Changeset 285747 in webkit

Timestamp:

Nov 12, 2021, 3:17:17 PM (5 years ago)

Author:

Chris Dumez

Message:

Crash when accessing reason property of a newly created AbortSignal
​https://bugs.webkit.org/show_bug.cgi?id=233066
<rdar://problem/85249306>

Reviewed by Geoffrey Garen.

Source/WebCore:

Make sure AbortSignal.reason get initialized to jsUndefined() by default
and not a default-constructed JSValue.

Test: fast/dom/AbortSignal-reason-crash.html

• dom/AbortSignal.cpp:

(WebCore::AbortSignal::AbortSignal):

• dom/AbortSignal.h:

LayoutTests:

Add layout test coverage.

• fast/dom/AbortSignal-reason-crash-expected.txt: Added.
• fast/dom/AbortSignal-reason-crash.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/AbortSignal-reason-crash-expected.txt (added)
• LayoutTests/fast/dom/AbortSignal-reason-crash.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/dom/AbortSignal.cpp (modified) (1 diff)
• Source/WebCore/dom/AbortSignal.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2021-11-12  Chris Dumez  <cdumez@apple.com>
+
+        Crash when accessing reason property of a newly created AbortSignal
+        https://bugs.webkit.org/show_bug.cgi?id=233066
+        <rdar://problem/85249306>
+
+        Reviewed by Geoffrey Garen.
+
+        Add layout test coverage.
+
+        * fast/dom/AbortSignal-reason-crash-expected.txt: Added.
+        * fast/dom/AbortSignal-reason-crash.html: Added.
+
 2021-11-12  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2021-11-12  Chris Dumez  <cdumez@apple.com>
+
+        Crash when accessing reason property of a newly created AbortSignal
+        https://bugs.webkit.org/show_bug.cgi?id=233066
+        <rdar://problem/85249306>
+
+        Reviewed by Geoffrey Garen.
+
+        Make sure AbortSignal.reason get initialized to jsUndefined() by default
+        and not a default-constructed JSValue.
+
+        Test: fast/dom/AbortSignal-reason-crash.html
+
+        * dom/AbortSignal.cpp:
+        (WebCore::AbortSignal::AbortSignal):
+        * dom/AbortSignal.h:
+
 2021-11-12  Ryan Haddad  <ryanhaddad@apple.com>
 

trunk/Source/WebCore/dom/AbortSignal.cpp

@@ -58 +58 @@
     , m_reason(reason)
 {
+    ASSERT(reason);
 }
 

trunk/Source/WebCore/dom/AbortSignal.h

@@ -65 +65 @@
 private:
     enum class Aborted : bool { No, Yes };
-    explicit AbortSignal(ScriptExecutionContext&, Aborted = Aborted::No, JSC::JSValue reason = { });
+    explicit AbortSignal(ScriptExecutionContext&, Aborted = Aborted::No, JSC::JSValue reason = JSC::jsUndefined());
 
     // EventTarget.