onwebkitfoo&quot;);
</ins><span class="cx">     }
</span><span class="cx">     setEventHandlerAttribute(*state, *castedThis, castedThis-&gt;wrapped(), eventNames().fooEvent, value);
</span><span class="cx">     return true;
</span><span class="lines">@@ -3630,11 +3929,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjWithScriptStateAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptStateAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptStateAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3647,11 +3948,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjWithCallWithAndSetterCallWithAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;withCallWithAndSetterCallWithAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withCallWithAndSetterCallWithAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3664,16 +3967,18 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjWithScriptExecutionContextAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttribute&quot;, &quot;TestObj&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttribute&quot;, &quot;TestObj&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -3686,16 +3991,18 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjWithScriptStateAttributeRaises(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptStateAttributeRaises&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptStateAttributeRaises&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;withScriptStateAttributeRaises&quot;, &quot;TestObj&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptStateAttributeRaises&quot;, &quot;TestObj&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     impl.setWithScriptStateAttributeRaises(*state, *nativeValue);
</span><span class="lines">@@ -3705,16 +4012,18 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjWithScriptExecutionContextAttributeRaises(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttributeRaises&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttributeRaises&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttributeRaises&quot;, &quot;TestObj&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAttributeRaises&quot;, &quot;TestObj&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -3727,16 +4036,18 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjWithScriptExecutionContextAndScriptStateAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttribute&quot;, &quot;TestObj&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttribute&quot;, &quot;TestObj&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -3749,16 +4060,18 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjWithScriptExecutionContextAndScriptStateAttributeRaises(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttributeRaises&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttributeRaises&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttributeRaises&quot;, &quot;TestObj&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateAttributeRaises&quot;, &quot;TestObj&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -3771,16 +4084,18 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateWithSpacesAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateWithSpacesAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateWithSpacesAttribute&quot;, &quot;TestObj&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateWithSpacesAttribute&quot;, &quot;TestObj&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -3793,16 +4108,18 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjWithScriptArgumentsAndCallStackAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;withScriptArgumentsAndCallStackAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptArgumentsAndCallStackAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = JSTestObj::toWrapped(value);
</span><span class="cx">     if (UNLIKELY(!nativeValue)) {
</span><del>-        throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;withScriptArgumentsAndCallStackAttribute&quot;, &quot;TestObj&quot;);
</del><ins>+        throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptArgumentsAndCallStackAttribute&quot;, &quot;TestObj&quot;);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     impl.setWithScriptArgumentsAndCallStackAttribute(*nativeValue);
</span><span class="lines">@@ -3813,11 +4130,13 @@
</span><span class="cx"> #if ENABLE(Condition1)
</span><span class="cx"> bool setJSTestObjConditionalAttr1(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr1&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr1&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3832,11 +4151,13 @@
</span><span class="cx"> #if ENABLE(Condition1) &amp;&amp; ENABLE(Condition2)
</span><span class="cx"> bool setJSTestObjConditionalAttr2(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr2&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr2&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3851,11 +4172,13 @@
</span><span class="cx"> #if ENABLE(Condition1) || ENABLE(Condition2)
</span><span class="cx"> bool setJSTestObjConditionalAttr3(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr3&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr3&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3870,11 +4193,13 @@
</span><span class="cx"> #if ENABLE(Condition1)
</span><span class="cx"> bool setJSTestObjConditionalAttr4Constructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr4&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr4&quot;);
</ins><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor.
</span><span class="cx">     return castedThis-&gt;putDirect(state-&gt;vm(), Identifier::fromString(state, &quot;conditionalAttr4&quot;), value);
</span><span class="lines">@@ -3885,11 +4210,13 @@
</span><span class="cx"> #if ENABLE(Condition1) &amp;&amp; ENABLE(Condition2)
</span><span class="cx"> bool setJSTestObjConditionalAttr5Constructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr5&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr5&quot;);
</ins><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor.
</span><span class="cx">     return castedThis-&gt;putDirect(state-&gt;vm(), Identifier::fromString(state, &quot;conditionalAttr5&quot;), value);
</span><span class="lines">@@ -3900,11 +4227,13 @@
</span><span class="cx"> #if ENABLE(Condition1) || ENABLE(Condition2)
</span><span class="cx"> bool setJSTestObjConditionalAttr6Constructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;conditionalAttr6&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalAttr6&quot;);
</ins><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor.
</span><span class="cx">     return castedThis-&gt;putDirect(state-&gt;vm(), Identifier::fromString(state, &quot;conditionalAttr6&quot;), value);
</span><span class="lines">@@ -3914,11 +4243,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjAnyAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;anyAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;anyAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value;
</span><span class="lines">@@ -3929,11 +4260,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjMutablePoint(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;mutablePoint&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;mutablePoint&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     SVGPropertyTearOff&lt;SVGPoint&gt;* nativeValue = nullptr;
</span><span class="lines">@@ -3940,7 +4273,7 @@
</span><span class="cx">     if (!value.isUndefinedOrNull()) {
</span><span class="cx">         nativeValue = JSSVGPoint::toWrapped(value);
</span><span class="cx">         if (UNLIKELY(!nativeValue)) {
</span><del>-            throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;mutablePoint&quot;, &quot;SVGPoint&quot;);
</del><ins>+            throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;mutablePoint&quot;, &quot;SVGPoint&quot;);
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -3951,11 +4284,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjImmutablePoint(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;immutablePoint&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;immutablePoint&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     SVGPropertyTearOff&lt;SVGPoint&gt;* nativeValue = nullptr;
</span><span class="lines">@@ -3962,7 +4297,7 @@
</span><span class="cx">     if (!value.isUndefinedOrNull()) {
</span><span class="cx">         nativeValue = JSSVGPoint::toWrapped(value);
</span><span class="cx">         if (UNLIKELY(!nativeValue)) {
</span><del>-            throwAttributeTypeError(*state, &quot;TestObject&quot;, &quot;immutablePoint&quot;, &quot;SVGPoint&quot;);
</del><ins>+            throwAttributeTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;immutablePoint&quot;, &quot;SVGPoint&quot;);
</ins><span class="cx">             return false;
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="lines">@@ -3973,11 +4308,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjStrawberry(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;strawberry&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;strawberry&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -3990,11 +4327,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjId(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;id&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;id&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -4007,11 +4346,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjReplaceableAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;replaceableAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;replaceableAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in property.
</span><span class="cx">     return castedThis-&gt;putDirect(state-&gt;vm(), Identifier::fromString(state, &quot;replaceableAttribute&quot;), value);
</span><span class="lines">@@ -4020,11 +4361,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjNullableLongSettableAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableLongSettableAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableLongSettableAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -4037,11 +4380,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjNullableStringSettableAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableStringSettableAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableStringSettableAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = valueToStringWithUndefinedOrNullCheck(state, value);
</span><span class="lines">@@ -4054,11 +4399,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjNullableUSVStringSettableAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableUSVStringSettableAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableUSVStringSettableAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = valueToUSVStringWithUndefinedOrNullCheck(state, value);
</span><span class="lines">@@ -4071,11 +4418,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjNullableStringValue(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;nullableStringValue&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableStringValue&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -4088,11 +4437,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjAttributeWithReservedEnumType(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;attributeWithReservedEnumType&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attributeWithReservedEnumType&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = parse&lt;TestObj::Optional&gt;(*state, value);
</span><span class="lines">@@ -4107,11 +4458,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjPutForwardsAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;putForwardsAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;putForwardsAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     Ref&lt;TestNode&gt; forwardedImpl = castedThis-&gt;wrapped().putForwardsAttribute();
</span><span class="cx">     auto&amp; impl = forwardedImpl.get();
</span><span class="lines">@@ -4125,11 +4478,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjPutForwardsNullableAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;putForwardsNullableAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;putForwardsNullableAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     RefPtr&lt;TestNode&gt; forwardedImpl = castedThis-&gt;wrapped().putForwardsNullableAttribute();
</span><span class="cx">     if (!forwardedImpl)
</span><span class="lines">@@ -4145,11 +4500,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestObjStringifierAttribute(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestObj* castedThis = jsDynamicCast&lt;JSTestObj*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestObject&quot;, &quot;stringifierAttribute&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringifierAttribute&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = valueToUSVString(state, value);
</span><span class="lines">@@ -4177,14 +4534,17 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionEnabledAtRuntimeOperation1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;enabledAtRuntimeOperation&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;enabledAtRuntimeOperation&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto testParam = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4197,14 +4557,17 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionEnabledAtRuntimeOperation2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;enabledAtRuntimeOperation&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;enabledAtRuntimeOperation&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto testParam = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4217,6 +4580,9 @@
</span><span class="cx"> #if ENABLE(TEST_FEATURE)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionEnabledAtRuntimeOperation(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());
</span><span class="cx">     if (argsCount == 1) {
</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);
</span><span class="lines">@@ -4228,16 +4594,19 @@
</span><span class="cx">         return jsTestObjPrototypeFunctionEnabledAtRuntimeOperation1(state);
</span><span class="cx"> #endif
</span><span class="cx">     }
</span><del>-    return argsCount &lt; 1 ? throwVMError(state, createNotEnoughArgumentsError(state)) : throwVMTypeError(state);
</del><ins>+    return argsCount &lt; 1 ? throwVMError(state, throwScope, createNotEnoughArgumentsError(state)) : throwVMTypeError(state, throwScope);
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionVoidMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;voidMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;voidMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     impl.voidMethod();
</span><span class="lines">@@ -4246,14 +4615,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionVoidMethodWithArgs(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;voidMethodWithArgs&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;voidMethodWithArgs&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 3))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto longArg = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4262,7 +4634,7 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto objArg = JSTestObj::toWrapped(state-&gt;argument(2));
</span><span class="cx">     if (UNLIKELY(!objArg))
</span><del>-        return throwArgumentTypeError(*state, 2, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;voidMethodWithArgs&quot;, &quot;TestObj&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 2, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;voidMethodWithArgs&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     impl.voidMethodWithArgs(WTFMove(longArg), WTFMove(strArg), *objArg);
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -4269,10 +4641,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionByteMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;byteMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;byteMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.byteMethod());
</span><span class="lines">@@ -4281,14 +4656,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionByteMethodWithArgs(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;byteMethodWithArgs&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;byteMethodWithArgs&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 3))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto byteArg = convert&lt;int8_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4297,7 +4675,7 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto objArg = JSTestObj::toWrapped(state-&gt;argument(2));
</span><span class="cx">     if (UNLIKELY(!objArg))
</span><del>-        return throwArgumentTypeError(*state, 2, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;byteMethodWithArgs&quot;, &quot;TestObj&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 2, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;byteMethodWithArgs&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     JSValue result = jsNumber(impl.byteMethodWithArgs(WTFMove(byteArg), WTFMove(strArg), *objArg));
</span><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="lines">@@ -4304,10 +4682,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOctetMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;octetMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;octetMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.octetMethod());
</span><span class="lines">@@ -4316,14 +4697,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOctetMethodWithArgs(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;octetMethodWithArgs&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;octetMethodWithArgs&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 3))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto octetArg = convert&lt;uint8_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4332,7 +4716,7 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto objArg = JSTestObj::toWrapped(state-&gt;argument(2));
</span><span class="cx">     if (UNLIKELY(!objArg))
</span><del>-        return throwArgumentTypeError(*state, 2, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;octetMethodWithArgs&quot;, &quot;TestObj&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 2, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;octetMethodWithArgs&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     JSValue result = jsNumber(impl.octetMethodWithArgs(WTFMove(octetArg), WTFMove(strArg), *objArg));
</span><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="lines">@@ -4339,10 +4723,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionLongMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;longMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;longMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.longMethod());
</span><span class="lines">@@ -4351,14 +4738,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionLongMethodWithArgs(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;longMethodWithArgs&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;longMethodWithArgs&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 3))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto longArg = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4367,7 +4757,7 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto objArg = JSTestObj::toWrapped(state-&gt;argument(2));
</span><span class="cx">     if (UNLIKELY(!objArg))
</span><del>-        return throwArgumentTypeError(*state, 2, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;longMethodWithArgs&quot;, &quot;TestObj&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 2, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;longMethodWithArgs&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     JSValue result = jsNumber(impl.longMethodWithArgs(WTFMove(longArg), WTFMove(strArg), *objArg));
</span><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="lines">@@ -4374,10 +4764,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionObjMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;objMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;objMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.objMethod());
</span><span class="lines">@@ -4386,14 +4779,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionObjMethodWithArgs(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;objMethodWithArgs&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;objMethodWithArgs&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 3))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto longArg = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4402,7 +4798,7 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto objArg = JSTestObj::toWrapped(state-&gt;argument(2));
</span><span class="cx">     if (UNLIKELY(!objArg))
</span><del>-        return throwArgumentTypeError(*state, 2, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;objMethodWithArgs&quot;, &quot;TestObj&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 2, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;objMethodWithArgs&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.objMethodWithArgs(WTFMove(longArg), WTFMove(strArg), *objArg));
</span><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="lines">@@ -4409,10 +4805,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjInstanceFunctionUnforgeableMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;unforgeableMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;unforgeableMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.unforgeableMethod());
</span><span class="lines">@@ -4421,14 +4820,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithArgTreatingNullAsEmptyString(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithArgTreatingNullAsEmptyString&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithArgTreatingNullAsEmptyString&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto arg = valueToStringTreatingNullAsEmptyString(state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4438,19 +4840,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithXPathNSResolverParameter(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithXPathNSResolverParameter&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithXPathNSResolverParameter&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto resolver = JSXPathNSResolver::toWrapped(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     if (UNLIKELY(!resolver))
</span><del>-        return throwArgumentTypeError(*state, 0, &quot;resolver&quot;, &quot;TestObject&quot;, &quot;methodWithXPathNSResolverParameter&quot;, &quot;XPathNSResolver&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 0, &quot;resolver&quot;, &quot;TestObject&quot;, &quot;methodWithXPathNSResolverParameter&quot;, &quot;XPathNSResolver&quot;);
</ins><span class="cx">     impl.methodWithXPathNSResolverParameter(*resolver);
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -4457,10 +4862,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionNullableStringMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;nullableStringMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableStringMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringOrNull(state, impl.nullableStringMethod());
</span><span class="lines">@@ -4469,6 +4877,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionNullableStringStaticMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue result = jsStringOrNull(state, TestObj::nullableStringStaticMethod());
</span><span class="cx">     return JSValue::encode(result);
</span><span class="cx"> }
</span><span class="lines">@@ -4475,14 +4886,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionNullableStringSpecialMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;nullableStringSpecialMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;nullableStringSpecialMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto index = convert&lt;uint32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4492,14 +4906,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithEnumArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithEnumArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithEnumArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto enumArgValue = state-&gt;argument(0);
</span><span class="cx">     TestObj::EnumType enumArg;
</span><span class="cx">     auto optionalValue = parse&lt;TestObj::EnumType&gt;(*state, enumArgValue);
</span><span class="lines">@@ -4506,7 +4923,7 @@
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     if (UNLIKELY(!optionalValue))
</span><del>-        return throwArgumentMustBeEnumError(*state, 0, &quot;enumArg&quot;, &quot;TestObject&quot;, &quot;methodWithEnumArg&quot;, expectedEnumerationValues&lt;TestObj::EnumType&gt;());
</del><ins>+        return throwArgumentMustBeEnumError(*state, throwScope, 0, &quot;enumArg&quot;, &quot;TestObject&quot;, &quot;methodWithEnumArg&quot;, expectedEnumerationValues&lt;TestObj::EnumType&gt;());
</ins><span class="cx">     enumArg = optionalValue.value();
</span><span class="cx">     impl.methodWithEnumArg(enumArg);
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4514,10 +4931,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalEnumArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalEnumArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalEnumArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto enumArgValue = state-&gt;argument(0);
</span><span class="lines">@@ -4527,7 +4947,7 @@
</span><span class="cx">         if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><span class="cx">         if (UNLIKELY(!enumArg))
</span><del>-            return throwArgumentMustBeEnumError(*state, 0, &quot;enumArg&quot;, &quot;TestObject&quot;, &quot;methodWithOptionalEnumArg&quot;, expectedEnumerationValues&lt;TestObj::EnumType&gt;());
</del><ins>+            return throwArgumentMustBeEnumError(*state, throwScope, 0, &quot;enumArg&quot;, &quot;TestObject&quot;, &quot;methodWithOptionalEnumArg&quot;, expectedEnumerationValues&lt;TestObj::EnumType&gt;());
</ins><span class="cx">     }
</span><span class="cx">     impl.methodWithOptionalEnumArg(enumArg);
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4535,10 +4955,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalEnumArgAndDefaultValue(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalEnumArgAndDefaultValue&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalEnumArgAndDefaultValue&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto enumArgValue = state-&gt;argument(0);
</span><span class="lines">@@ -4550,7 +4973,7 @@
</span><span class="cx">         if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><span class="cx">         if (UNLIKELY(!optionalValue))
</span><del>-            return throwArgumentMustBeEnumError(*state, 0, &quot;enumArg&quot;, &quot;TestObject&quot;, &quot;methodWithOptionalEnumArgAndDefaultValue&quot;, expectedEnumerationValues&lt;TestObj::EnumType&gt;());
</del><ins>+            return throwArgumentMustBeEnumError(*state, throwScope, 0, &quot;enumArg&quot;, &quot;TestObject&quot;, &quot;methodWithOptionalEnumArgAndDefaultValue&quot;, expectedEnumerationValues&lt;TestObj::EnumType&gt;());
</ins><span class="cx">         enumArg = optionalValue.value();
</span><span class="cx">     }
</span><span class="cx">     impl.methodWithOptionalEnumArgAndDefaultValue(enumArg);
</span><span class="lines">@@ -4559,14 +4982,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodThatRequiresAllArgsAndThrows&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodThatRequiresAllArgsAndThrows&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto strArg = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -4573,7 +4999,7 @@
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto objArg = JSTestObj::toWrapped(state-&gt;argument(1));
</span><span class="cx">     if (UNLIKELY(!objArg))
</span><del>-        return throwArgumentTypeError(*state, 1, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;methodThatRequiresAllArgsAndThrows&quot;, &quot;TestObj&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 1, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;methodThatRequiresAllArgsAndThrows&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.methodThatRequiresAllArgsAndThrows(WTFMove(strArg), *objArg, ec));
</span><span class="cx"> 
</span><span class="cx">     setDOMException(state, ec);
</span><span class="lines">@@ -4582,14 +5008,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithUSVStringArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithUSVStringArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithUSVStringArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto str = valueToUSVString(state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4599,14 +5028,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNullableUSVStringArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithNullableUSVStringArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithNullableUSVStringArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto str = valueToUSVStringWithUndefinedOrNullCheck(state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4616,14 +5048,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithUSVStringArgTreatingNullAsEmptyString(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithUSVStringArgTreatingNullAsEmptyString&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithUSVStringArgTreatingNullAsEmptyString&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto str = valueToUSVStringTreatingNullAsEmptyString(state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4633,14 +5068,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionSerializedValue(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;serializedValue&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;serializedValue&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto serializedArg = SerializedScriptValue::create(state, state-&gt;argument(0), 0, 0);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4650,14 +5088,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOptionsObject(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;optionsObject&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;optionsObject&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto oo = Dictionary(state, state-&gt;argument(0));
</span><span class="cx">     auto ooo = Dictionary(state, state-&gt;argument(1));
</span><span class="cx">     impl.optionsObject(WTFMove(oo), WTFMove(ooo));
</span><span class="lines">@@ -4666,10 +5107,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithException(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithException&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithException&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -4680,10 +5124,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithExceptionWithMessage(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithExceptionWithMessage&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithExceptionWithMessage&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCodeWithMessage ec;
</span><span class="lines">@@ -4694,10 +5141,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;customMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;customMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     return JSValue::encode(castedThis-&gt;customMethod(*state));
</span><span class="cx"> }
</span><span class="lines">@@ -4704,10 +5154,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomMethodWithArgs(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;customMethodWithArgs&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;customMethodWithArgs&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     return JSValue::encode(castedThis-&gt;customMethodWithArgs(*state));
</span><span class="cx"> }
</span><span class="lines">@@ -4714,14 +5167,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionPrivateMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;privateMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;privateMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto argument = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4731,14 +5187,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionPublicAndPrivateMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;publicAndPrivateMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;publicAndPrivateMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto argument = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4748,20 +5207,23 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionAddEventListener(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;addEventListener&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;addEventListener&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto type = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto listener = JSEventListener::create(state-&gt;argument(1), *castedThis, false, currentWorld(state));
</span><span class="cx">     if (UNLIKELY(!listener))
</span><del>-        return throwArgumentTypeError(*state, 1, &quot;listener&quot;, &quot;TestObject&quot;, &quot;addEventListener&quot;, &quot;EventListener&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 1, &quot;listener&quot;, &quot;TestObject&quot;, &quot;addEventListener&quot;, &quot;EventListener&quot;);
</ins><span class="cx">     auto useCapture = state-&gt;argument(2).toBoolean(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4771,20 +5233,23 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionRemoveEventListener(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;removeEventListener&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;removeEventListener&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto type = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     auto listener = JSEventListener::create(state-&gt;argument(1), *castedThis, false, currentWorld(state));
</span><span class="cx">     if (UNLIKELY(!listener))
</span><del>-        return throwArgumentTypeError(*state, 1, &quot;listener&quot;, &quot;TestObject&quot;, &quot;removeEventListener&quot;, &quot;EventListener&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 1, &quot;listener&quot;, &quot;TestObject&quot;, &quot;removeEventListener&quot;, &quot;EventListener&quot;);
</ins><span class="cx">     auto useCapture = state-&gt;argument(2).toBoolean(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -4794,10 +5259,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateVoid(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withScriptStateVoid&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptStateVoid&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     impl.withScriptStateVoid(*state);
</span><span class="lines">@@ -4806,10 +5274,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateObj(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withScriptStateObj&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptStateObj&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.withScriptStateObj(*state));
</span><span class="lines">@@ -4820,10 +5291,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateVoidException(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withScriptStateVoidException&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptStateVoidException&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -4834,10 +5308,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptStateObjException(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withScriptStateObjException&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptStateObjException&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -4851,10 +5328,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContext(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContext&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContext&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -4866,10 +5346,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptState(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptState&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptState&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -4881,10 +5364,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateObjException(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateObjException&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateObjException&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -4901,10 +5387,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptExecutionContextAndScriptStateWithSpaces(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateWithSpaces&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptExecutionContextAndScriptStateWithSpaces&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -4918,10 +5407,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithScriptArgumentsAndCallStack(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withScriptArgumentsAndCallStack&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withScriptArgumentsAndCallStack&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     RefPtr&lt;Inspector::ScriptArguments&gt; scriptArguments(Inspector::createScriptArguments(state, 0));
</span><span class="lines">@@ -4931,10 +5423,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithDocumentArgument(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withDocumentArgument&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withDocumentArgument&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto* context = jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject())-&gt;scriptExecutionContext();
</span><span class="lines">@@ -4948,10 +5443,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithCallerDocumentArgument(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withCallerDocumentArgument&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withCallerDocumentArgument&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto* document = callerDOMWindow(state).document();
</span><span class="lines">@@ -4963,10 +5461,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionWithCallerWindowArgument(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;withCallerWindowArgument&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;withCallerWindowArgument&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     impl.withCallerWindowArgument(callerDOMWindow(state));
</span><span class="lines">@@ -4975,10 +5476,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto opt = state-&gt;argument(0).isUndefined() ? Optional&lt;int32_t&gt;() : convert&lt;int32_t&gt;(*state, state-&gt;uncheckedArgument(0), NormalConversion);
</span><span class="lines">@@ -4990,10 +5494,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalArgAndDefaultValue(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalArgAndDefaultValue&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalArgAndDefaultValue&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto opt = state-&gt;argument(0).isUndefined() ? 666 : convert&lt;int32_t&gt;(*state, state-&gt;uncheckedArgument(0), NormalConversion);
</span><span class="lines">@@ -5005,14 +5512,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithNonOptionalArgAndOptionalArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithNonOptionalArgAndOptionalArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto nonOpt = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5025,14 +5535,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithNonOptionalArgAndTwoOptionalArgs&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithNonOptionalArgAndTwoOptionalArgs&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto nonOpt = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5048,10 +5561,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalString(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalString&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalString&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).isUndefined() ? String() : state-&gt;uncheckedArgument(0).toWTFString(state);
</span><span class="lines">@@ -5063,10 +5579,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalUSVString(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalUSVString&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalUSVString&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).isUndefined() ? String() : valueToUSVString(state, state-&gt;uncheckedArgument(0));
</span><span class="lines">@@ -5078,10 +5597,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalAtomicString(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalAtomicString&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalAtomicString&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).isUndefined() ? nullAtom : state-&gt;uncheckedArgument(0).toString(state)-&gt;toAtomicString(state);
</span><span class="lines">@@ -5093,10 +5615,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringAndDefaultValue(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalStringAndDefaultValue&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalStringAndDefaultValue&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).isUndefined() ? ASCIILiteral(&quot;foo&quot;) : state-&gt;uncheckedArgument(0).toWTFString(state);
</span><span class="lines">@@ -5108,10 +5633,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringAndDefaultValue(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalAtomicStringAndDefaultValue&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalAtomicStringAndDefaultValue&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).isUndefined() ? AtomicString(&quot;foo&quot;, AtomicString::ConstructFromLiteral) : state-&gt;uncheckedArgument(0).toString(state)-&gt;toAtomicString(state);
</span><span class="lines">@@ -5123,10 +5651,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsNull(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalStringIsNull&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalStringIsNull&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).isUndefined() ? String() : state-&gt;uncheckedArgument(0).toWTFString(state);
</span><span class="lines">@@ -5138,10 +5669,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsUndefined(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalStringIsUndefined&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalStringIsUndefined&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).toWTFString(state);
</span><span class="lines">@@ -5153,10 +5687,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringIsNull(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalAtomicStringIsNull&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalAtomicStringIsNull&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).isUndefined() ? nullAtom : state-&gt;uncheckedArgument(0).toString(state)-&gt;toAtomicString(state);
</span><span class="lines">@@ -5168,10 +5705,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalStringIsEmptyString(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalStringIsEmptyString&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalStringIsEmptyString&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).isUndefined() ? emptyString() : state-&gt;uncheckedArgument(0).toWTFString(state);
</span><span class="lines">@@ -5183,10 +5723,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalUSVStringIsEmptyString(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalUSVStringIsEmptyString&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalUSVStringIsEmptyString&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).isUndefined() ? emptyString() : valueToUSVString(state, state-&gt;uncheckedArgument(0));
</span><span class="lines">@@ -5198,10 +5741,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalAtomicStringIsEmptyString(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalAtomicStringIsEmptyString&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalAtomicStringIsEmptyString&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto str = state-&gt;argument(0).isUndefined() ? emptyAtom : state-&gt;uncheckedArgument(0).toString(state)-&gt;toAtomicString(state);
</span><span class="lines">@@ -5213,10 +5759,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalDoubleIsNaN(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalDoubleIsNaN&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalDoubleIsNaN&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto number = convert&lt;double&gt;(*state, state-&gt;argument(0), ShouldAllowNonFinite::Yes);
</span><span class="lines">@@ -5228,10 +5777,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalFloatIsNaN(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalFloatIsNaN&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalFloatIsNaN&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto number = convert&lt;float&gt;(*state, state-&gt;argument(0), ShouldAllowNonFinite::Yes);
</span><span class="lines">@@ -5243,10 +5795,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalLongLong(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalLongLong&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalLongLong&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto number = state-&gt;argument(0).isUndefined() ? Optional&lt;int64_t&gt;() : convert&lt;int64_t&gt;(*state, state-&gt;uncheckedArgument(0), NormalConversion);
</span><span class="lines">@@ -5258,10 +5813,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalLongLongIsZero(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalLongLongIsZero&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalLongLongIsZero&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto number = convert&lt;int64_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="lines">@@ -5273,10 +5831,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalUnsignedLongLong(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalUnsignedLongLong&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalUnsignedLongLong&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto number = state-&gt;argument(0).isUndefined() ? Optional&lt;uint64_t&gt;() : convert&lt;uint64_t&gt;(*state, state-&gt;uncheckedArgument(0), NormalConversion);
</span><span class="lines">@@ -5288,10 +5849,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalUnsignedLongLongIsZero(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalUnsignedLongLongIsZero&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalUnsignedLongLongIsZero&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto number = convert&lt;uint64_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="lines">@@ -5303,10 +5867,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalSequence(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalSequence&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalSequence&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto array = state-&gt;argument(0).isUndefined() ? Optional&lt;Vector&lt;String&gt;&gt;() : toNativeArray&lt;String&gt;(*state, state-&gt;uncheckedArgument(0));
</span><span class="lines">@@ -5318,10 +5885,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalSequenceIsEmpty(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalSequenceIsEmpty&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalSequenceIsEmpty&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto array = state-&gt;argument(0).isUndefined() ? Vector&lt;String&gt;() : toNativeArray&lt;String&gt;(*state, state-&gt;uncheckedArgument(0));
</span><span class="lines">@@ -5333,10 +5903,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalBoolean(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalBoolean&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalBoolean&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto b = state-&gt;argument(0).isUndefined() ? Optional&lt;bool&gt;() : state-&gt;uncheckedArgument(0).toBoolean(state);
</span><span class="lines">@@ -5348,10 +5921,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalBooleanIsFalse(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalBooleanIsFalse&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalBooleanIsFalse&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto b = state-&gt;argument(0).toBoolean(state);
</span><span class="lines">@@ -5363,10 +5939,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalAny(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalAny&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalAny&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto a = state-&gt;argument(0);
</span><span class="lines">@@ -5376,10 +5955,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalNullableWrapper(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalNullableWrapper&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalNullableWrapper&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     TestObj* obj = nullptr;
</span><span class="lines">@@ -5386,7 +5968,7 @@
</span><span class="cx">     if (!state-&gt;argument(0).isUndefinedOrNull()) {
</span><span class="cx">         obj = JSTestObj::toWrapped(state-&gt;uncheckedArgument(0));
</span><span class="cx">         if (UNLIKELY(!obj))
</span><del>-            return throwArgumentTypeError(*state, 0, &quot;obj&quot;, &quot;TestObject&quot;, &quot;methodWithOptionalNullableWrapper&quot;, &quot;TestObj&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, 0, &quot;obj&quot;, &quot;TestObject&quot;, &quot;methodWithOptionalNullableWrapper&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     }
</span><span class="cx">     impl.methodWithOptionalNullableWrapper(WTFMove(obj));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5394,10 +5976,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalNullableWrapperIsNull(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalNullableWrapperIsNull&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalNullableWrapperIsNull&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     TestObj* obj = nullptr;
</span><span class="lines">@@ -5404,7 +5989,7 @@
</span><span class="cx">     if (!state-&gt;argument(0).isUndefinedOrNull()) {
</span><span class="cx">         obj = JSTestObj::toWrapped(state-&gt;uncheckedArgument(0));
</span><span class="cx">         if (UNLIKELY(!obj))
</span><del>-            return throwArgumentTypeError(*state, 0, &quot;obj&quot;, &quot;TestObject&quot;, &quot;methodWithOptionalNullableWrapperIsNull&quot;, &quot;TestObj&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, 0, &quot;obj&quot;, &quot;TestObject&quot;, &quot;methodWithOptionalNullableWrapperIsNull&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     }
</span><span class="cx">     impl.methodWithOptionalNullableWrapperIsNull(WTFMove(obj));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5412,10 +5997,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalXPathNSResolver(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithOptionalXPathNSResolver&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithOptionalXPathNSResolver&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     RefPtr&lt;XPathNSResolver&gt; resolver = nullptr;
</span><span class="lines">@@ -5424,7 +6012,7 @@
</span><span class="cx">         if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">             return JSValue::encode(jsUndefined());
</span><span class="cx">         if (UNLIKELY(!resolver))
</span><del>-            return throwArgumentTypeError(*state, 0, &quot;resolver&quot;, &quot;TestObject&quot;, &quot;methodWithOptionalXPathNSResolver&quot;, &quot;XPathNSResolver&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, 0, &quot;resolver&quot;, &quot;TestObject&quot;, &quot;methodWithOptionalXPathNSResolver&quot;, &quot;XPathNSResolver&quot;);
</ins><span class="cx">     }
</span><span class="cx">     impl.methodWithOptionalXPathNSResolver(WTFMove(resolver));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5432,16 +6020,19 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithCallbackArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithCallbackArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     if (UNLIKELY(!state-&gt;argument(0).isObject()))
</span><del>-        return throwArgumentMustBeFunctionError(*state, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithCallbackArg&quot;);
</del><ins>+        return throwArgumentMustBeFunctionError(*state, throwScope, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithCallbackArg&quot;);
</ins><span class="cx">     auto callback = JSTestCallback::create(asObject(state-&gt;uncheckedArgument(0)), castedThis-&gt;globalObject());
</span><span class="cx">     impl.methodWithCallbackArg(WTFMove(callback));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5449,19 +6040,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithNonCallbackArgAndCallbackArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithNonCallbackArgAndCallbackArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto nonCallback = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     if (UNLIKELY(!state-&gt;argument(1).isObject()))
</span><del>-        return throwArgumentMustBeFunctionError(*state, 1, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithNonCallbackArgAndCallbackArg&quot;);
</del><ins>+        return throwArgumentMustBeFunctionError(*state, throwScope, 1, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithNonCallbackArgAndCallbackArg&quot;);
</ins><span class="cx">     auto callback = JSTestCallback::create(asObject(state-&gt;uncheckedArgument(1)), castedThis-&gt;globalObject());
</span><span class="cx">     impl.methodWithNonCallbackArgAndCallbackArg(WTFMove(nonCallback), WTFMove(callback));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5469,16 +6063,19 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithCallbackAndOptionalArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithCallbackAndOptionalArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     RefPtr&lt;TestCallback&gt; callback;
</span><span class="cx">     if (!state-&gt;argument(0).isUndefinedOrNull()) {
</span><span class="cx">         if (!state-&gt;uncheckedArgument(0).isObject())
</span><del>-            return throwArgumentMustBeFunctionError(*state, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithCallbackAndOptionalArg&quot;);
</del><ins>+            return throwArgumentMustBeFunctionError(*state, throwScope, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithCallbackAndOptionalArg&quot;);
</ins><span class="cx">         callback = JSTestCallback::create(asObject(state-&gt;uncheckedArgument(0)), castedThis-&gt;globalObject());
</span><span class="cx">     }
</span><span class="cx">     impl.methodWithCallbackAndOptionalArg(WTFMove(callback));
</span><span class="lines">@@ -5487,16 +6084,19 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackFunctionArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithCallbackFunctionArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithCallbackFunctionArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     if (UNLIKELY(!state-&gt;argument(0).isFunction()))
</span><del>-        return throwArgumentMustBeFunctionError(*state, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithCallbackFunctionArg&quot;);
</del><ins>+        return throwArgumentMustBeFunctionError(*state, throwScope, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithCallbackFunctionArg&quot;);
</ins><span class="cx">     auto callback = JSTestCallbackFunction::create(asObject(state-&gt;uncheckedArgument(0)), castedThis-&gt;globalObject());
</span><span class="cx">     impl.methodWithCallbackFunctionArg(WTFMove(callback));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5504,19 +6104,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackFunctionArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithNonCallbackArgAndCallbackFunctionArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithNonCallbackArgAndCallbackFunctionArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto nonCallback = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     if (UNLIKELY(!state-&gt;argument(1).isFunction()))
</span><del>-        return throwArgumentMustBeFunctionError(*state, 1, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithNonCallbackArgAndCallbackFunctionArg&quot;);
</del><ins>+        return throwArgumentMustBeFunctionError(*state, throwScope, 1, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithNonCallbackArgAndCallbackFunctionArg&quot;);
</ins><span class="cx">     auto callback = JSTestCallbackFunction::create(asObject(state-&gt;uncheckedArgument(1)), castedThis-&gt;globalObject());
</span><span class="cx">     impl.methodWithNonCallbackArgAndCallbackFunctionArg(WTFMove(nonCallback), WTFMove(callback));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5524,16 +6127,19 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackFunctionAndOptionalArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithCallbackFunctionAndOptionalArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithCallbackFunctionAndOptionalArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     RefPtr&lt;TestCallbackFunction&gt; callback;
</span><span class="cx">     if (!state-&gt;argument(0).isUndefinedOrNull()) {
</span><span class="cx">         if (!state-&gt;uncheckedArgument(0).isFunction())
</span><del>-            return throwArgumentMustBeFunctionError(*state, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithCallbackFunctionAndOptionalArg&quot;);
</del><ins>+            return throwArgumentMustBeFunctionError(*state, throwScope, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;methodWithCallbackFunctionAndOptionalArg&quot;);
</ins><span class="cx">         callback = JSTestCallbackFunction::create(asObject(state-&gt;uncheckedArgument(0)), castedThis-&gt;globalObject());
</span><span class="cx">     }
</span><span class="cx">     impl.methodWithCallbackFunctionAndOptionalArg(WTFMove(callback));
</span><span class="lines">@@ -5542,10 +6148,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionStaticMethodWithCallbackAndOptionalArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     RefPtr&lt;TestCallback&gt; callback;
</span><span class="cx">     if (!state-&gt;argument(0).isUndefinedOrNull()) {
</span><span class="cx">         if (!state-&gt;uncheckedArgument(0).isObject())
</span><del>-            return throwArgumentMustBeFunctionError(*state, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;staticMethodWithCallbackAndOptionalArg&quot;);
</del><ins>+            return throwArgumentMustBeFunctionError(*state, throwScope, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;staticMethodWithCallbackAndOptionalArg&quot;);
</ins><span class="cx">         callback = createFunctionOnlyCallback&lt;JSTestCallback&gt;(state, jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject()), state-&gt;uncheckedArgument(0));
</span><span class="cx">     }
</span><span class="cx">     TestObj::staticMethodWithCallbackAndOptionalArg(WTFMove(callback));
</span><span class="lines">@@ -5554,10 +6163,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionStaticMethodWithCallbackArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     if (UNLIKELY(!state-&gt;argument(0).isObject()))
</span><del>-        return throwArgumentMustBeFunctionError(*state, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;staticMethodWithCallbackArg&quot;);
</del><ins>+        return throwArgumentMustBeFunctionError(*state, throwScope, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;staticMethodWithCallbackArg&quot;);
</ins><span class="cx">     auto callback = createFunctionOnlyCallback&lt;JSTestCallback&gt;(state, jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject()), state-&gt;uncheckedArgument(0));
</span><span class="cx">     TestObj::staticMethodWithCallbackArg(WTFMove(callback));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5566,10 +6178,13 @@
</span><span class="cx"> #if ENABLE(Condition1)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConditionalMethod1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;conditionalMethod1&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalMethod1&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.conditionalMethod1());
</span><span class="lines">@@ -5581,10 +6196,13 @@
</span><span class="cx"> #if ENABLE(Condition1) &amp;&amp; ENABLE(Condition2)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConditionalMethod2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;conditionalMethod2&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalMethod2&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     impl.conditionalMethod2();
</span><span class="lines">@@ -5596,10 +6214,13 @@
</span><span class="cx"> #if ENABLE(Condition1) || ENABLE(Condition2)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConditionalMethod3(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;conditionalMethod3&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalMethod3&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     impl.conditionalMethod3();
</span><span class="lines">@@ -5610,19 +6231,22 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     TestObj* objArg = nullptr;
</span><span class="cx">     if (!state-&gt;argument(0).isUndefinedOrNull()) {
</span><span class="cx">         objArg = JSTestObj::toWrapped(state-&gt;uncheckedArgument(0));
</span><span class="cx">         if (UNLIKELY(!objArg))
</span><del>-            return throwArgumentTypeError(*state, 0, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;, &quot;TestObj&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, 0, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto strArg = state-&gt;argument(1).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -5633,19 +6257,22 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     TestObj* objArg = nullptr;
</span><span class="cx">     if (!state-&gt;argument(0).isUndefinedOrNull()) {
</span><span class="cx">         objArg = JSTestObj::toWrapped(state-&gt;uncheckedArgument(0));
</span><span class="cx">         if (UNLIKELY(!objArg))
</span><del>-            return throwArgumentTypeError(*state, 0, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;, &quot;TestObj&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, 0, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto longArg = state-&gt;argument(1).isUndefined() ? Optional&lt;int32_t&gt;() : convert&lt;int32_t&gt;(*state, state-&gt;uncheckedArgument(1), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -5656,14 +6283,17 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod3(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto strArg = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5673,14 +6303,17 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod4(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto longArg = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5690,16 +6323,19 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod5(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     if (UNLIKELY(!state-&gt;argument(0).isObject()))
</span><del>-        return throwArgumentMustBeFunctionError(*state, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwArgumentMustBeFunctionError(*state, throwScope, 0, &quot;callback&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     auto callback = JSTestCallback::create(asObject(state-&gt;uncheckedArgument(0)), castedThis-&gt;globalObject());
</span><span class="cx">     impl.overloadedMethod(WTFMove(callback));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5707,19 +6343,22 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod6(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     DOMStringList* listArg = nullptr;
</span><span class="cx">     if (!state-&gt;argument(0).isUndefinedOrNull()) {
</span><span class="cx">         listArg = JSDOMStringList::toWrapped(state-&gt;uncheckedArgument(0));
</span><span class="cx">         if (UNLIKELY(!listArg))
</span><del>-            return throwArgumentTypeError(*state, 0, &quot;listArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;, &quot;DOMStringList&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, 0, &quot;listArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;, &quot;DOMStringList&quot;);
</ins><span class="cx">     }
</span><span class="cx">     impl.overloadedMethod(WTFMove(listArg));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5727,14 +6366,17 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod7(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto arrayArg = toNativeArray&lt;String&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5744,17 +6386,20 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod8(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto objArg = JSTestObj::toWrapped(state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(!objArg))
</span><del>-        return throwArgumentTypeError(*state, 0, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;, &quot;TestObj&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 0, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     impl.overloadedMethod(*objArg);
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -5761,14 +6406,17 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod9(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto arrayArg = toNativeArray&lt;String&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5778,14 +6426,17 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod10(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto arrayArg = toNativeArray&lt;uint32_t&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5795,14 +6446,17 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod11(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto strArg = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5812,10 +6466,13 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethod12(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     Vector&lt;Blob*&gt; blobArgs;
</span><span class="lines">@@ -5824,7 +6481,7 @@
</span><span class="cx">     for (unsigned i = 0, count = state-&gt;argumentCount(); i &lt; count; ++i) {
</span><span class="cx">         auto* item = JSBlob::toWrapped(state-&gt;uncheckedArgument(i));
</span><span class="cx">         if (!item)
</span><del>-            return throwArgumentTypeError(*state, i, &quot;blobArgs&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;, &quot;Blob&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, i, &quot;blobArgs&quot;, &quot;TestObject&quot;, &quot;overloadedMethod&quot;, &quot;Blob&quot;);
</ins><span class="cx">         blobArgs.uncheckedAppend(item);
</span><span class="cx">     }
</span><span class="cx">     impl.overloadedMethod(WTFMove(blobArgs));
</span><span class="lines">@@ -5833,6 +6490,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(2, state-&gt;argumentCount());
</span><span class="cx">     if (argsCount == 0) {
</span><span class="cx">         return jsTestObjPrototypeFunctionOverloadedMethod12(state);
</span><span class="lines">@@ -5869,19 +6529,22 @@
</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethod2(state);
</span><span class="cx">         return jsTestObjPrototypeFunctionOverloadedMethod1(state);
</span><span class="cx">     }
</span><del>-    return throwVMTypeError(state);
</del><ins>+    return throwVMTypeError(state, throwScope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethodWithOptionalParameter&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethodWithOptionalParameter&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto strArg = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5889,7 +6552,7 @@
</span><span class="cx">     if (!state-&gt;argument(1).isUndefinedOrNull()) {
</span><span class="cx">         objArg = JSTestObj::toWrapped(state-&gt;uncheckedArgument(1));
</span><span class="cx">         if (UNLIKELY(!objArg))
</span><del>-            return throwArgumentTypeError(*state, 1, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethodWithOptionalParameter&quot;, &quot;TestObj&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, 1, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethodWithOptionalParameter&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     }
</span><span class="cx">     impl.overloadedMethodWithOptionalParameter(WTFMove(strArg), WTFMove(objArg));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5897,19 +6560,22 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;overloadedMethodWithOptionalParameter&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;overloadedMethodWithOptionalParameter&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     TestObj* objArg = nullptr;
</span><span class="cx">     if (!state-&gt;argument(0).isUndefinedOrNull()) {
</span><span class="cx">         objArg = JSTestObj::toWrapped(state-&gt;uncheckedArgument(0));
</span><span class="cx">         if (UNLIKELY(!objArg))
</span><del>-            return throwArgumentTypeError(*state, 0, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethodWithOptionalParameter&quot;, &quot;TestObj&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, 0, &quot;objArg&quot;, &quot;TestObject&quot;, &quot;overloadedMethodWithOptionalParameter&quot;, &quot;TestObj&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto longArg = state-&gt;argument(1).isUndefined() ? Optional&lt;int32_t&gt;() : convert&lt;int32_t&gt;(*state, state-&gt;uncheckedArgument(1), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -5920,6 +6586,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(2, state-&gt;argumentCount());
</span><span class="cx">     if (argsCount == 1) {
</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);
</span><span class="lines">@@ -5937,11 +6606,14 @@
</span><span class="cx">             return jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2(state);
</span><span class="cx">         return jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter1(state);
</span><span class="cx">     }
</span><del>-    return argsCount &lt; 1 ? throwVMError(state, createNotEnoughArgumentsError(state)) : throwVMTypeError(state);
</del><ins>+    return argsCount &lt; 1 ? throwVMError(state, throwScope, createNotEnoughArgumentsError(state)) : throwVMTypeError(state, throwScope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     TestObj::classMethod();
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -5948,6 +6620,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethodWithOptional(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto arg = state-&gt;argument(0).isUndefined() ? Optional&lt;int32_t&gt;() : convert&lt;int32_t&gt;(*state, state-&gt;uncheckedArgument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5957,8 +6632,11 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethod2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     return JSValue::encode(JSTestObj::classMethod2(state));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -5965,8 +6643,11 @@
</span><span class="cx"> #if ENABLE(Condition1)
</span><span class="cx"> static inline EncodedJSValue jsTestObjConstructorFunctionOverloadedMethod11(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto arg = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5979,8 +6660,11 @@
</span><span class="cx"> #if ENABLE(Condition1)
</span><span class="cx"> static inline EncodedJSValue jsTestObjConstructorFunctionOverloadedMethod12(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto type = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -5993,6 +6677,9 @@
</span><span class="cx"> #if ENABLE(Condition1)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());
</span><span class="cx">     if (argsCount == 1) {
</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);
</span><span class="lines">@@ -6004,20 +6691,23 @@
</span><span class="cx">         return jsTestObjConstructorFunctionOverloadedMethod12(state);
</span><span class="cx"> #endif
</span><span class="cx">     }
</span><del>-    return argsCount &lt; 1 ? throwVMError(state, createNotEnoughArgumentsError(state)) : throwVMTypeError(state);
</del><ins>+    return argsCount &lt; 1 ? throwVMError(state, throwScope, createNotEnoughArgumentsError(state)) : throwVMTypeError(state, throwScope);
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionClassMethodWithClamp(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;classMethodWithClamp&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;classMethodWithClamp&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto objArgsShort = convert&lt;uint16_t&gt;(*state, state-&gt;argument(0), Clamp);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6030,14 +6720,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionClassMethodWithEnforceRange(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;classMethodWithEnforceRange&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;classMethodWithEnforceRange&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto objArgsShort = convert&lt;uint16_t&gt;(*state, state-&gt;argument(0), EnforceRange);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6050,14 +6743,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithUnsignedLongSequence(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithUnsignedLongSequence&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithUnsignedLongSequence&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto unsignedLongSequence = toNativeArray&lt;uint32_t&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6067,14 +6763,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionStringArrayFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;stringArrayFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;stringArrayFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto values = toNativeArray&lt;String&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -6087,18 +6786,21 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionDomStringListFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;domStringListFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;domStringListFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto values = JSDOMStringList::toWrapped(state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(!values))
</span><del>-        return throwArgumentTypeError(*state, 0, &quot;values&quot;, &quot;TestObject&quot;, &quot;domStringListFunction&quot;, &quot;DOMStringList&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 0, &quot;values&quot;, &quot;TestObject&quot;, &quot;domStringListFunction&quot;, &quot;DOMStringList&quot;);
</ins><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), impl.domStringListFunction(*values, ec));
</span><span class="cx"> 
</span><span class="cx">     setDOMException(state, ec);
</span><span class="lines">@@ -6107,14 +6809,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithAndWithoutNullableSequence&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithAndWithoutNullableSequence&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto arrayArg = toNativeArray&lt;uint32_t&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6127,14 +6832,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionGetElementById(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;getElementById&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;getElementById&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto elementId = AtomicString(state-&gt;argument(0).toString(state)-&gt;toExistingAtomicString(state));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6144,10 +6852,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionGetSVGDocument(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;getSVGDocument&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;getSVGDocument&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -6161,17 +6872,20 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;convert1&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;convert1&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto value = JSTestNode::toWrapped(state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(!value))
</span><del>-        return throwArgumentTypeError(*state, 0, &quot;value&quot;, &quot;TestObject&quot;, &quot;convert1&quot;, &quot;TestNode&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 0, &quot;value&quot;, &quot;TestObject&quot;, &quot;convert1&quot;, &quot;TestNode&quot;);
</ins><span class="cx">     impl.convert1(*value);
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -6178,19 +6892,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;convert2&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;convert2&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     TestNode* value = nullptr;
</span><span class="cx">     if (!state-&gt;argument(0).isUndefinedOrNull()) {
</span><span class="cx">         value = JSTestNode::toWrapped(state-&gt;uncheckedArgument(0));
</span><span class="cx">         if (UNLIKELY(!value))
</span><del>-            return throwArgumentTypeError(*state, 0, &quot;value&quot;, &quot;TestObject&quot;, &quot;convert2&quot;, &quot;TestNode&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, 0, &quot;value&quot;, &quot;TestObject&quot;, &quot;convert2&quot;, &quot;TestNode&quot;);
</ins><span class="cx">     }
</span><span class="cx">     impl.convert2(WTFMove(value));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6198,14 +6915,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert3(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;convert3&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;convert3&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto value = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6215,14 +6935,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert4(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;convert4&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;convert4&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto value = valueToStringWithUndefinedOrNullCheck(state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6232,10 +6955,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMutablePointFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;mutablePointFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;mutablePointFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), SVGPropertyTearOff&lt;SVGPoint&gt;::create(impl.mutablePointFunction()));
</span><span class="lines">@@ -6244,10 +6970,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionImmutablePointFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;immutablePointFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;immutablePointFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), SVGPropertyTearOff&lt;SVGPoint&gt;::create(impl.immutablePointFunction()));
</span><span class="lines">@@ -6256,10 +6985,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOrange(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;orange&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;orange&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     impl.banana();
</span><span class="lines">@@ -6268,14 +7000,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionVariadicStringMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;variadicStringMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;variadicStringMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto head = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6288,14 +7023,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionVariadicDoubleMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;variadicDoubleMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;variadicDoubleMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto head = convert&lt;double&gt;(*state, state-&gt;argument(0), ShouldAllowNonFinite::Yes);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6308,17 +7046,20 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionVariadicNodeMethod(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;variadicNodeMethod&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;variadicNodeMethod&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto head = JSNode::toWrapped(state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(!head))
</span><del>-        return throwArgumentTypeError(*state, 0, &quot;head&quot;, &quot;TestObject&quot;, &quot;variadicNodeMethod&quot;, &quot;Node&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 0, &quot;head&quot;, &quot;TestObject&quot;, &quot;variadicNodeMethod&quot;, &quot;Node&quot;);
</ins><span class="cx">     Vector&lt;Node*&gt; tail;
</span><span class="cx">     ASSERT(1 &lt;= state-&gt;argumentCount());
</span><span class="cx">     tail.reserveInitialCapacity(state-&gt;argumentCount() - 1);
</span><span class="lines">@@ -6325,7 +7066,7 @@
</span><span class="cx">     for (unsigned i = 1, count = state-&gt;argumentCount(); i &lt; count; ++i) {
</span><span class="cx">         auto* item = JSNode::toWrapped(state-&gt;uncheckedArgument(i));
</span><span class="cx">         if (!item)
</span><del>-            return throwArgumentTypeError(*state, i, &quot;tail&quot;, &quot;TestObject&quot;, &quot;variadicNodeMethod&quot;, &quot;Node&quot;);
</del><ins>+            return throwArgumentTypeError(*state, throwScope, i, &quot;tail&quot;, &quot;TestObject&quot;, &quot;variadicNodeMethod&quot;, &quot;Node&quot;);
</ins><span class="cx">         tail.uncheckedAppend(item);
</span><span class="cx">     }
</span><span class="cx">     impl.variadicNodeMethod(*head, WTFMove(tail));
</span><span class="lines">@@ -6334,14 +7075,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionAny(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;any&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;any&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto a = convert&lt;float&gt;(*state, state-&gt;argument(0), ShouldAllowNonFinite::Yes);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6360,10 +7104,13 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionTestPromiseFunctionPromise(ExecState* state, JSPromiseDeferred* promiseDeferred)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;testPromiseFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testPromiseFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     impl.testPromiseFunction(DeferredWrapper(state, castedThis-&gt;globalObject(), promiseDeferred));
</span><span class="lines">@@ -6378,14 +7125,17 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionTestPromiseFunctionWithFloatArgumentPromise(ExecState* state, JSPromiseDeferred* promiseDeferred)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;testPromiseFunctionWithFloatArgument&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testPromiseFunctionWithFloatArgument&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto a = convert&lt;float&gt;(*state, state-&gt;argument(0), ShouldAllowNonFinite::No);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6401,10 +7151,13 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionTestPromiseFunctionWithExceptionPromise(ExecState* state, JSPromiseDeferred* promiseDeferred)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;testPromiseFunctionWithException&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testPromiseFunctionWithException&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -6421,10 +7174,13 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionTestPromiseFunctionWithOptionalIntArgumentPromise(ExecState* state, JSPromiseDeferred* promiseDeferred)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;testPromiseFunctionWithOptionalIntArgument&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testPromiseFunctionWithOptionalIntArgument&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto a = state-&gt;argument(0).isUndefined() ? Optional&lt;int32_t&gt;() : convert&lt;int32_t&gt;(*state, state-&gt;uncheckedArgument(0), NormalConversion);
</span><span class="lines">@@ -6442,14 +7198,17 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1Promise(ExecState* state, JSPromiseDeferred* promiseDeferred)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;testPromiseOverloadedFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testPromiseOverloadedFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto a = convert&lt;float&gt;(*state, state-&gt;argument(0), ShouldAllowNonFinite::No);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6465,17 +7224,20 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise(ExecState* state, JSPromiseDeferred* promiseDeferred)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;testPromiseOverloadedFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;testPromiseOverloadedFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto request = JSFetchRequest::toWrapped(state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(!request))
</span><del>-        return throwArgumentTypeError(*state, 0, &quot;request&quot;, &quot;TestObject&quot;, &quot;testPromiseOverloadedFunction&quot;, &quot;FetchRequest&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 0, &quot;request&quot;, &quot;TestObject&quot;, &quot;testPromiseOverloadedFunction&quot;, &quot;FetchRequest&quot;);
</ins><span class="cx">     impl.testPromiseOverloadedFunction(*request, DeferredWrapper(state, castedThis-&gt;globalObject(), promiseDeferred));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -6482,6 +7244,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionTestPromiseOverloadedFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());
</span><span class="cx">     if (argsCount == 1) {
</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);
</span><span class="lines">@@ -6491,7 +7256,7 @@
</span><span class="cx">             return jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1(state);
</span><span class="cx">         return jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1(state);
</span><span class="cx">     }
</span><del>-    return argsCount &lt; 1 ? throwVMError(state, createNotEnoughArgumentsError(state)) : throwVMTypeError(state);
</del><ins>+    return argsCount &lt; 1 ? throwVMError(state, throwScope, createNotEnoughArgumentsError(state)) : throwVMTypeError(state, throwScope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue jsTestObjConstructorFunctionTestStaticPromiseFunctionPromise(ExecState*, JSPromiseDeferred*);
</span><span class="lines">@@ -6502,6 +7267,9 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjConstructorFunctionTestStaticPromiseFunctionPromise(ExecState* state, JSPromiseDeferred* promiseDeferred)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     TestObj::testStaticPromiseFunction(DeferredWrapper(state, jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject()), promiseDeferred));
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="lines">@@ -6514,6 +7282,9 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjConstructorFunctionTestStaticPromiseFunctionWithExceptionPromise(ExecState* state, JSPromiseDeferred* promiseDeferred)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     TestObj::testStaticPromiseFunctionWithException(DeferredWrapper(state, jsCast&lt;JSDOMGlobalObject*&gt;(state-&gt;lexicalGlobalObject()), promiseDeferred), ec);
</span><span class="cx">     setDOMException(state, ec);
</span><span class="lines">@@ -6522,6 +7293,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNeedsCustomElementReactionStack(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx"> #if ENABLE(CUSTOM_ELEMENTS)
</span><span class="cx">     CustomElementReactionStack customElementReactionStack;
</span><span class="cx"> #endif
</span><span class="lines">@@ -6528,7 +7302,7 @@
</span><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;methodWithNeedsCustomElementReactionStack&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;methodWithNeedsCustomElementReactionStack&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     impl.methodWithNeedsCustomElementReactionStack();
</span><span class="lines">@@ -6538,14 +7312,17 @@
</span><span class="cx"> #if ENABLE(CONDITION1)
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionConditionalOverload1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;conditionalOverload&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalOverload&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto str = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6558,14 +7335,17 @@
</span><span class="cx"> #if ENABLE(CONDITION2)
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionConditionalOverload2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;conditionalOverload&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;conditionalOverload&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto a = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6578,6 +7358,9 @@
</span><span class="cx"> #if ENABLE(CONDITION1) || ENABLE(CONDITION2)
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConditionalOverload(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());
</span><span class="cx">     if (argsCount == 1) {
</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);
</span><span class="lines">@@ -6589,20 +7372,23 @@
</span><span class="cx">         return jsTestObjPrototypeFunctionConditionalOverload1(state);
</span><span class="cx"> #endif
</span><span class="cx">     }
</span><del>-    return argsCount &lt; 1 ? throwVMError(state, createNotEnoughArgumentsError(state)) : throwVMTypeError(state);
</del><ins>+    return argsCount &lt; 1 ? throwVMError(state, throwScope, createNotEnoughArgumentsError(state)) : throwVMTypeError(state, throwScope);
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionSingleConditionalOverload1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;singleConditionalOverload&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;singleConditionalOverload&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto str = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6613,14 +7399,17 @@
</span><span class="cx"> #if ENABLE(CONDITION)
</span><span class="cx"> static inline EncodedJSValue jsTestObjPrototypeFunctionSingleConditionalOverload2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;singleConditionalOverload&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;singleConditionalOverload&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto a = convert&lt;int32_t&gt;(*state, state-&gt;argument(0), NormalConversion);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6632,6 +7421,9 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionSingleConditionalOverload(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());
</span><span class="cx">     if (argsCount == 1) {
</span><span class="cx">         JSValue distinguishingArg = state-&gt;uncheckedArgument(0);
</span><span class="lines">@@ -6641,19 +7433,22 @@
</span><span class="cx"> #endif
</span><span class="cx">         return jsTestObjPrototypeFunctionSingleConditionalOverload1(state);
</span><span class="cx">     }
</span><del>-    return argsCount &lt; 1 ? throwVMError(state, createNotEnoughArgumentsError(state)) : throwVMTypeError(state);
</del><ins>+    return argsCount &lt; 1 ? throwVMError(state, throwScope, createNotEnoughArgumentsError(state)) : throwVMTypeError(state, throwScope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionAttachShadowRoot(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;attachShadowRoot&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;attachShadowRoot&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto init = convertDictionary&lt;TestObj::Dictionary&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -6663,10 +7458,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionToString(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestObj*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestObject&quot;, &quot;toString&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestObject&quot;, &quot;toString&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestObj::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.stringifierAttribute());
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -67,15 +67,18 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue constructJSTestOverloadedConstructors1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestOverloadedConstructorsConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto arrayBuffer = toArrayBuffer(state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     if (UNLIKELY(!arrayBuffer))
</span><del>-        return throwArgumentTypeError(*state, 0, &quot;arrayBuffer&quot;, &quot;TestOverloadedConstructors&quot;, nullptr, &quot;ArrayBuffer&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 0, &quot;arrayBuffer&quot;, &quot;TestOverloadedConstructors&quot;, nullptr, &quot;ArrayBuffer&quot;);
</ins><span class="cx">     auto object = TestOverloadedConstructors::create(*arrayBuffer);
</span><span class="cx">     return JSValue::encode(toJSNewlyCreated(state, castedThis-&gt;globalObject(), WTFMove(object)));
</span><span class="cx"> }
</span><span class="lines">@@ -82,15 +85,18 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue constructJSTestOverloadedConstructors2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestOverloadedConstructorsConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto arrayBufferView = toArrayBufferView(state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     if (UNLIKELY(!arrayBufferView))
</span><del>-        return throwArgumentTypeError(*state, 0, &quot;arrayBufferView&quot;, &quot;TestOverloadedConstructors&quot;, nullptr, &quot;ArrayBufferView&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 0, &quot;arrayBufferView&quot;, &quot;TestOverloadedConstructors&quot;, nullptr, &quot;ArrayBufferView&quot;);
</ins><span class="cx">     auto object = TestOverloadedConstructors::create(*arrayBufferView);
</span><span class="cx">     return JSValue::encode(toJSNewlyCreated(state, castedThis-&gt;globalObject(), WTFMove(object)));
</span><span class="cx"> }
</span><span class="lines">@@ -97,13 +103,16 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue constructJSTestOverloadedConstructors3(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestOverloadedConstructorsConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto blob = JSBlob::toWrapped(state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(!blob))
</span><del>-        return throwArgumentTypeError(*state, 0, &quot;blob&quot;, &quot;TestOverloadedConstructors&quot;, nullptr, &quot;Blob&quot;);
</del><ins>+        return throwArgumentTypeError(*state, throwScope, 0, &quot;blob&quot;, &quot;TestOverloadedConstructors&quot;, nullptr, &quot;Blob&quot;);
</ins><span class="cx">     auto object = TestOverloadedConstructors::create(*blob);
</span><span class="cx">     return JSValue::encode(toJSNewlyCreated(state, castedThis-&gt;globalObject(), WTFMove(object)));
</span><span class="cx"> }
</span><span class="lines">@@ -110,10 +119,13 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue constructJSTestOverloadedConstructors4(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestOverloadedConstructorsConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto string = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -123,6 +135,9 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue constructJSTestOverloadedConstructors5(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestOverloadedConstructorsConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     Vector&lt;int32_t&gt; longArgs = toNativeArguments&lt;int32_t&gt;(*state, 0);
</span><span class="lines">@@ -134,6 +149,9 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; EncodedJSValue JSC_HOST_CALL JSTestOverloadedConstructorsConstructor::construct(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());
</span><span class="cx">     if (argsCount == 0) {
</span><span class="cx">         return constructJSTestOverloadedConstructors5(state);
</span><span class="lines">@@ -150,7 +168,7 @@
</span><span class="cx">             return constructJSTestOverloadedConstructors5(state);
</span><span class="cx">         return constructJSTestOverloadedConstructors4(state);
</span><span class="cx">     }
</span><del>-    return throwVMTypeError(state);
</del><ins>+    return throwVMTypeError(state, throwScope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; JSValue JSTestOverloadedConstructorsConstructor::prototypeForStructure(JSC::VM&amp; vm, const JSDOMGlobalObject&amp; globalObject)
</span><span class="lines">@@ -208,18 +226,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestOverloadedConstructorsConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestOverloadedConstructorsPrototype* domObject = jsDynamicCast&lt;JSTestOverloadedConstructorsPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestOverloadedConstructors::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestOverloadedConstructorsConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestOverloadedConstructorsPrototype* domObject = jsDynamicCast&lt;JSTestOverloadedConstructorsPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsWithSequencecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -66,6 +66,9 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue constructJSTestOverloadedConstructorsWithSequence1(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestOverloadedConstructorsWithSequenceConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     auto sequenceOfStrings = state-&gt;argument(0).isUndefined() ? Vector&lt;String&gt;() : toNativeArray&lt;String&gt;(*state, state-&gt;uncheckedArgument(0));
</span><span class="lines">@@ -77,10 +80,13 @@
</span><span class="cx"> 
</span><span class="cx"> static inline EncodedJSValue constructJSTestOverloadedConstructorsWithSequence2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestOverloadedConstructorsWithSequenceConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto string = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -90,6 +96,9 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; EncodedJSValue JSC_HOST_CALL JSTestOverloadedConstructorsWithSequenceConstructor::construct(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     size_t argsCount = std::min&lt;size_t&gt;(1, state-&gt;argumentCount());
</span><span class="cx">     if (argsCount == 0) {
</span><span class="cx">         return constructJSTestOverloadedConstructorsWithSequence1(state);
</span><span class="lines">@@ -102,7 +111,7 @@
</span><span class="cx">             return constructJSTestOverloadedConstructorsWithSequence1(state);
</span><span class="cx">         return constructJSTestOverloadedConstructorsWithSequence2(state);
</span><span class="cx">     }
</span><del>-    return throwVMTypeError(state);
</del><ins>+    return throwVMTypeError(state, throwScope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; JSValue JSTestOverloadedConstructorsWithSequenceConstructor::prototypeForStructure(JSC::VM&amp; vm, const JSDOMGlobalObject&amp; globalObject)
</span><span class="lines">@@ -160,18 +169,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestOverloadedConstructorsWithSequenceConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestOverloadedConstructorsWithSequencePrototype* domObject = jsDynamicCast&lt;JSTestOverloadedConstructorsWithSequencePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestOverloadedConstructorsWithSequence::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestOverloadedConstructorsWithSequenceConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestOverloadedConstructorsWithSequencePrototype* domObject = jsDynamicCast&lt;JSTestOverloadedConstructorsWithSequencePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -158,18 +158,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestOverrideBuiltinsConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestOverrideBuiltinsPrototype* domObject = jsDynamicCast&lt;JSTestOverrideBuiltinsPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestOverrideBuiltins::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestOverrideBuiltinsConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestOverrideBuiltinsPrototype* domObject = jsDynamicCast&lt;JSTestOverrideBuiltinsPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -194,14 +198,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestOverrideBuiltinsPrototypeFunctionNamedItem(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestOverrideBuiltins*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestOverrideBuiltins&quot;, &quot;namedItem&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestOverrideBuiltins&quot;, &quot;namedItem&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestOverrideBuiltins::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto name = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -134,12 +134,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestSerializedScriptValueInterfaceValue(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestSerializedScriptValueInterface&quot;, &quot;value&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestSerializedScriptValueInterface&quot;, &quot;value&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = impl.value() ? impl.value()-&gt;deserialize(state, castedThis-&gt;globalObject(), 0) : jsNull();
</span><span class="lines">@@ -149,12 +151,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestSerializedScriptValueInterfaceReadonlyValue(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestSerializedScriptValueInterface&quot;, &quot;readonlyValue&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestSerializedScriptValueInterface&quot;, &quot;readonlyValue&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = impl.readonlyValue() ? impl.readonlyValue()-&gt;deserialize(state, castedThis-&gt;globalObject(), 0) : jsNull();
</span><span class="lines">@@ -164,12 +168,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestSerializedScriptValueInterfaceCachedValue(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestSerializedScriptValueInterface&quot;, &quot;cachedValue&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestSerializedScriptValueInterface&quot;, &quot;cachedValue&quot;);
</ins><span class="cx">     }
</span><span class="cx">     if (JSValue cachedValue = castedThis-&gt;m_cachedValue.get())
</span><span class="cx">         return JSValue::encode(cachedValue);
</span><span class="lines">@@ -182,12 +188,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestSerializedScriptValueInterfacePorts(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestSerializedScriptValueInterface&quot;, &quot;ports&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestSerializedScriptValueInterface&quot;, &quot;ports&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsArray(state, castedThis-&gt;globalObject(), impl.ports());
</span><span class="lines">@@ -197,12 +205,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestSerializedScriptValueInterfaceCachedReadonlyValue(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestSerializedScriptValueInterface&quot;, &quot;cachedReadonlyValue&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestSerializedScriptValueInterface&quot;, &quot;cachedReadonlyValue&quot;);
</ins><span class="cx">     }
</span><span class="cx">     if (JSValue cachedValue = castedThis-&gt;m_cachedReadonlyValue.get())
</span><span class="cx">         return JSValue::encode(cachedValue);
</span><span class="lines">@@ -215,18 +225,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestSerializedScriptValueInterfaceConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestSerializedScriptValueInterfacePrototype* domObject = jsDynamicCast&lt;JSTestSerializedScriptValueInterfacePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestSerializedScriptValueInterface::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestSerializedScriptValueInterfaceConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestSerializedScriptValueInterfacePrototype* domObject = jsDynamicCast&lt;JSTestSerializedScriptValueInterfacePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -235,11 +249,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestSerializedScriptValueInterfaceValue(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestSerializedScriptValueInterface&quot;, &quot;value&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestSerializedScriptValueInterface&quot;, &quot;value&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = SerializedScriptValue::create(state, value, 0, 0);
</span><span class="lines">@@ -252,11 +268,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestSerializedScriptValueInterfaceCachedValue(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestSerializedScriptValueInterface* castedThis = jsDynamicCast&lt;JSTestSerializedScriptValueInterface*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestSerializedScriptValueInterface&quot;, &quot;cachedValue&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestSerializedScriptValueInterface&quot;, &quot;cachedValue&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = SerializedScriptValue::create(state, value, 0, 0);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSTestTypedefscpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -124,15 +124,18 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; EncodedJSValue JSC_HOST_CALL JSTestTypedefsConstructor::construct(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     auto* castedThis = jsCast&lt;JSTestTypedefsConstructor*&gt;(state-&gt;callee());
</span><span class="cx">     ASSERT(castedThis);
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 2))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto hello = state-&gt;argument(0).toWTFString(state);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     if (UNLIKELY(!state-&gt;argument(1).isObject()))
</span><del>-        return throwArgumentMustBeFunctionError(*state, 1, &quot;testCallback&quot;, &quot;TestTypedefs&quot;, nullptr);
</del><ins>+        return throwArgumentMustBeFunctionError(*state, throwScope, 1, &quot;testCallback&quot;, &quot;TestTypedefs&quot;, nullptr);
</ins><span class="cx">     auto testCallback = JSTestCallback::create(asObject(state-&gt;uncheckedArgument(1)), castedThis-&gt;globalObject());
</span><span class="cx">     auto object = TestTypedefs::create(WTFMove(hello), *testCallback);
</span><span class="cx">     return JSValue::encode(toJSNewlyCreated(state, castedThis-&gt;globalObject(), WTFMove(object)));
</span><span class="lines">@@ -210,12 +213,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestTypedefsUnsignedLongLongAttr(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;unsignedLongLongAttr&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;unsignedLongLongAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.unsignedLongLongAttr());
</span><span class="lines">@@ -225,12 +230,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestTypedefsImmutableSerializedScriptValue(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;immutableSerializedScriptValue&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;immutableSerializedScriptValue&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = impl.immutableSerializedScriptValue() ? impl.immutableSerializedScriptValue()-&gt;deserialize(state, castedThis-&gt;globalObject(), 0) : jsNull();
</span><span class="lines">@@ -240,12 +247,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestTypedefsConstructorTestSubObj(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;TestSubObj&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;TestSubObj&quot;);
</ins><span class="cx">     }
</span><span class="cx">     return JSValue::encode(JSTestSubObj::getConstructor(state-&gt;vm(), castedThis-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="lines">@@ -253,12 +262,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestTypedefsAttrWithGetterException(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;attrWithGetterException&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;attrWithGetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="lines">@@ -270,12 +281,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestTypedefsAttrWithSetterException(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;attrWithSetterException&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;attrWithSetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsNumber(impl.attrWithSetterException());
</span><span class="lines">@@ -285,12 +298,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestTypedefsStringAttrWithGetterException(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;stringAttrWithGetterException&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;stringAttrWithGetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="lines">@@ -302,12 +317,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestTypedefsStringAttrWithSetterException(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;stringAttrWithSetterException&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;stringAttrWithSetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.stringAttrWithSetterException());
</span><span class="lines">@@ -317,18 +334,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsTestTypedefsConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSTestTypedefsPrototype* domObject = jsDynamicCast&lt;JSTestTypedefsPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSTestTypedefs::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestTypedefsConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSTestTypedefsPrototype* domObject = jsDynamicCast&lt;JSTestTypedefsPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span><span class="lines">@@ -337,11 +358,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestTypedefsUnsignedLongLongAttr(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;unsignedLongLongAttr&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;unsignedLongLongAttr&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;uint64_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -354,11 +377,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestTypedefsImmutableSerializedScriptValue(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;immutableSerializedScriptValue&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;immutableSerializedScriptValue&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = SerializedScriptValue::create(state, value, 0, 0);
</span><span class="lines">@@ -371,11 +396,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestTypedefsAttrWithGetterException(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;attrWithGetterException&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;attrWithGetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = convert&lt;int32_t&gt;(*state, value, NormalConversion);
</span><span class="lines">@@ -388,11 +415,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestTypedefsAttrWithSetterException(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;attrWithSetterException&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;attrWithSetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -407,11 +436,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestTypedefsStringAttrWithGetterException(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;stringAttrWithGetterException&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;stringAttrWithGetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto nativeValue = value.toWTFString(state);
</span><span class="lines">@@ -424,11 +455,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool setJSTestTypedefsStringAttrWithSetterException(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><del>-    JSValue value = JSValue::decode(encodedValue);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);    JSValue value = JSValue::decode(encodedValue);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSTestTypedefs* castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwSetterTypeError(*state, &quot;TestTypedefs&quot;, &quot;stringAttrWithSetterException&quot;);
</del><ins>+        return throwSetterTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;stringAttrWithSetterException&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span><span class="lines">@@ -448,10 +481,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestTypedefsPrototypeFunctionFunc(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestTypedefs&quot;, &quot;func&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;func&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestTypedefs::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     auto x = state-&gt;argument(0).isUndefined() ? Vector&lt;int32_t&gt;() : toNativeArray&lt;int32_t&gt;(*state, state-&gt;uncheckedArgument(0));
</span><span class="lines">@@ -463,14 +499,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestTypedefsPrototypeFunctionSetShadow(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestTypedefs&quot;, &quot;setShadow&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;setShadow&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestTypedefs::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 3))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto width = convert&lt;float&gt;(*state, state-&gt;argument(0), ShouldAllowNonFinite::Yes);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -492,14 +531,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestTypedefsPrototypeFunctionMethodWithSequenceArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestTypedefs&quot;, &quot;methodWithSequenceArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;methodWithSequenceArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestTypedefs::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto sequenceArg = toRefPtrNativeArray&lt;SerializedScriptValue, JSSerializedScriptValue&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -509,14 +551,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestTypedefsPrototypeFunctionNullableSequenceArg(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestTypedefs&quot;, &quot;nullableSequenceArg&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;nullableSequenceArg&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestTypedefs::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto sequenceArg = toNativeArray&lt;String&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -526,14 +571,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestTypedefsPrototypeFunctionFuncWithClamp(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestTypedefs&quot;, &quot;funcWithClamp&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;funcWithClamp&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestTypedefs::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto arg1 = convert&lt;uint64_t&gt;(*state, state-&gt;argument(0), Clamp);
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -546,10 +594,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestTypedefsPrototypeFunctionImmutablePointFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestTypedefs&quot;, &quot;immutablePointFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;immutablePointFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestTypedefs::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = toJS(state, castedThis-&gt;globalObject(), SVGPropertyTearOff&lt;SVGPoint&gt;::create(impl.immutablePointFunction()));
</span><span class="lines">@@ -558,14 +609,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestTypedefsPrototypeFunctionStringSequenceFunction(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestTypedefs&quot;, &quot;stringSequenceFunction&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;stringSequenceFunction&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestTypedefs::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto values = toNativeArray&lt;String&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -578,14 +632,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestTypedefsPrototypeFunctionStringSequenceFunction2(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestTypedefs&quot;, &quot;stringSequenceFunction2&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;stringSequenceFunction2&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestTypedefs::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     ExceptionCode ec = 0;
</span><span class="cx">     auto values = toNativeArray&lt;String&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="lines">@@ -598,14 +655,17 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestTypedefsPrototypeFunctionCallWithSequenceThatRequiresInclude(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestTypedefs&quot;, &quot;callWithSequenceThatRequiresInclude&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;callWithSequenceThatRequiresInclude&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestTypedefs::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     if (UNLIKELY(state-&gt;argumentCount() &lt; 1))
</span><del>-        return throwVMError(state, createNotEnoughArgumentsError(state));
</del><ins>+        return throwVMError(state, throwScope, createNotEnoughArgumentsError(state));
</ins><span class="cx">     auto sequenceArg = toRefPtrNativeArray&lt;TestEventTarget, JSTestEventTarget&gt;(*state, state-&gt;argument(0));
</span><span class="cx">     if (UNLIKELY(state-&gt;hadException()))
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -615,10 +675,13 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL jsTestTypedefsPrototypeFunctionMethodWithException(ExecState* state)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     JSValue thisValue = state-&gt;thisValue();
</span><span class="cx">     auto castedThis = jsDynamicCast&lt;JSTestTypedefs*&gt;(thisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis))
</span><del>-        return throwThisTypeError(*state, &quot;TestTypedefs&quot;, &quot;methodWithException&quot;);
</del><ins>+        return throwThisTypeError(*state, throwScope, &quot;TestTypedefs&quot;, &quot;methodWithException&quot;);
</ins><span class="cx">     ASSERT_GC_OBJECT_INHERITS(castedThis, JSTestTypedefs::info());
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     ExceptionCode ec = 0;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSattributecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -134,12 +134,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsattributeReadonly(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><del>-    UNUSED_PARAM(state);
</del><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
+    UNUSED_PARAM(throwScope);
</ins><span class="cx">     UNUSED_PARAM(thisValue);
</span><span class="cx">     JSValue decodedThisValue = JSValue::decode(thisValue);
</span><span class="cx">     auto* castedThis = jsDynamicCast&lt;JSattribute*&gt;(decodedThisValue);
</span><span class="cx">     if (UNLIKELY(!castedThis)) {
</span><del>-        return throwGetterTypeError(*state, &quot;attribute&quot;, &quot;readonly&quot;);
</del><ins>+        return throwGetterTypeError(*state, throwScope, &quot;attribute&quot;, &quot;readonly&quot;);
</ins><span class="cx">     }
</span><span class="cx">     auto&amp; impl = castedThis-&gt;wrapped();
</span><span class="cx">     JSValue result = jsStringWithCache(state, impl.readonly());
</span><span class="lines">@@ -149,18 +151,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsattributeConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSattributePrototype* domObject = jsDynamicCast&lt;JSattributePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSattribute::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSattributeConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSattributePrototype* domObject = jsDynamicCast&lt;JSattributePrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebindingsscriptstestJSJSreadonlycpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -117,18 +117,22 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue jsreadonlyConstructor(ExecState* state, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSreadonlyPrototype* domObject = jsDynamicCast&lt;JSreadonlyPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject))
</span><del>-        return throwVMTypeError(state);
</del><ins>+        return throwVMTypeError(state, throwScope);
</ins><span class="cx">     return JSValue::encode(JSreadonly::getConstructor(state-&gt;vm(), domObject-&gt;globalObject()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool setJSreadonlyConstructor(ExecState* state, EncodedJSValue thisValue, EncodedJSValue encodedValue)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = state-&gt;vm();
+    auto throwScope = DECLARE_THROW_SCOPE(vm);
</ins><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSreadonlyPrototype* domObject = jsDynamicCast&lt;JSreadonlyPrototype*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (UNLIKELY(!domObject)) {
</span><del>-        throwVMTypeError(state);
</del><ins>+        throwVMTypeError(state, throwScope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     // Shadowing a built-in constructor
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebridgecc_instancecpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/c/c_instance.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/c/c_instance.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/c/c_instance.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2003, 2006 Apple Inc.  All rights reserved.
</del><ins>+ * Copyright (C) 2003, 2006, 2016 Apple Inc.  All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -68,12 +68,15 @@
</span><span class="cx"> 
</span><span class="cx"> void CInstance::moveGlobalExceptionToExecState(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (globalExceptionString().isNull())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     {
</span><span class="cx">         JSLockHolder lock(exec);
</span><del>-        exec-&gt;vm().throwException(exec, createError(exec, globalExceptionString()));
</del><ins>+        throwException(exec, scope, createError(exec, globalExceptionString()));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     globalExceptionString() = String();
</span><span class="lines">@@ -154,8 +157,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue CInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!asObject(runtimeMethod)-&gt;inherits(CRuntimeMethod::info()))
</span><del>-        return throwTypeError(exec, &quot;Attempt to invoke non-plug-in method on plug-in object.&quot;);
</del><ins>+        return throwTypeError(exec, scope, &quot;Attempt to invoke non-plug-in method on plug-in object.&quot;);
</ins><span class="cx"> 
</span><span class="cx">     CMethod* method = static_cast&lt;CMethod*&gt;(runtimeMethod-&gt;method());
</span><span class="cx">     ASSERT(method);
</span><span class="lines">@@ -184,7 +190,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!retval)
</span><del>-        exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Error calling method on NPObject.&quot;)));
</del><ins>+        throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Error calling method on NPObject.&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     for (i = 0; i &lt; count; i++)
</span><span class="cx">         _NPN_ReleaseVariantValue(&amp;cArgs[i]);
</span><span class="lines">@@ -197,6 +203,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue CInstance::invokeDefaultMethod(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!_object-&gt;_class-&gt;invokeDefault)
</span><span class="cx">         return jsUndefined();
</span><span class="cx"> 
</span><span class="lines">@@ -219,7 +228,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!retval)
</span><del>-        exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Error calling method on NPObject.&quot;)));
</del><ins>+        throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Error calling method on NPObject.&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     for (i = 0; i &lt; count; i++)
</span><span class="cx">         _NPN_ReleaseVariantValue(&amp;cArgs[i]);
</span><span class="lines">@@ -236,6 +245,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList&amp; args)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!_object-&gt;_class-&gt;construct)
</span><span class="cx">         return jsUndefined();
</span><span class="cx"> 
</span><span class="lines">@@ -258,7 +270,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!retval)
</span><del>-        exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Error calling method on NPObject.&quot;)));
</del><ins>+        throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Error calling method on NPObject.&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     for (i = 0; i &lt; count; i++)
</span><span class="cx">         _NPN_ReleaseVariantValue(&amp;cArgs[i]);
</span><span class="lines">@@ -311,6 +323,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool CInstance::toJSPrimitive(ExecState* exec, const char* name, JSValue&amp; resultValue) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     NPIdentifier ident = _NPN_GetStringIdentifier(name);
</span><span class="cx">     if (!_object-&gt;_class-&gt;hasMethod(_object, ident))
</span><span class="cx">         return false;
</span><span class="lines">@@ -328,7 +343,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!retval)
</span><del>-        exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;Error calling method on NPObject.&quot;)));
</del><ins>+        throwException(exec, scope, createError(exec, ASCIILiteral(&quot;Error calling method on NPObject.&quot;)));
</ins><span class="cx"> 
</span><span class="cx">     resultValue = convertNPVariantToValue(exec, &amp;resultVariant, m_rootObject.get());
</span><span class="cx">     _NPN_ReleaseVariantValue(&amp;resultVariant);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebridgeobjcobjc_instancemm"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_instance.mm (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_instance.mm        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_instance.mm        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2004, 2008, 2009, 2013, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2004, 2008-2009, 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -79,6 +79,9 @@
</span><span class="cx"> 
</span><span class="cx"> void ObjcInstance::moveGlobalExceptionToExecState(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!s_exception) {
</span><span class="cx">         ASSERT(!s_exceptionEnvironment);
</span><span class="cx">         return;
</span><span class="lines">@@ -86,7 +89,7 @@
</span><span class="cx"> 
</span><span class="cx">     if (!s_exceptionEnvironment || s_exceptionEnvironment == exec-&gt;vmEntryGlobalObject()) {
</span><span class="cx">         JSLockHolder lock(exec);
</span><del>-        throwError(exec, s_exception);
</del><ins>+        throwError(exec, scope, s_exception);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     [s_exception release];
</span><span class="lines">@@ -205,8 +208,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSC::JSValue ObjcInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!asObject(runtimeMethod)-&gt;inherits(ObjCRuntimeMethod::info()))
</span><del>-        return throwTypeError(exec, ASCIILiteral(&quot;Attempt to invoke non-plug-in method on plug-in object.&quot;));
</del><ins>+        return throwTypeError(exec, scope, ASCIILiteral(&quot;Attempt to invoke non-plug-in method on plug-in object.&quot;));
</ins><span class="cx"> 
</span><span class="cx">     ObjcMethod *method = static_cast&lt;ObjcMethod*&gt;(runtimeMethod-&gt;method());
</span><span class="cx">     ASSERT(method);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebridgeobjcobjc_runtimemm"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_runtime.mm (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_runtime.mm        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_runtime.mm        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2004, 2008, 2013 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2004, 2008, 2013, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -94,6 +94,9 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue ObjcField::valueFromInstance(ExecState* exec, const Instance* instance) const
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue result = jsUndefined();
</span><span class="cx">     
</span><span class="cx">     id targetObject = (static_cast&lt;const ObjcInstance*&gt;(instance))-&gt;getObject();
</span><span class="lines">@@ -109,7 +112,7 @@
</span><span class="cx">         }
</span><span class="cx">     } @catch(NSException* localException) {
</span><span class="cx">         JSLockHolder lock(exec);
</span><del>-        throwError(exec, [localException reason]);
</del><ins>+        throwError(exec, scope, [localException reason]);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     // Work around problem in some versions of GCC where result gets marked volatile and
</span><span class="lines">@@ -127,6 +130,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool ObjcField::setValueToInstance(ExecState* exec, const Instance* instance, JSValue aValue) const
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     id targetObject = (static_cast&lt;const ObjcInstance*&gt;(instance))-&gt;getObject();
</span><span class="cx">     id value = convertValueToObjcObject(exec, aValue);
</span><span class="cx"> 
</span><span class="lines">@@ -141,7 +147,7 @@
</span><span class="cx">         return true;
</span><span class="cx">     } @catch(NSException* localException) {
</span><span class="cx">         JSLockHolder lock(exec);
</span><del>-        throwError(exec, [localException reason]);
</del><ins>+        throwError(exec, scope, [localException reason]);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -156,13 +162,16 @@
</span><span class="cx"> 
</span><span class="cx"> bool ObjcArray::setValueAt(ExecState* exec, unsigned int index, JSValue aValue) const
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (![_array.get() respondsToSelector:@selector(insertObject:atIndex:)]) {
</span><del>-        throwTypeError(exec, ASCIILiteral(&quot;Array is not mutable.&quot;));
</del><ins>+        throwTypeError(exec, scope, ASCIILiteral(&quot;Array is not mutable.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (index &gt; [_array.get() count]) {
</span><del>-        exec-&gt;vm().throwException(exec, createRangeError(exec, &quot;Index exceeds array size.&quot;));
</del><ins>+        throwException(exec, scope, createRangeError(exec, &quot;Index exceeds array size.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -174,7 +183,7 @@
</span><span class="cx">         [_array.get() insertObject:oValue.objectValue atIndex:index];
</span><span class="cx">         return true;
</span><span class="cx">     } @catch(NSException* localException) {
</span><del>-        exec-&gt;vm().throwException(exec, createError(exec, &quot;Objective-C exception.&quot;));
</del><ins>+        throwException(exec, scope, createError(exec, &quot;Objective-C exception.&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="lines">@@ -181,14 +190,17 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue ObjcArray::valueAt(ExecState* exec, unsigned int index) const
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (index &gt; [_array.get() count])
</span><del>-        return exec-&gt;vm().throwException(exec, createRangeError(exec, &quot;Index exceeds array size.&quot;));
</del><ins>+        return throwException(exec, scope, createRangeError(exec, &quot;Index exceeds array size.&quot;));
</ins><span class="cx">     @try {
</span><span class="cx">         id obj = [_array.get() objectAtIndex:index];
</span><span class="cx">         if (obj)
</span><span class="cx">             return convertObjcValueToValue (exec, &amp;obj, ObjcObjectType, m_rootObject.get());
</span><span class="cx">     } @catch(NSException* localException) {
</span><del>-        return exec-&gt;vm().throwException(exec, createError(exec, &quot;Objective-C exception.&quot;));
</del><ins>+        return throwException(exec, scope, createError(exec, &quot;Objective-C exception.&quot;));
</ins><span class="cx">     }
</span><span class="cx">     return jsUndefined();
</span><span class="cx"> }
</span><span class="lines">@@ -232,9 +244,12 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callObjCFallbackObject(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    JSC::VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="cx">     if (!thisValue.inherits(ObjCRuntimeObject::info()))
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     JSValue result = jsUndefined();
</span><span class="cx"> 
</span><span class="lines">@@ -242,7 +257,7 @@
</span><span class="cx">     ObjcInstance* objcInstance = runtimeObject-&gt;getInternalObjCInstance();
</span><span class="cx"> 
</span><span class="cx">     if (!objcInstance)
</span><del>-        return JSValue::encode(RuntimeObject::throwInvalidAccessError(exec));
</del><ins>+        return JSValue::encode(RuntimeObject::throwInvalidAccessError(exec, scope));
</ins><span class="cx">     
</span><span class="cx">     objcInstance-&gt;begin();
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebridgeobjcobjc_utilityh"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_utility.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_utility.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_utility.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -75,7 +75,7 @@
</span><span class="cx"> JSValue convertObjcValueToValue(ExecState*, void* buffer, ObjcValueType, RootObject*);
</span><span class="cx"> ObjcValueType objcValueTypeForType(const char *type);
</span><span class="cx"> 
</span><del>-JSObject *throwError(ExecState *, NSString *message);
</del><ins>+JSObject *throwError(ExecState*, ThrowScope&amp;, NSString *message);
</ins><span class="cx"> 
</span><span class="cx"> } // namespace Bindings
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebridgeobjcobjc_utilitymm"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_utility.mm (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_utility.mm        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/objc/objc_utility.mm        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2004, 2013 Apple Inc.  All rights reserved.
</del><ins>+ * Copyright (C) 2004, 2013, 2016 Apple Inc.  All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -310,10 +310,10 @@
</span><span class="cx">     return objcValueType;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject *throwError(ExecState *exec, NSString *message)
</del><ins>+JSObject *throwError(ExecState *exec, ThrowScope&amp; scope, NSString *message)
</ins><span class="cx"> {
</span><span class="cx">     ASSERT(message);
</span><del>-    JSObject *error = exec-&gt;vm().throwException(exec, JSC::createError(exec, String(message)));
</del><ins>+    JSObject *error = throwException(exec, scope, JSC::createError(exec, String(message)));
</ins><span class="cx">     return error;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebridgeruntime_arraycpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_array.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_array.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_array.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003, 2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -62,9 +62,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue RuntimeArray::lengthGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeArray* thisObject = jsDynamicCast&lt;RuntimeArray*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (!thisObject)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     return JSValue::encode(jsNumber(thisObject-&gt;getLength()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -113,9 +116,12 @@
</span><span class="cx"> 
</span><span class="cx"> bool RuntimeArray::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeArray* thisObject = jsCast&lt;RuntimeArray*&gt;(cell);
</span><span class="cx">     if (propertyName == exec-&gt;propertyNames().length) {
</span><del>-        exec-&gt;vm().throwException(exec, createRangeError(exec, &quot;Range error&quot;));
</del><ins>+        throwException(exec, scope, createRangeError(exec, &quot;Range error&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -127,9 +133,12 @@
</span><span class="cx"> 
</span><span class="cx"> bool RuntimeArray::putByIndex(JSCell* cell, ExecState* exec, unsigned index, JSValue value, bool)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeArray* thisObject = jsCast&lt;RuntimeArray*&gt;(cell);
</span><span class="cx">     if (index &gt;= thisObject-&gt;getLength()) {
</span><del>-        exec-&gt;vm().throwException(exec, createRangeError(exec, &quot;Range error&quot;));
</del><ins>+        throwException(exec, scope, createRangeError(exec, &quot;Range error&quot;));
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebridgeruntime_methodcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_method.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_method.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_method.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003, 2008, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -56,9 +56,12 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue RuntimeMethod::lengthGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeMethod* thisObject = jsDynamicCast&lt;RuntimeMethod*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     if (!thisObject)
</span><del>-        return throwVMTypeError(exec);
</del><ins>+        return throwVMTypeError(exec, scope);
</ins><span class="cx">     return JSValue::encode(jsNumber(thisObject-&gt;m_method-&gt;numParameters()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -75,6 +78,9 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeMethod* method = static_cast&lt;RuntimeMethod*&gt;(exec-&gt;callee());
</span><span class="cx"> 
</span><span class="cx">     if (!method-&gt;method())
</span><span class="lines">@@ -87,13 +93,13 @@
</span><span class="cx">         RuntimeObject* runtimeObject = static_cast&lt;RuntimeObject*&gt;(asObject(thisValue));
</span><span class="cx">         instance = runtimeObject-&gt;getInternalInstance();
</span><span class="cx">         if (!instance) 
</span><del>-            return JSValue::encode(RuntimeObject::throwInvalidAccessError(exec));
</del><ins>+            return JSValue::encode(RuntimeObject::throwInvalidAccessError(exec, scope));
</ins><span class="cx">     } else {
</span><span class="cx">         // Calling a runtime object of a plugin element?
</span><span class="cx">         if (thisValue.inherits(JSHTMLElement::info()))
</span><span class="cx">             instance = pluginInstance(jsCast&lt;JSHTMLElement*&gt;(asObject(thisValue))-&gt;wrapped());
</span><span class="cx">         if (!instance)
</span><del>-            return throwVMTypeError(exec);
</del><ins>+            return throwVMTypeError(exec, scope);
</ins><span class="cx">     }
</span><span class="cx">     ASSERT(instance);
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebridgeruntime_objectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_object.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_object.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_object.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003, 2008-2009, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -64,11 +64,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue RuntimeObject::fallbackObjectGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeObject* thisObj = jsCast&lt;RuntimeObject*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     RefPtr&lt;Instance&gt; instance = thisObj-&gt;m_instance;
</span><span class="cx"> 
</span><span class="cx">     if (!instance)
</span><del>-        return JSValue::encode(throwInvalidAccessError(exec));
</del><ins>+        return JSValue::encode(throwInvalidAccessError(exec, scope));
</ins><span class="cx">     
</span><span class="cx">     instance-&gt;begin();
</span><span class="cx"> 
</span><span class="lines">@@ -82,11 +85,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue RuntimeObject::fieldGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
</span><span class="cx"> {    
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeObject* thisObj = jsCast&lt;RuntimeObject*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     RefPtr&lt;Instance&gt; instance = thisObj-&gt;m_instance;
</span><span class="cx"> 
</span><span class="cx">     if (!instance)
</span><del>-        return JSValue::encode(throwInvalidAccessError(exec));
</del><ins>+        return JSValue::encode(throwInvalidAccessError(exec, scope));
</ins><span class="cx">     
</span><span class="cx">     instance-&gt;begin();
</span><span class="cx"> 
</span><span class="lines">@@ -101,11 +107,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue RuntimeObject::methodGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeObject* thisObj = jsCast&lt;RuntimeObject*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     RefPtr&lt;Instance&gt; instance = thisObj-&gt;m_instance;
</span><span class="cx"> 
</span><span class="cx">     if (!instance)
</span><del>-        return JSValue::encode(throwInvalidAccessError(exec));
</del><ins>+        return JSValue::encode(throwInvalidAccessError(exec, scope));
</ins><span class="cx">     
</span><span class="cx">     instance-&gt;begin();
</span><span class="cx"> 
</span><span class="lines">@@ -118,9 +127,12 @@
</span><span class="cx"> 
</span><span class="cx"> bool RuntimeObject::getOwnPropertySlot(JSObject* object, ExecState *exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeObject* thisObject = jsCast&lt;RuntimeObject*&gt;(object);
</span><span class="cx">     if (!thisObject-&gt;m_instance) {
</span><del>-        throwInvalidAccessError(exec);
</del><ins>+        throwInvalidAccessError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -163,9 +175,12 @@
</span><span class="cx"> 
</span><span class="cx"> bool RuntimeObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeObject* thisObject = jsCast&lt;RuntimeObject*&gt;(cell);
</span><span class="cx">     if (!thisObject-&gt;m_instance) {
</span><del>-        throwInvalidAccessError(exec);
</del><ins>+        throwInvalidAccessError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -192,9 +207,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue RuntimeObject::defaultValue(const JSObject* object, ExecState* exec, PreferredPrimitiveType hint)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     const RuntimeObject* thisObject = jsCast&lt;const RuntimeObject*&gt;(object);
</span><span class="cx">     if (!thisObject-&gt;m_instance)
</span><del>-        return throwInvalidAccessError(exec);
</del><ins>+        return throwInvalidAccessError(exec, scope);
</ins><span class="cx">     
</span><span class="cx">     RefPtr&lt;Instance&gt; instance = thisObject-&gt;m_instance;
</span><span class="cx"> 
</span><span class="lines">@@ -258,9 +276,12 @@
</span><span class="cx"> 
</span><span class="cx"> void RuntimeObject::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray&amp; propertyNames, EnumerationMode)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     RuntimeObject* thisObject = jsCast&lt;RuntimeObject*&gt;(object);
</span><span class="cx">     if (!thisObject-&gt;m_instance) {
</span><del>-        throwInvalidAccessError(exec);
</del><ins>+        throwInvalidAccessError(exec, scope);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -271,9 +292,9 @@
</span><span class="cx">     instance-&gt;end();
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* RuntimeObject::throwInvalidAccessError(ExecState* exec)
</del><ins>+JSObject* RuntimeObject::throwInvalidAccessError(ExecState* exec, ThrowScope&amp; scope)
</ins><span class="cx"> {
</span><del>-    return exec-&gt;vm().throwException(exec, createReferenceError(exec, &quot;Trying to access object from destroyed plug-in.&quot;));
</del><ins>+    return throwException(exec, scope, createReferenceError(exec, &quot;Trying to access object from destroyed plug-in.&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> }
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebCorebridgeruntime_objecth"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_object.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_object.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebCore/bridge/runtime_object.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -59,7 +59,7 @@
</span><span class="cx"> 
</span><span class="cx">     Instance* getInternalInstance() const { return m_instance.get(); }
</span><span class="cx"> 
</span><del>-    static JSObject* throwInvalidAccessError(ExecState*);
</del><ins>+    static JSObject* throwInvalidAccessError(ExecState*, ThrowScope&amp;);
</ins><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebKitmacChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/ChangeLog (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/ChangeLog        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/ChangeLog        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,3 +1,15 @@
</span><ins>+2016-08-30  Mark Lam  &lt;mark.lam@apple.com&gt;
+
+        Introduce the ThrowScope and force every throw site to instantiate a ThrowScope.
+        https://bugs.webkit.org/show_bug.cgi?id=161171
+
+        Reviewed by Filip Pizlo and Geoffrey Garen.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::moveGlobalExceptionToExecState):
+        * Plugins/Hosted/ProxyInstance.mm:
+        (WebKit::ProxyInstance::invokeMethod):
+
</ins><span class="cx"> 2016-08-28  Andreas Kling  &lt;akling@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         document.title setter can't throw.
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebKitmacPluginsHostedNetscapePluginInstanceProxymm"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2009, 2010 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2008-2010, 2016 Apple Inc. All Rights Reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -1632,12 +1632,15 @@
</span><span class="cx"> 
</span><span class="cx"> void NetscapePluginInstanceProxy::moveGlobalExceptionToExecState(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (globalExceptionString().isNull())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     {
</span><del>-        JSLockHolder lock(exec);
-        exec-&gt;vm().throwException(exec, createError(exec, globalExceptionString()));
</del><ins>+        JSLockHolder lock(vm);
+        throwException(exec, scope, createError(exec, globalExceptionString()));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     globalExceptionString() = String();
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebKitmacPluginsHostedProxyInstancemm"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebKit/mac/Plugins/Hosted/ProxyInstance.mm        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2009, 2010 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2008-2010, 2016 Apple Inc. All Rights Reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -219,8 +219,11 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue ProxyInstance::invokeMethod(ExecState* exec, JSC::RuntimeMethod* runtimeMethod)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (!asObject(runtimeMethod)-&gt;inherits(ProxyRuntimeMethod::info()))
</span><del>-        return throwTypeError(exec, ASCIILiteral(&quot;Attempt to invoke non-plug-in method on plug-in object.&quot;));
</del><ins>+        return throwTypeError(exec, scope, ASCIILiteral(&quot;Attempt to invoke non-plug-in method on plug-in object.&quot;));
</ins><span class="cx"> 
</span><span class="cx">     ProxyMethod* method = static_cast&lt;ProxyMethod*&gt;(runtimeMethod-&gt;method());
</span><span class="cx">     ASSERT(method);
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebKit2ChangeLog"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebKit2/ChangeLog (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebKit2/ChangeLog        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebKit2/ChangeLog        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,3 +1,27 @@
</span><ins>+2016-08-30  Mark Lam  &lt;mark.lam@apple.com&gt;
+
+        Introduce the ThrowScope and force every throw site to instantiate a ThrowScope.
+        https://bugs.webkit.org/show_bug.cgi?id=161171
+
+        Reviewed by Filip Pizlo and Geoffrey Garen.
+
+        * WebProcess/Plugins/Netscape/JSNPMethod.cpp:
+        (WebKit::callMethod):
+        * WebProcess/Plugins/Netscape/JSNPObject.cpp:
+        (WebKit::JSNPObject::callMethod):
+        (WebKit::JSNPObject::callObject):
+        (WebKit::JSNPObject::callConstructor):
+        (WebKit::JSNPObject::getOwnPropertySlot):
+        (WebKit::JSNPObject::put):
+        (WebKit::JSNPObject::deleteProperty):
+        (WebKit::JSNPObject::getOwnPropertyNames):
+        (WebKit::JSNPObject::propertyGetter):
+        (WebKit::JSNPObject::methodGetter):
+        (WebKit::JSNPObject::throwInvalidAccessError):
+        * WebProcess/Plugins/Netscape/JSNPObject.h:
+        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
+        (WebKit::NPRuntimeObjectMap::moveGlobalExceptionToExecState):
+
</ins><span class="cx"> 2016-08-30  Carlos Garcia Campos  &lt;cgarcia@igalia.com&gt;
</span><span class="cx"> 
</span><span class="cx">         REGRESSION(r194846): [GTK] UI process crash visiting sites protected with HTTP auth when using GTK+ &lt; 3.14
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebKit2WebProcessPluginsNetscapeJSNPMethodcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPMethod.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2010 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2010, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -59,6 +59,9 @@
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callMethod(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSNPMethod* jsNPMethod = jsCast&lt;JSNPMethod*&gt;(exec-&gt;callee());
</span><span class="cx"> 
</span><span class="cx">     JSValue thisValue = exec-&gt;thisValue();
</span><span class="lines">@@ -78,7 +81,7 @@
</span><span class="cx">         return JSValue::encode(jsNPObject-&gt;callMethod(exec, jsNPMethod-&gt;npIdentifier()));
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    return throwVMTypeError(exec);
</del><ins>+    return throwVMTypeError(exec, scope);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> CallType JSNPMethod::getCallData(JSCell*, CallData&amp; callData)
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebKit2WebProcessPluginsNetscapeJSNPObjectcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -107,9 +107,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSNPObject::callMethod(ExecState* exec, NPIdentifier methodName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT_THIS_GC_OBJECT_INHERITS(info());
</span><span class="cx">     if (!m_npObject)
</span><del>-        return throwInvalidAccessError(exec);
</del><ins>+        return throwInvalidAccessError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     // If the propertyName is symbol.
</span><span class="cx">     if (!methodName)
</span><span class="lines">@@ -142,7 +145,7 @@
</span><span class="cx">         releaseNPVariantValue(&amp;arguments[i]);
</span><span class="cx"> 
</span><span class="cx">     if (!returnValue)
</span><del>-        exec-&gt;vm().throwException(exec, createError(exec, &quot;Error calling method on NPObject.&quot;));
</del><ins>+        throwException(exec, scope, createError(exec, &quot;Error calling method on NPObject.&quot;));
</ins><span class="cx"> 
</span><span class="cx">     JSValue propertyValue = m_objectMap-&gt;convertNPVariantToJSValue(exec, globalObject(), result);
</span><span class="cx">     releaseNPVariantValue(&amp;result);
</span><span class="lines">@@ -151,9 +154,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSC::JSValue JSNPObject::callObject(JSC::ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT_THIS_GC_OBJECT_INHERITS(info());
</span><span class="cx">     if (!m_npObject)
</span><del>-        return throwInvalidAccessError(exec);
</del><ins>+        return throwInvalidAccessError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     size_t argumentCount = exec-&gt;argumentCount();
</span><span class="cx">     Vector&lt;NPVariant, 8&gt; arguments(argumentCount);
</span><span class="lines">@@ -182,7 +188,7 @@
</span><span class="cx">         releaseNPVariantValue(&amp;arguments[i]);
</span><span class="cx"> 
</span><span class="cx">     if (!returnValue)
</span><del>-        exec-&gt;vm().throwException(exec, createError(exec, &quot;Error calling method on NPObject.&quot;));
</del><ins>+        throwException(exec, scope, createError(exec, &quot;Error calling method on NPObject.&quot;));
</ins><span class="cx"> 
</span><span class="cx">     JSValue propertyValue = m_objectMap-&gt;convertNPVariantToJSValue(exec, globalObject(), result);
</span><span class="cx">     releaseNPVariantValue(&amp;result);
</span><span class="lines">@@ -191,9 +197,12 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue JSNPObject::callConstructor(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT_THIS_GC_OBJECT_INHERITS(info());
</span><span class="cx">     if (!m_npObject)
</span><del>-        return throwInvalidAccessError(exec);
</del><ins>+        return throwInvalidAccessError(exec, scope);
</ins><span class="cx"> 
</span><span class="cx">     size_t argumentCount = exec-&gt;argumentCount();
</span><span class="cx">     Vector&lt;NPVariant, 8&gt; arguments(argumentCount);
</span><span class="lines">@@ -218,7 +227,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (!returnValue)
</span><del>-        exec-&gt;vm().throwException(exec, createError(exec, &quot;Error calling method on NPObject.&quot;));
</del><ins>+        throwException(exec, scope, createError(exec, &quot;Error calling method on NPObject.&quot;));
</ins><span class="cx">     
</span><span class="cx">     JSValue value = m_objectMap-&gt;convertNPVariantToJSValue(exec, globalObject(), result);
</span><span class="cx">     releaseNPVariantValue(&amp;result);
</span><span class="lines">@@ -265,10 +274,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSNPObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSNPObject* thisObject = JSC::jsCast&lt;JSNPObject*&gt;(object);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><span class="cx">     if (!thisObject-&gt;m_npObject) {
</span><del>-        throwInvalidAccessError(exec);
</del><ins>+        throwInvalidAccessError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="lines">@@ -299,10 +311,13 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSNPObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot&amp;)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSNPObject* thisObject = JSC::jsCast&lt;JSNPObject*&gt;(cell);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><span class="cx">     if (!thisObject-&gt;m_npObject) {
</span><del>-        throwInvalidAccessError(exec);
</del><ins>+        throwInvalidAccessError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -353,6 +368,9 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSNPObject::deleteProperty(ExecState* exec, NPIdentifier propertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     ASSERT_THIS_GC_OBJECT_INHERITS(info());
</span><span class="cx"> 
</span><span class="cx">     // If the propertyName is symbol.
</span><span class="lines">@@ -360,7 +378,7 @@
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     if (!m_npObject) {
</span><del>-        throwInvalidAccessError(exec);
</del><ins>+        throwInvalidAccessError(exec, scope);
</ins><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -389,10 +407,13 @@
</span><span class="cx"> 
</span><span class="cx"> void JSNPObject::getOwnPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray&amp; propertyNameArray, EnumerationMode)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSNPObject* thisObject = jsCast&lt;JSNPObject*&gt;(object);
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><span class="cx">     if (!thisObject-&gt;m_npObject) {
</span><del>-        throwInvalidAccessError(exec);
</del><ins>+        throwInvalidAccessError(exec, scope);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="lines">@@ -437,11 +458,14 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSNPObject::propertyGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSNPObject* thisObj = jsCast&lt;JSNPObject*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObj, info());
</span><span class="cx">     
</span><span class="cx">     if (!thisObj-&gt;m_npObject)
</span><del>-        return JSValue::encode(throwInvalidAccessError(exec));
</del><ins>+        return JSValue::encode(throwInvalidAccessError(exec, scope));
</ins><span class="cx"> 
</span><span class="cx">     if (!thisObj-&gt;m_npObject-&gt;_class-&gt;getProperty)
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -477,23 +501,26 @@
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSNPObject::methodGetter(ExecState* exec, EncodedJSValue thisValue, PropertyName propertyName)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     JSNPObject* thisObj = jsCast&lt;JSNPObject*&gt;(JSValue::decode(thisValue));
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObj, info());
</span><span class="cx">     
</span><span class="cx">     if (!thisObj-&gt;m_npObject)
</span><del>-        return JSValue::encode(throwInvalidAccessError(exec));
</del><ins>+        return JSValue::encode(throwInvalidAccessError(exec, scope));
</ins><span class="cx"> 
</span><span class="cx">     NPIdentifier npIdentifier = npIdentifierFromIdentifier(propertyName);
</span><span class="cx">     // If the propertyName is symbol.
</span><span class="cx">     if (!npIdentifier)
</span><del>-        return JSValue::encode(throwInvalidAccessError(exec));
</del><ins>+        return JSValue::encode(throwInvalidAccessError(exec, scope));
</ins><span class="cx"> 
</span><span class="cx">     return JSValue::encode(JSNPMethod::create(exec, thisObj-&gt;globalObject(), propertyName.publicName(), npIdentifier));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSNPObject::throwInvalidAccessError(ExecState* exec)
</del><ins>+JSObject* JSNPObject::throwInvalidAccessError(ExecState* exec, ThrowScope&amp; scope)
</ins><span class="cx"> {
</span><del>-    return exec-&gt;vm().throwException(exec, createReferenceError(exec, &quot;Trying to access object from destroyed plug-in.&quot;));
</del><ins>+    return throwException(exec, scope, createReferenceError(exec, &quot;Trying to access object from destroyed plug-in.&quot;));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebKit
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebKit2WebProcessPluginsNetscapeJSNPObjecth"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.h        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -96,7 +96,7 @@
</span><span class="cx"> 
</span><span class="cx">     static JSC::EncodedJSValue propertyGetter(JSC::ExecState*, JSC::EncodedJSValue, JSC::PropertyName);
</span><span class="cx">     static JSC::EncodedJSValue methodGetter(JSC::ExecState*, JSC::EncodedJSValue, JSC::PropertyName);
</span><del>-    static JSC::JSObject* throwInvalidAccessError(JSC::ExecState*);
</del><ins>+    static JSC::JSObject* throwInvalidAccessError(JSC::ExecState*, JSC::ThrowScope&amp;);
</ins><span class="cx"> 
</span><span class="cx">     NPRuntimeObjectMap* m_objectMap;
</span><span class="cx">     NPObject* m_npObject;
</span></span></pre></div>
<a id="releasesWebKitGTKwebkit214SourceWebKit2WebProcessPluginsNetscapeNPRuntimeObjectMapcpp"></a>
<div class="modfile"><h4>Modified: releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp (205594 => 205595)</h4>
<pre class="diff"><span>
<span class="info">--- releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp        2016-09-08 07:36:27 UTC (rev 205594)
+++ releases/WebKitGTK/webkit-2.14/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp        2016-09-08 07:44:11 UTC (rev 205595)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2010 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2010, 2016 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  * Redistribution and use in source and binary forms, with or without
</span><span class="cx">  * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -274,12 +274,15 @@
</span><span class="cx">     
</span><span class="cx"> void NPRuntimeObjectMap::moveGlobalExceptionToExecState(ExecState* exec)
</span><span class="cx"> {
</span><ins>+    VM&amp; vm = exec-&gt;vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+
</ins><span class="cx">     if (globalExceptionString().isNull())
</span><span class="cx">         return;
</span><span class="cx"> 
</span><span class="cx">     {
</span><del>-        JSLockHolder lock(exec);
-        exec-&gt;vm().throwException(exec, createError(exec, globalExceptionString()));
</del><ins>+        JSLockHolder lock(vm);
+        throwException(exec, scope, createError(exec, globalExceptionString()));
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     globalExceptionString() = String();
</span></span></pre>
</div>
</div>

</body>
</html>