Changeset 109594 in webkit


Ignore:
Timestamp:
Mar 2, 2012 11:58:36 AM (12 years ago)
Author:
mjs@apple.com
Message:

Source/WebCore: REGRESSION(r97353): Crash when accessing location or history properties inside a navigated window
​https://bugs.webkit.org/show_bug.cgi?id=80133
<rdar://problem/10432233>

Reviewed by Antti Koivisto.

Test: fast/dom/Window/navigated-window-properties.html

  • bindings/js/JSDOMWindowCustom.cpp:

(WebCore): Remove custom getters for window.location and window.history; they
were unnecessary and did the wrong thing when DOMWindow returned null values
for these.

  • page/DOMWindow.idl: ditto
  • bindings/js/JSDOMBinding.cpp:

(WebCore::reportException): Remove assert about null values and update comment,
since this is now an expected state for navigated inner windows.

LayoutTests: REGRESSION(r97353): Crash when accessing location or history properties inside a navigated window
​https://bugs.webkit.org/show_bug.cgi?id=80133

Reviewed by Antti Koivisto.

  • fast/dom/Window/navigated-window-properties-expected.txt: Added.
  • fast/dom/Window/navigated-window-properties.html: Added.
  • fast/dom/Window/resources/navigated-window-prop-subframe1.html: Added.
  • fast/dom/Window/resources/navigated-window-prop-subframe2.html: Added.
Location:
trunk
Files:
4 added
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r109593 r109594  
     12012-03-02  Maciej Stachowiak  <mjs@apple.com>
     2
     3        REGRESSION(r97353): Crash when accessing location or history properties inside a navigated window
     4        https://bugs.webkit.org/show_bug.cgi?id=80133
     5
     6        Reviewed by Antti Koivisto.
     7
     8        * fast/dom/Window/navigated-window-properties-expected.txt: Added.
     9        * fast/dom/Window/navigated-window-properties.html: Added.
     10        * fast/dom/Window/resources/navigated-window-prop-subframe1.html: Added.
     11        * fast/dom/Window/resources/navigated-window-prop-subframe2.html: Added.
     12
    1132012-03-02  Ryosuke Niwa  <rniwa@webkit.org>
    214

  • trunk/Source/WebCore/ChangeLog

    r109593 r109594  
     12012-03-02  Maciej Stachowiak  <mjs@apple.com>
     2
     3        REGRESSION(r97353): Crash when accessing location or history properties inside a navigated window
     4        https://bugs.webkit.org/show_bug.cgi?id=80133
     5        <rdar://problem/10432233>
     6       
     7        Reviewed by Antti Koivisto.
     8
     9        Test: fast/dom/Window/navigated-window-properties.html
     10
     11        * bindings/js/JSDOMWindowCustom.cpp:
     12        (WebCore): Remove custom getters for window.location and window.history; they
     13        were unnecessary and did the wrong thing when DOMWindow returned null values
     14        for these.
     15        * page/DOMWindow.idl: ditto
     16        * bindings/js/JSDOMBinding.cpp:
     17        (WebCore::reportException): Remove assert about null values and update comment,
     18        since this is now an expected state for navigated inner windows.
     19
    1202012-03-02  Ryosuke Niwa  <rniwa@webkit.org>
    221

  • trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp

    r108010 r109594  
    162162
    163163    ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
    164     ASSERT(scriptExecutionContext);
    165 
    166     // Crash data indicates null-dereference crashes at this point in the Safari 4 Public Beta.
     164
     165    // scriptExecutionContext can be null when the relevant global object is a stale inner window object.
    167166    // It's harmless to return here without reporting the exception to the log and the debugger in this case.
    168167    if (!scriptExecutionContext)

  • trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp

    r109196 r109594  
    405405// Custom Attributes
    406406
    407 JSValue JSDOMWindow::history(ExecState* exec) const
    408 {
    409     History* history = impl()->history();
    410     if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), history))
    411         return wrapper;
    412 
    413     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
    414     JSHistory* jsHistory = JSHistory::create(getDOMStructure<JSHistory>(exec, window), window, history);
    415     cacheWrapper(currentWorld(exec), history, jsHistory);
    416     return jsHistory;
    417 }
    418 
    419 JSValue JSDOMWindow::location(ExecState* exec) const
    420 {
    421     Location* location = impl()->location();
    422     if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), location))
    423         return wrapper;
    424 
    425     JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
    426     JSLocation* jsLocation = JSLocation::create(getDOMStructure<JSLocation>(exec, window), window, location);
    427     cacheWrapper(currentWorld(exec), location, jsLocation);
    428     return jsLocation;
    429 }
    430 
    431407void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
    432408{

  • trunk/Source/WebCore/page/DOMWindow.idl

    r109306 r109594  
    4646        // DOM Level 0
    4747        attribute [Replaceable] Screen screen;
    48         attribute [Replaceable, DoNotCheckSecurityOnGetter, JSCustomGetter] History history;
     48        attribute [Replaceable, DoNotCheckSecurityOnGetter] History history;
    4949        attribute [Replaceable] BarInfo locationbar;
    5050        attribute [Replaceable] BarInfo menubar;
    … …  
    5757        readonly attribute Crypto crypto;
    5858#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
    59         attribute [DoNotCheckSecurity, JSCustom, V8CustomSetter, V8Unforgeable] Location location;
     59        attribute [DoNotCheckSecurity, CustomSetter, V8Unforgeable] Location location;
    6060#endif
    6161        attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;

  • trunk/Source/WebCore/platform/sql/SQLiteStatement.cpp

    r103387 r109594  
    9898    if (m_database.isInterrupted())
    9999        return SQLITE_INTERRUPT;
    100     ASSERT(m_isPrepared);
     100    //ASSERT(m_isPrepared);
    101101
    102102    if (!m_statement)
Note: See TracChangeset for help on using the changeset viewer.