Changeset 83645 in webkit


Ignore:
Timestamp:
Apr 12, 2011 2:50:04 PM (13 years ago)
Author:
Stephanie Lewis
Message:

../WebCore: ​https://bugs.webkit.org/show_bug.cgi?id=58280
<rdar://problem/9252824> javascript in an inconsistent state due to serialization returning an un-handled exception
Currently serialization and deserialization can throw javascript exceptions. Since SerializedScriptValue is called in
several places that do not always involve direct calls into javascript have the functions return an error code and the callers
decide whether or not to throw exceptions.

Reviewed by Oliver Hunt.

Don't allow SerializedScriptValue to attempt to serialize objects that inherit from JSNavigator.h. Walking that object creates
additional objects which eventually causes serialization to end up throwing a stack overflow error. Instead fail immediately.

Untangle header includes. SerializedScriptValue was inheriting ScriptValue.h, but not using it. Since ScriptValue depends on
SerializedScriptValue this could lead to a circular header dependency.

No change in functionality, covered by current tests

  • WebCore.exp.in:
  • bindings/js/JSMessageEventCustom.cpp:

(WebCore::JSMessageEvent::initMessageEvent):

  • bindings/js/ScriptValue.cpp:

(WebCore::ScriptValue::serialize):
(WebCore::ScriptValue::deserialize):

  • bindings/js/ScriptValue.h:
  • bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::serialize):
(WebCore::CloneSerializer::dumpIfTerminal):
(WebCore::CloneDeserializer::deserialize):
(WebCore::SerializedScriptValue::create):
(WebCore::SerializedScriptValue::deserialize):
(WebCore::SerializedScriptValue::maybeThrowExceptionIfSerializationFailed):
(WebCore::SerializedScriptValue::serializationDidCompleteSuccessfully):

  • bindings/js/SerializedScriptValue.h:
  • bindings/js/JSWorkerContextBase.cpp: header include fix
  • loader/FrameLoader.h: header include fix
  • page/Frame.cpp: header include fix

../WebKit/gtk: ​https://bugs.webkit.org/show_bug.cgi?id=58280
<rdar://problem/9252824> javascript in an inconsistent state due to serialization returning an un-handled exception.

Reviewed by Oliver Hunt.

Add a header include. Fallout from untangling some header files in WebCore.

  • webkit/webkitwebhistoryitem.cpp:

../WebKit2: ​https://bugs.webkit.org/show_bug.cgi?id=58280
<rdar://problem/9252824> javascript in an inconsistent state due to serialization returning an un-handled exception
Change use of SerializedScriptValue::Create to use the same api as the rest of WebKit2. This has the benefit
of handling any exceptions so Javascript is not in an inconsistent state.

Reviewed by Oliver Hunt.

  • Shared/API/c/WKSerializedScriptValue.h: fix a typo
  • WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::runJavaScriptInMainFrame):

Location:
trunk/Source
Files:
15 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r83641 r83645  
     12011-04-11  Stephanie Lewis  <slewis@apple.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        https://bugs.webkit.org/show_bug.cgi?id=58280
     6        <rdar://problem/9252824> javascript in an inconsistent state due to serialization returning an un-handled exception
     7        Currently serialization and deserialization can throw javascript exceptions.  Since SerializedScriptValue is called in
     8        several places that do not always involve direct calls into javascript have the functions return an error code and the callers
     9        decide whether or not to throw exceptions.
     10
     11        Don't allow SerializedScriptValue to attempt to serialize objects that inherit from JSNavigator.h.  Walking that object creates
     12        additional objects which eventually causes serialization to end up throwing a stack overflow error.  Instead fail immediately.
     13
     14        Untangle header includes.  SerializedScriptValue was inheriting ScriptValue.h, but not using it.  Since ScriptValue depends on
     15        SerializedScriptValue this could lead to a circular header dependency.
     16
     17        No change in functionality, covered by current tests
     18
     19        * WebCore.exp.in:
     20        * bindings/js/JSMessageEventCustom.cpp:
     21        (WebCore::JSMessageEvent::initMessageEvent):
     22        * bindings/js/ScriptValue.cpp:
     23        (WebCore::ScriptValue::serialize):
     24        (WebCore::ScriptValue::deserialize):
     25        * bindings/js/ScriptValue.h:
     26        * bindings/js/SerializedScriptValue.cpp:
     27        (WebCore::CloneSerializer::serialize):
     28        (WebCore::CloneSerializer::dumpIfTerminal):
     29        (WebCore::CloneDeserializer::deserialize):
     30        (WebCore::SerializedScriptValue::create):
     31        (WebCore::SerializedScriptValue::deserialize):
     32        (WebCore::SerializedScriptValue::maybeThrowExceptionIfSerializationFailed):
     33        (WebCore::SerializedScriptValue::serializationDidCompleteSuccessfully):
     34        * bindings/js/SerializedScriptValue.h:
     35
     36        * bindings/js/JSWorkerContextBase.cpp: header include fix
     37        * loader/FrameLoader.h: header include fix
     38        * page/Frame.cpp: header include fix
     39
    1402011-03-28  Adam Barth  <abarth@webkit.org>
    241

  • trunk/Source/WebCore/WebCore.exp.in

    r83628 r83645  
    548548__ZN7WebCore21SerializedScriptValue11deserializeEPK15OpaqueJSContextPPK13OpaqueJSValue
    549549__ZN7WebCore21SerializedScriptValue6createEPK15OpaqueJSContextPK13OpaqueJSValuePS6_
    550 __ZN7WebCore21SerializedScriptValue6createEPN3JSC9ExecStateENS1_7JSValueE
    551550__ZN7WebCore21SerializedScriptValueC1ERN3WTF6VectorIhLm0EEE
    552551__ZN7WebCore21SerializedScriptValueD1Ev

  • trunk/Source/WebCore/bindings/js/JSMessageEventCustom.cpp

    r60392 r83645  
    6161    bool cancelableArg = exec->argument(2).toBoolean(exec);
    6262    PassRefPtr<SerializedScriptValue> dataArg = SerializedScriptValue::create(exec, exec->argument(3));
     63    if (exec->hadException())
     64        return jsUndefined();
    6365    const UString& originArg = exec->argument(4).toString(exec);
    6466    const UString& lastEventIdArg = exec->argument(5).toString(exec);

  • trunk/Source/WebCore/bindings/js/JSWorkerContextBase.cpp

    r80742 r83645  
    3232#include "JSWorkerContextBase.h"
    3333
     34#include "DOMWrapperWorld.h"
    3435#include "JSDedicatedWorkerContext.h"
    3536#include "JSSharedWorkerContext.h"

  • trunk/Source/WebCore/bindings/js/ScriptValue.cpp

    r83385 r83645  
    101101}
    102102
    103 PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState)
     103PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState, SerializationErrorMode throwExceptions)
    104104{
    105     return SerializedScriptValue::create(scriptState, jsValue());
     105    return SerializedScriptValue::create(scriptState, jsValue(), throwExceptions);
    106106}
    107107
    108 ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value)
     108ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value, SerializationErrorMode throwExceptions)
    109109{
    110     return ScriptValue(scriptState->globalData(), value->deserialize(scriptState, scriptState->lexicalGlobalObject()));
     110    return ScriptValue(scriptState->globalData(), value->deserialize(scriptState, scriptState->lexicalGlobalObject(), throwExceptions));
    111111}
    112112

  • trunk/Source/WebCore/bindings/js/ScriptValue.h

    r83385 r83645  
    3434#include "JSDOMBinding.h"
    3535#include "PlatformString.h"
     36#include "SerializedScriptValue.h"
    3637#include "ScriptState.h"
    3738#include <heap/Strong.h>
    … …  
    6263    bool operator==(const ScriptValue& other) const { return m_value == other.m_value; }
    6364
    64     PassRefPtr<SerializedScriptValue> serialize(ScriptState*);
    65     static ScriptValue deserialize(ScriptState*, SerializedScriptValue*);
     65    PassRefPtr<SerializedScriptValue> serialize(ScriptState*, SerializationErrorMode = Throwing);
     66    static ScriptValue deserialize(ScriptState*, SerializedScriptValue*, SerializationErrorMode = Throwing);
    6667
    6768    static ScriptValue undefined();

  • trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp

    r80951 r83645  
    3737#include "JSFileList.h"
    3838#include "JSImageData.h"
     39#include "JSNavigator.h"
    3940#include "SharedBuffer.h"
    4041#include <limits>
    … …  
    161162 */
    162163
     164typedef pair<JSC::JSValue, SerializationReturnCode> DeserializationResult;
     165
    163166class CloneBase {
    164167protected:
    … …  
    248251class CloneSerializer : CloneBase {
    249252public:
    250     static bool serialize(ExecState* exec, JSValue value, Vector<uint8_t>& out)
     253    static SerializationReturnCode serialize(ExecState* exec, JSValue value, Vector<uint8_t>& out)
    251254    {
    252255        CloneSerializer serializer(exec, out);
    … …  
    275278    }
    276279
    277     bool serialize(JSValue in);
     280    SerializationReturnCode serialize(JSValue in);
    278281
    279282    bool isArray(JSValue value)
    … …  
    415418        if (isArray(value))
    416419            return false;
     420           
     421        // Object cannot be serialized because the act of walking the object creates new objects
     422        if (value.isObject() && asObject(value)->inherits(&JSNavigator::s_info)) {
     423            fail();
     424            write(NullTag);
     425            return true;
     426        }
    417427
    418428        if (value.isObject()) {
    … …  
    599609};
    600610
    601 bool CloneSerializer::serialize(JSValue in)
     611SerializationReturnCode CloneSerializer::serialize(JSValue in)
    602612{
    603613    Vector<uint32_t, 16> indexStack;
    … …  
    615625            case ArrayStartState: {
    616626                ASSERT(isArray(inValue));
    617                 if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
    618                     throwStackOverflow();
    619                     return false;
    620                 }
     627                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion)
     628                    return StackOverflowError;
    621629
    622630                JSArray* inArray = asArray(inValue);
    … …  
    632640            case ArrayStartVisitMember: {
    633641                if (!--tickCount) {
    634                     if (didTimeOut()) {
    635                         throwInterruptedException();
    636                         return false;
    637                     }
     642                    if (didTimeOut())
     643                        return InterruptedExecutionError;
    638644                    tickCount = ticksUntilNextCheck();
    639645                }
    … …  
    674680            case ObjectStartState: {
    675681                ASSERT(inValue.isObject());
    676                 if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
    677                     throwStackOverflow();
    678                     return false;
    679                 }
     682                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion)
     683                    return StackOverflowError;
    680684                JSObject* inObject = asObject(inValue);
    681685                if (!startObject(inObject))
    … …  
    690694            case ObjectStartVisitMember: {
    691695                if (!--tickCount) {
    692                     if (didTimeOut()) {
    693                         throwInterruptedException();
    694                         return false;
    695                     }
     696                    if (didTimeOut())
     697                        return InterruptedExecutionError;
    696698                    tickCount = ticksUntilNextCheck();
    697699                }
    … …  
    709711                inValue = getProperty(object, properties[index]);
    710712                if (shouldTerminate())
    711                     return false;
     713                    return ExistingExceptionError;
    712714
    713715                if (!inValue) {
    … …  
    719721
    720722                if (shouldTerminate())
    721                     return false;
     723                    return ExistingExceptionError;
    722724
    723725                if (!dumpIfTerminal(inValue)) {
    … …  
    729731            case ObjectEndVisitMember: {
    730732                if (shouldTerminate())
    731                     return false;
     733                    return ExistingExceptionError;
    732734
    733735                indexStack.last()++;
    … …  
    750752
    751753        if (!--tickCount) {
    752             if (didTimeOut()) {
    753                 throwInterruptedException();
    754                 return false;
    755             }
     754            if (didTimeOut())
     755                return InterruptedExecutionError;
    756756            tickCount = ticksUntilNextCheck();
    757757        }
    758758    }
    759759    if (m_failed)
    760         return false;
    761 
    762     return true;
     760        return UnspecifiedError;
     761
     762    return SuccessfullyCompleted;
    763763}
    764764
    … …  
    784784    }
    785785
    786     static JSValue deserialize(ExecState* exec, JSGlobalObject* globalObject, const Vector<uint8_t>& buffer)
     786    static DeserializationResult deserialize(ExecState* exec, JSGlobalObject* globalObject, const Vector<uint8_t>& buffer)
    787787    {
    788788        if (!buffer.size())
    789             return jsNull();
     789            return make_pair(jsNull(), UnspecifiedError);
    790790        CloneDeserializer deserializer(exec, globalObject, buffer);
    791         if (!deserializer.isValid()) {
    792             deserializer.throwValidationError();
    793             return JSValue();
    794         }
     791        if (!deserializer.isValid())
     792            return make_pair(JSValue(), ValidationError);
    795793        return deserializer.deserialize();
    796794    }
    … …  
    847845    }
    848846
    849     JSValue deserialize();
     847    DeserializationResult deserialize();
    850848
    851849    void throwValidationError()
    … …  
    11941192};
    11951193
    1196 JSValue CloneDeserializer::deserialize()
     1194DeserializationResult CloneDeserializer::deserialize()
    11971195{
    11981196    Vector<uint32_t, 16> indexStack;
    … …  
    12231221        case ArrayStartVisitMember: {
    12241222            if (!--tickCount) {
    1225                 if (didTimeOut()) {
    1226                     throwInterruptedException();
    1227                     return JSValue();
    1228                 }
     1223                if (didTimeOut())
     1224                    return make_pair(JSValue(), InterruptedExecutionError);
    12291225                tickCount = ticksUntilNextCheck();
    12301226            }
    … …  
    12601256        objectStartState:
    12611257        case ObjectStartState: {
    1262             if (outputObjectStack.size() + outputArrayStack.size() > maximumFilterRecursion) {
    1263                 throwStackOverflow();
    1264                 return JSValue();
    1265             }
     1258            if (outputObjectStack.size() + outputArrayStack.size() > maximumFilterRecursion)
     1259                return make_pair(JSValue(), StackOverflowError);
    12661260            JSObject* outObject = constructEmptyObject(m_exec, m_globalObject);
    12671261            m_gcBuffer.append(outObject);
    … …  
    12721266        case ObjectStartVisitMember: {
    12731267            if (!--tickCount) {
    1274                 if (didTimeOut()) {
    1275                     throwInterruptedException();
    1276                     return JSValue();
    1277                 }
     1268                if (didTimeOut())
     1269                    return make_pair(JSValue(), InterruptedExecutionError);
    12781270                tickCount = ticksUntilNextCheck();
    12791271            }
    … …  
    13231315
    13241316        if (!--tickCount) {
    1325             if (didTimeOut()) {
    1326                 throwInterruptedException();
    1327                 return JSValue();
    1328             }
     1317            if (didTimeOut())
     1318                return make_pair(JSValue(), InterruptedExecutionError);
    13291319            tickCount = ticksUntilNextCheck();
    13301320        }
    … …  
    13321322    ASSERT(outValue);
    13331323    ASSERT(!m_failed);
    1334     return outValue;
     1324    return make_pair(outValue, SuccessfullyCompleted);
    13351325error:
    13361326    fail();
    1337     throwValidationError();
    1338     return JSValue();
     1327    return make_pair(JSValue(), ValidationError);
    13391328}
    13401329
    … …  
    13501339}
    13511340
    1352 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(ExecState* exec, JSValue value)
     1341PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(ExecState* exec, JSValue value, SerializationErrorMode throwExceptions)
    13531342{
    13541343    Vector<uint8_t> buffer;
    1355     if (!CloneSerializer::serialize(exec, value, buffer))
     1344    SerializationReturnCode code = CloneSerializer::serialize(exec, value, buffer);
     1345    if (throwExceptions)
     1346        maybeThrowExceptionIfSerializationFailed(exec, code);
     1347
     1348    if (!serializationDidCompleteSuccessfully(code))
    13561349        return 0;
     1350       
    13571351    return adoptRef(new SerializedScriptValue(buffer));
    13581352}
    … …  
    13931387}
    13941388
    1395 JSValue SerializedScriptValue::deserialize(ExecState* exec, JSGlobalObject* globalObject)
    1396 {
    1397     return CloneDeserializer::deserialize(exec, globalObject, m_data);
     1389JSValue SerializedScriptValue::deserialize(ExecState* exec, JSGlobalObject* globalObject, SerializationErrorMode throwExceptions)
     1390{
     1391    DeserializationResult result = CloneDeserializer::deserialize(exec, globalObject, m_data);
     1392    if (throwExceptions)
     1393        maybeThrowExceptionIfSerializationFailed(exec, result.second);
     1394    return result.first;
    13981395}
    13991396
    … …  
    14191416}
    14201417
    1421 }
     1418void SerializedScriptValue::maybeThrowExceptionIfSerializationFailed(ExecState* exec, SerializationReturnCode code)
     1419{
     1420    if (code == SuccessfullyCompleted)
     1421        return;
     1422   
     1423    switch (code) {
     1424    case StackOverflowError:
     1425        throwError(exec, createStackOverflowError(exec));
     1426        break;
     1427    case InterruptedExecutionError:
     1428        throwError(exec, createInterruptedExecutionException(&exec->globalData()));
     1429        break;
     1430    case ValidationError:
     1431        throwError(exec, createTypeError(exec, "Unable to deserialize data."));
     1432        break;
     1433    case ExistingExceptionError:
     1434        throwError(exec, createTypeError(exec, "Javascript has thrown an exception.  Halting serialization."));
     1435        break;
     1436    case UnspecifiedError:
     1437        throwError(exec, createTypeError(exec, "Unknown error while serializing or deserializing data."));
     1438        break;
     1439    default:
     1440        ASSERT_NOT_REACHED();
     1441    }
     1442}
     1443
     1444bool SerializedScriptValue::serializationDidCompleteSuccessfully(SerializationReturnCode code)
     1445{
     1446    return (code == SuccessfullyCompleted);
     1447}
     1448
     1449}

  • trunk/Source/WebCore/bindings/js/SerializedScriptValue.h

    r66995 r83645  
    2828#define SerializedScriptValue_h
    2929
    30 #include "ScriptValue.h"
     30#include <heap/Strong.h>
     31#include <runtime/JSValue.h>
    3132#include <wtf/Forward.h>
     33#include <wtf/PassRefPtr.h>
    3234
    3335typedef const struct OpaqueJSContext* JSContextRef;
    … …  
    3638namespace WebCore {
    3739
     40 
     41enum SerializationReturnCode {
     42    SuccessfullyCompleted,
     43    StackOverflowError,
     44    InterruptedExecutionError,
     45    ValidationError,
     46    ExistingExceptionError,
     47    UnspecifiedError
     48};
     49   
     50enum SerializationErrorMode { Throwing, NonThrowing };
     51
    3852class SharedBuffer;
    3953
    4054class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
    4155public:
    42     static PassRefPtr<SerializedScriptValue> create(JSC::ExecState* exec, JSC::JSValue value);
     56    static PassRefPtr<SerializedScriptValue> create(JSC::ExecState*, JSC::JSValue, SerializationErrorMode = Throwing);
    4357    static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef value, JSValueRef* exception);
    4458    static PassRefPtr<SerializedScriptValue> create(String string);
    … …  
    5165    static SerializedScriptValue* nullValue();
    5266
    53     JSC::JSValue deserialize(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject);
    5467    String toString();
     68   
     69    JSC::JSValue deserialize(JSC::ExecState*, JSC::JSGlobalObject*, SerializationErrorMode = Throwing);
    5570    JSValueRef deserialize(JSContextRef, JSValueRef* exception);
     71
    5672    const Vector<uint8_t>& data() { return m_data; }
    5773
    … …  
    5975
    6076private:
     77    static void maybeThrowExceptionIfSerializationFailed(JSC::ExecState*, SerializationReturnCode);
     78    static bool serializationDidCompleteSuccessfully(SerializationReturnCode);
     79   
    6180    SerializedScriptValue(Vector<unsigned char>&);
    6281    Vector<unsigned char> m_data;

  • trunk/Source/WebCore/loader/FrameLoader.h

    r82580 r83645  
    3939#include "PolicyChecker.h"
    4040#include "ResourceLoadNotifier.h"
     41#include "ScriptValue.h"
    4142#include "SubframeLoader.h"
    4243#include "ThreadableLoader.h"

  • trunk/Source/WebCore/page/Frame.cpp

    r83344 r83645  
    7373#include "ScriptController.h"
    7474#include "ScriptSourceCode.h"
     75#include "ScriptValue.h"
    7576#include "Settings.h"
    7677#include "TextIterator.h"

  • trunk/Source/WebKit/gtk/ChangeLog

    r83530 r83645  
     12011-04-12  Stephanie Lewis  <slewis@apple.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        https://bugs.webkit.org/show_bug.cgi?id=58280
     6        <rdar://problem/9252824> javascript in an inconsistent state due to serialization returning an un-handled exception.
     7
     8        Add a header include.  Fallout from untangling some header files in WebCore.
     9
     10        * webkit/webkitwebhistoryitem.cpp:
     11
    1122011-02-03  Martin Robinson  <mrobinson@igalia.com>
    213

  • trunk/Source/WebKit/gtk/webkit/webkitwebhistoryitem.cpp

    r74933 r83645  
    2323
    2424#include "HistoryItem.h"
     25#inlcude "KURL.h"
    2526#include "PlatformString.h"
    2627#include "webkitglobalsprivate.h"

  • trunk/Source/WebKit2/ChangeLog

    r83633 r83645  
     12011-04-11  Stephanie Lewis  <slewis@apple.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        https://bugs.webkit.org/show_bug.cgi?id=58280
     6        <rdar://problem/9252824> javascript in an inconsistent state due to serialization returning an un-handled exception
     7        Change use of SerializedScriptValue::Create to use the same api as the rest of WebKit2.  This has the benefit
     8        of handling any exceptions so Javascript is not in an inconsistent state.
     9
     10        * Shared/API/c/WKSerializedScriptValue.h: fix a typo
     11        * WebProcess/WebPage/WebPage.cpp:
     12        (WebKit::WebPage::runJavaScriptInMainFrame):
     13
    1142011-04-12  Jeff Miller  <jeffm@apple.com>
    215

  • trunk/Source/WebKit2/Shared/API/c/WKSerializedScriptValue.h

    r68357 r83645  
    3737
    3838WK_EXPORT WKSerializedScriptValueRef WKSerializedScriptValueCreate(JSContextRef context, JSValueRef value, JSValueRef* exception);
    39 WK_EXPORT JSValueRef WKSerializedScriptValueDeserialize(WKSerializedScriptValueRef scriptValue, JSContextRef constext, JSValueRef* exception);
     39WK_EXPORT JSValueRef WKSerializedScriptValueDeserialize(WKSerializedScriptValueRef scriptValue, JSContextRef context, JSValueRef* exception);
    4040
    4141#ifdef __cplusplus

  • trunk/Source/WebKit2/WebProcess/WebPage/WebPage.cpp

    r83628 r83645  
    7070#include "WebProcessProxyMessageKinds.h"
    7171#include "WebProcessProxyMessages.h"
     72#include <JavaScriptCore/APICast.h>
    7273#include <WebCore/AbstractDatabase.h>
    7374#include <WebCore/ArchiveResource.h>
    … …  
    12361237    JSLock lock(SilenceAssertionsOnly);
    12371238    if (JSValue resultValue = m_mainFrame->coreFrame()->script()->executeScript(script, true).jsValue()) {
    1238         if ((serializedResultValue = SerializedScriptValue::create(m_mainFrame->coreFrame()->script()->globalObject(mainThreadNormalWorld())->globalExec(), resultValue)))
     1239        if ((serializedResultValue = SerializedScriptValue::create(m_mainFrame->jsContext(),
     1240            toRef(m_mainFrame->coreFrame()->script()->globalObject(mainThreadNormalWorld())->globalExec(), resultValue), 0)))
    12391241            dataReference = CoreIPC::DataReference(serializedResultValue->data().data(), serializedResultValue->data().size());
    12401242    }
Note: See TracChangeset for help on using the changeset viewer.