Changeset 211065 in webkit

Timestamp:

Jan 23, 2017, 3:13:41 PM (10 years ago)

Author:

fpizlo@apple.com

Message:

SharedArrayBuffer plus WebGL should not equal CRASH
​https://bugs.webkit.org/show_bug.cgi?id=167329

Reviewed by Saam Barati.

Source/JavaScriptCore:

DOM unwrapping methods should return null rather than crashing. The code expects an
unshared buffer, so we should return null when it's shared. The caller can then decide
if they like null or not.

• runtime/JSArrayBufferViewInlines.h:

(JSC::JSArrayBufferView::toWrapped):

LayoutTests:

This test used to crash and now it doesn't. It throws some exception.

• js/shared-array-buffer-webgl-expected.txt: Added.
• js/shared-array-buffer-webgl.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/shared-array-buffer-webgl-expected.txt (added)
• LayoutTests/js/shared-array-buffer-webgl.html (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-01-23  Filip Pizlo  <fpizlo@apple.com>
+
+        SharedArrayBuffer plus WebGL should not equal CRASH
+        https://bugs.webkit.org/show_bug.cgi?id=167329
+
+        Reviewed by Saam Barati.
+        
+        This test used to crash and now it doesn't. It throws some exception.
+
+        * js/shared-array-buffer-webgl-expected.txt: Added.
+        * js/shared-array-buffer-webgl.html: Added.
+
 2017-01-23  Myles C. Maxfield  <mmaxfield@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-01-23  Filip Pizlo  <fpizlo@apple.com>
+
+        SharedArrayBuffer plus WebGL should not equal CRASH
+        https://bugs.webkit.org/show_bug.cgi?id=167329
+
+        Reviewed by Saam Barati.
+        
+        DOM unwrapping methods should return null rather than crashing. The code expects an
+        unshared buffer, so we should return null when it's shared. The caller can then decide
+        if they like null or not.
+
+        * runtime/JSArrayBufferViewInlines.h:
+        (JSC::JSArrayBufferView::toWrapped):
+
 2017-01-23  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSArrayBufferViewInlines.h

@@ -92 +92 @@
 inline RefPtr<ArrayBufferView> JSArrayBufferView::toWrapped(JSValue value)
 {
-    if (JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(value))
-        return view->unsharedImpl();
+    if (JSArrayBufferView* view = jsDynamicCast<JSArrayBufferView*>(value)) {
+        if (!view->isShared())
+            return view->unsharedImpl();
+    }
     return nullptr;
 }