Changeset 125513 in webkit

Timestamp:

Aug 14, 2012 12:22:31 AM (12 years ago)

Author:

commit-queue@webkit.org

Message:

regression(r124510) webintents/web-intents-obj-constructor.html is crashing
​https://bugs.webkit.org/show_bug.cgi?id=93096

Patch by Christophe Dumez <Christophe Dumez> on 2012-08-14
Reviewed by Kentaro Hara.

Source/WebCore:

Add null-check for JSC::ExecState pointer in JSDictionary constructor
before using it. The exec may indeed be null, thus causing crashes.

No new test, already tested by webintents/web-intents-obj-constructor.html

• bindings/js/JSDictionary.cpp:

(WebCore::JSDictionary::tryGetProperty):
(WebCore::JSDictionary::getWithUndefinedOrNullCheck):

• bindings/js/JSDictionary.h:

(WebCore::JSDictionary::JSDictionary):

LayoutTests:

Unskip webintents/web-intents-obj-constructor.html now that the
crash is fixed in WebCore.

• platform/efl-wk2/TestExpectations:
• platform/efl/TestExpectations:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/platform/efl-wk2/TestExpectations (modified) (1 diff)
• LayoutTests/platform/efl/TestExpectations (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/js/JSDictionary.cpp (modified) (2 diffs)
• Source/WebCore/bindings/js/JSDictionary.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-08-14  Christophe Dumez  <christophe.dumez@intel.com>
+
+        regression(r124510) webintents/web-intents-obj-constructor.html is crashing
+        https://bugs.webkit.org/show_bug.cgi?id=93096
+
+        Reviewed by Kentaro Hara.
+
+        Unskip webintents/web-intents-obj-constructor.html now that the
+        crash is fixed in WebCore.
+
+        * platform/efl-wk2/TestExpectations:
+        * platform/efl/TestExpectations:
+
 2012-08-13  Zan Dobersek  <zandobersek@gmail.com>
 

trunk/LayoutTests/platform/efl-wk2/TestExpectations

@@ -282 +282 @@
 // WTR does not print information about Web Intents MessagePorts
 BUGWK89072 : webintents/web-intents-invoke-port.html = TEXT
-BUGWK89072 : webintents/web-intents-obj-constructor.html = CRASH
-
+BUGWK89072 : webintents/web-intents-obj-constructor.html = TEXT
+

trunk/LayoutTests/platform/efl/TestExpectations

@@ -147 +147 @@
 //////////////////////////////////////////////////////////////////////////////////////////
 
-BUGWK93096 : webintents/web-intents-obj-constructor.html = CRASH
 BUGWK93654 DEBUG : fast/events/keyevent-iframe-removed-crash.html = CRASH
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-08-14  Christophe Dumez  <christophe.dumez@intel.com>
+
+        regression(r124510) webintents/web-intents-obj-constructor.html is crashing
+        https://bugs.webkit.org/show_bug.cgi?id=93096
+
+        Reviewed by Kentaro Hara.
+
+        Add null-check for JSC::ExecState pointer in JSDictionary constructor
+        before using it. The exec may indeed be null, thus causing crashes.
+
+        No new test, already tested by webintents/web-intents-obj-constructor.html
+
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::tryGetProperty):
+        (WebCore::JSDictionary::getWithUndefinedOrNullCheck):
+        * bindings/js/JSDictionary.h:
+        (WebCore::JSDictionary::JSDictionary):
+
 2012-08-13  Keishi Hattori  <keishi@webkit.org>
 

trunk/Source/WebCore/bindings/js/JSDictionary.cpp

@@ -47 +47 @@
 JSDictionary::GetPropertyResult JSDictionary::tryGetProperty(const char* propertyName, JSValue& finalResult) const
 {
+    ASSERT(isValid());
     Identifier identifier(m_exec, propertyName);
     PropertySlot slot(m_initializerObject.get());
@@ -197 +198 @@
 bool JSDictionary::getWithUndefinedOrNullCheck(const String& propertyName, String& result) const
 {
+    ASSERT(isValid());
     JSValue value;
     if (tryGetProperty(propertyName.utf8().data(), value) != PropertyFound || value.isUndefinedOrNull())

trunk/Source/WebCore/bindings/js/JSDictionary.h

@@ -49 +49 @@
     JSDictionary(JSC::ExecState* exec, JSC::JSObject* initializerObject)
         : m_exec(exec)
-        , m_initializerObject(exec->globalData(), initializerObject)
     {
+        if (exec && initializerObject)
+            m_initializerObject = JSC::Strong<JSC::JSObject>(exec->globalData(), initializerObject);
     }