Changeset 194409 in webkit

Timestamp:

Dec 23, 2015, 6:17:03 PM (11 years ago)

Author:

akling@apple.com

Message:

jsc CLI tool crashes on EOF.
<​https://webkit.org/b/152522>

Reviewed by Benjamin Poulain.

SourceProvider should treat String() like the empty string for hashing purposes.
This was a subtle behavior change in r194017 due to how zero-length strings are
treated by StringImpl::createSubstringSharingImpl().

I made these SourceProviders store a Ref<StringImpl> internally instead of a
String, to codify the fact that these strings can't be null strings.

I couldn't find a way to cause this crash through the API.

• API/JSScriptRef.cpp:

(OpaqueJSScript::OpaqueJSScript):

• parser/SourceProvider.h:

(JSC::StringSourceProvider::StringSourceProvider):

Location:

trunk/Source/JavaScriptCore

Files:

• API/JSScriptRef.cpp (modified) (3 diffs)
• ChangeLog (modified) (1 diff)
• parser/SourceProvider.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/API/JSScriptRef.cpp

@@ -49 +49 @@
     unsigned hash() const override
     {
-        return m_source.impl()->hash();
+        return m_source.get().hash();
     }
 
     StringView source() const override
     {
-        return m_source;
+        return m_source.get();
     }
 
@@ -63 +63 @@
         : SourceProvider(url, TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber::first()))
         , m_vm(vm)
-        , m_source(source)
+        , m_source(source.isNull() ? *StringImpl::empty() : *source.impl())
     {
     }
@@ -70 +70 @@
 
     VM* m_vm;
-    String m_source;
+    Ref<StringImpl> m_source;
 };
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2015-12-23  Andreas Kling  <akling@apple.com>
+
+        jsc CLI tool crashes on EOF.
+        <https://webkit.org/b/152522>
+
+        Reviewed by Benjamin Poulain.
+
+        SourceProvider should treat String() like the empty string for hashing purposes.
+        This was a subtle behavior change in r194017 due to how zero-length strings are
+        treated by StringImpl::createSubstringSharingImpl().
+
+        I made these SourceProviders store a Ref<StringImpl> internally instead of a
+        String, to codify the fact that these strings can't be null strings.
+
+        I couldn't find a way to cause this crash through the API.
+
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::OpaqueJSScript):
+        * parser/SourceProvider.h:
+        (JSC::StringSourceProvider::StringSourceProvider):
+
 2015-12-23  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/parser/SourceProvider.h

@@ -91 +91 @@
         unsigned hash() const override
         {
-            return m_source.impl()->hash();
+            return m_source.get().hash();
         }
 
         virtual StringView source() const override
         {
-            return m_source;
+            return m_source.get();
         }
 
@@ -102 +102 @@
         StringSourceProvider(const String& source, const String& url, const TextPosition& startPosition)
             : SourceProvider(url, startPosition)
-            , m_source(source)
+            , m_source(source.isNull() ? *StringImpl::empty() : *source.impl())
         {
         }
 
-        String m_source;
+        Ref<StringImpl> m_source;
     };