Changeset 164089 in webkit

Timestamp:

Feb 13, 2014 6:42:10 PM (10 years ago)

Author:

mark.lam@apple.com

Message:

The JSContainerConvertor and ObjcContainerConvertor need to protect JSValueRefs. Part 2.
<​https://webkit.org/b/128764>

Reviewed by Mark Hahnenberg.

toJS() is the wrong cast function to use. We need to use toJSForGC() instead.
Also we need to acquire the JSLock to prevent concurrent accesses to the
Strong handle list.

• API/JSValue.mm:

(JSContainerConvertor::add):
(containerValueToObject):
(ObjcContainerConvertor::add):
(objectToValue):

Location:

trunk/Source/JavaScriptCore

Files:

• API/JSValue.mm (modified) (4 diffs)
• ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/API/JSValue.mm

@@ -616 +616 @@
 {
     JSC::ExecState* exec = toJS(m_context);
-    m_jsValues.append(JSC::Strong<JSC::Unknown>(exec->vm(), toJS(exec, task.js)));
+    m_jsValues.append(JSC::Strong<JSC::Unknown>(exec->vm(), toJSForGC(exec, task.js)));
     m_objectMap.add(task.js, task.objc);
     if (task.type != ContainerNone)
@@ -673 +673 @@
 {
     ASSERT(task.type != ContainerNone);
+    JSC::APIEntryShim entryShim(toJS(context));
     JSContainerConvertor convertor(context);
     convertor.add(task);
@@ -842 +843 @@
 {
     JSC::ExecState* exec = toJS(m_context.JSGlobalContextRef);
-    m_jsValues.append(JSC::Strong<JSC::Unknown>(exec->vm(), toJS(exec, task.js)));
+    m_jsValues.append(JSC::Strong<JSC::Unknown>(exec->vm(), toJSForGC(exec, task.js)));
     m_objectMap.add(task.objc, task.js);
     if (task.type != ContainerNone)
@@ -922 +923 @@
         return task.js;
 
+    JSC::APIEntryShim entryShim(toJS(contextRef));
     ObjcContainerConvertor convertor(context);
     convertor.add(task);

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-02-13  Mark Lam  <mark.lam@apple.com>
+
+        The JSContainerConvertor and ObjcContainerConvertor need to protect JSValueRefs. Part 2.
+        <https://webkit.org/b/128764>
+
+        Reviewed by Mark Hahnenberg.
+
+        toJS() is the wrong cast function to use. We need to use toJSForGC() instead.
+        Also we need to acquire the JSLock to prevent concurrent accesses to the
+        Strong handle list.
+
+        * API/JSValue.mm:
+        (JSContainerConvertor::add):
+        (containerValueToObject):
+        (ObjcContainerConvertor::add):
+        (objectToValue):
+
 2014-02-13  Mark Hahnenberg  <mhahnenberg@apple.com>