Changeset 60754

Timestamp:

06/05/10 13:19:21 (5 years ago)

Author:

dumi@chromium.org

Message:

Do not pass empty handles to v8.
​https://bugs.webkit.org/show_bug.cgi?id=39896

Reviewed by Adam Barth.

Passing an empty handle to v8 results in a crash with a stack
trace that doesn't give us much information about the cause of the
crash. Instead, if we check the handles we pass to v8 and crash
when they are empty, we do not make things worse, and should get a
more informative stack trace.

• bindings/scripts/CodeGeneratorV8.pm:
• bindings/scripts/test/V8/V8TestCallback.cpp:

(WebCore::V8TestCallback::callbackWithClass1Param):
(WebCore::V8TestCallback::callbackWithClass2Param):

• bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:

(WebCore::V8SQLStatementErrorCallback::handleEvent):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/scripts/CodeGeneratorV8.pm (modified) (2 diffs)
• bindings/scripts/test/V8/V8TestCallback.cpp (modified) (3 diffs)
• bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp (modified) (2 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-05-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Do not pass empty handles to v8.
+        https://bugs.webkit.org/show_bug.cgi?id=39896
+
+        Passing an empty handle to v8 results in a crash with a stack
+        trace that doesn't give us much information about the cause of the
+        crash. Instead, if we check the handles we pass to v8 and crash
+        when they are empty, we do not make things worse, and should get a
+        more informative stack trace.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/test/V8/V8TestCallback.cpp:
+        (WebCore::V8TestCallback::callbackWithClass1Param):
+        (WebCore::V8TestCallback::callbackWithClass2Param):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8SQLStatementErrorCallback::handleEvent):
+
 2010-05-30  Antonio Gomes  <tonikitoo@webkit.org>
 

trunk/WebCore/bindings/scripts/CodeGeneratorV8.pm

@@ -2237 +2237 @@
     $implIncludes{"V8CustomVoidCallback.h"} = 1;
 
+    push(@implContent, "#include <wtf/Assertions.h>\n\n");
     push(@implContent, "namespace WebCore {\n\n");
     push(@implContent, <<END);
@@ -2278 +2279 @@
             push(@implContent, "        return true;\n\n");
             push(@implContent, "    v8::Context::Scope scope(v8Context);\n\n");
-            push(@implContent, "    v8::Handle<v8::Value> argv[] = {\n");
 
             my @argvs = ();
             foreach my $param (@params) {
                 my $paramName = $param->name;
-                push(@argvs, "        toV8(${paramName})");
+                push(@implContent, "    v8::Handle<v8::Value> ${paramName}Handle = toV8(${paramName});\n");
+                push(@implContent, "    if (${paramName}Handle.IsEmpty()) {\n");
+                push(@implContent, "        CRASH();\n");
+                push(@implContent, "        return true;\n");
+                push(@implContent, "    }\n");
+                push(@argvs, "        ${paramName}Handle");
             }
+
+            push(@implContent, "\n    v8::Handle<v8::Value> argv[] = {\n");
             push(@implContent, join(",\n", @argvs));
-
             push(@implContent, "\n    };\n\n");
             push(@implContent, "    bool callbackReturnValue = false;\n");

trunk/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp

@@ -30 +30 @@
 #include "V8DOMString.h"
 
+#include <wtf/Assertions.h>
+
 namespace WebCore {
 
@@ -55 +57 @@
     v8::Context::Scope scope(v8Context);
 
+    v8::Handle<v8::Value> class1ParamHandle = toV8(class1Param);
+    if (class1ParamHandle.IsEmpty()) {
+        CRASH();
+        return true;
+    }
+
     v8::Handle<v8::Value> argv[] = {
-        toV8(class1Param)
+        class1ParamHandle
     };
 
@@ -73 +81 @@
     v8::Context::Scope scope(v8Context);
 
+    v8::Handle<v8::Value> class2ParamHandle = toV8(class2Param);
+    if (class2ParamHandle.IsEmpty()) {
+        CRASH();
+        return true;
+    }
+    v8::Handle<v8::Value> strArgHandle = toV8(strArg);
+    if (strArgHandle.IsEmpty()) {
+        CRASH();
+        return true;
+    }
+
     v8::Handle<v8::Value> argv[] = {
-        toV8(class2Param),
-        toV8(strArg)
+        class2ParamHandle,
+        strArgHandle
     };
 

trunk/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp

@@ -40 +40 @@
 #include "V8SQLError.h"
 #include "V8SQLTransaction.h"
+#include <wtf/Assertions.h>
 
 namespace WebCore {
@@ -53 +54 @@
     v8::Context::Scope scope(v8Context);
 
+    v8::Handle<v8::Value> transactionHandle = toV8(transaction);
+    v8::Handle<v8::Value> errorHandle = toV8(error);
+    if (transactionHandle.IsEmpty() || errorHandle.isEmpty()) {
+        CRASH();
+        return true;
+    }
+
     v8::Handle<v8::Value> argv[] = {
-        toV8(transaction),
-        toV8(error)
+        transactionHandle,
+        errorHandle
     };