Changeset 233540 in webkit

Timestamp:

Jul 5, 2018, 2:35:09 PM (8 years ago)

Author:

sbarati@apple.com

Message:

ProgramExecutable may be collected as we checkSyntax on it
​https://bugs.webkit.org/show_bug.cgi?id=187359
<rdar://problem/41832135>

Reviewed by Mark Lam.

The bug was we were passing in a reference to the SourceCode field on ProgramExecutable as
the ProgramExecutable itself may be collected. The fix here is to make a copy
of the field instead of passing in a reference inside of ParserError::toErrorObject.

No new tests here as this was already caught by our iOS JSC testers.

• parser/ParserError.h:

(JSC::ParserError::toErrorObject):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• parser/ParserError.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2018-07-05  Saam Barati  <sbarati@apple.com>
+
+        ProgramExecutable may be collected as we checkSyntax on it
+        https://bugs.webkit.org/show_bug.cgi?id=187359
+        <rdar://problem/41832135>
+
+        Reviewed by Mark Lam.
+
+        The bug was we were passing in a reference to the SourceCode field on ProgramExecutable as
+        the ProgramExecutable itself may be collected. The fix here is to make a copy
+        of the field instead of passing in a reference inside of ParserError::toErrorObject.
+        
+        No new tests here as this was already caught by our iOS JSC testers.
+
+        * parser/ParserError.h:
+        (JSC::ParserError::toErrorObject):
+
 2018-07-04  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/JavaScriptCore/parser/ParserError.h

@@ -87 +87 @@
 
     JSObject* toErrorObject(
-        JSGlobalObject* globalObject, const SourceCode& source, 
+        JSGlobalObject* globalObject,
+        SourceCode source, // Note: We must copy the source here, since the objects that pass in their SourceCode field may be destroyed in addErrorInfo.
         int overrideLineNumber = -1)
     {