Changeset 230965 in webkit

Timestamp:

Apr 24, 2018 12:19:47 PM (6 years ago)

Author:

mark.lam@apple.com

Message:

Need to acquire the VM lock before calling toNumber on a JSValue.
​https://bugs.webkit.org/show_bug.cgi?id=184924
<rdar://problem/39690679>

Reviewed by Saam Barati.

• bridge/objc/objc_utility.mm:

(JSC::Bindings::convertValueToObjcValue):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bridge/objc/objc_utility.mm (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2018-04-24  Mark Lam  <mark.lam@apple.com>
+
+        Need to acquire the VM lock before calling toNumber on a JSValue.
+        https://bugs.webkit.org/show_bug.cgi?id=184924
+        <rdar://problem/39690679>
+
+        Reviewed by Saam Barati.
+
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+
 2018-04-24  Tadeu Zagallo  <tzagallo@apple.com>
 

trunk/Source/WebCore/bridge/objc/objc_utility.mm

@@ -1 +1 @@
 /*
- * Copyright (C) 2004, 2013, 2016 Apple Inc.  All rights reserved.
+ * Copyright (C) 2004-2018 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -82 +82 @@
     double d = 0;
 
-    if (value.isNumber() || value.isString() || value.isBoolean())
+    if (value.isNumber() || value.isString() || value.isBoolean()) {
+        JSLockHolder lock(exec);
         d = value.toNumber(exec);
+    }
 
     switch (type) {