Changeset 126067 in webkit


Ignore:
Timestamp:
Aug 20, 2012 2:12:55 PM (12 years ago)
Author:
commit-queue@webkit.org
Message:

[JSC] SerializedScriptValue::create() should throw a DataCloneError if input is an unsupported object
​https://bugs.webkit.org/show_bug.cgi?id=94493

Patch by Christophe Dumez <Christophe Dumez> on 2012-08-20
Reviewed by Oliver Hunt.

Source/WebCore:

Update JSC implementation for SerializedScriptValue::create() so that
a DataCloneError is thrown when the input value is an unsupported
object. The previous implementation was not throwing any error.

This change is according to the structured clone specification at:
​http://www.w3.org/TR/html5/common-dom-interfaces.html#structured-clone

This also matches the corresponding V8 implementation.

Test: fast/events/message-port-multi.html.

  • bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneSerializer::dumpIfTerminal):
(WebCore::CloneSerializer::serialize):
(WebCore::SerializedScriptValue::maybeThrowExceptionIfSerializationFailed):

  • bindings/js/SerializedScriptValue.h:

LayoutTests:

Add checks for Function, Error and host objects arguments to
MessagePort.postMessage() in fast/events/message-port-multi.html.

According to the structured clone specification, we should throw
a DataCloneError for such input types.

  • fast/dom/Window/anonymous-slot-with-changes-expected.txt:
  • fast/dom/Window/anonymous-slot-with-changes.html: Update test to expect

an exception when passing a function to postMessage().

  • fast/events/message-port-multi-expected.txt: Update expected result

accordingly.

  • fast/events/resources/message-port-multi.js:

(testTransfers.try.f1):

  • platform/chromium/fast/events/message-port-multi-expected.txt: Removed.

Now identical to global expectation.

Location:
trunk
Files:
1 deleted
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r126063 r126067  
     12012-08-20  Christophe Dumez  <christophe.dumez@intel.com>
     2
     3        [JSC] SerializedScriptValue::create() should throw a DataCloneError if input is an unsupported object
     4        https://bugs.webkit.org/show_bug.cgi?id=94493
     5
     6        Reviewed by Oliver Hunt.
     7
     8        Add checks for Function, Error and host objects arguments to
     9        MessagePort.postMessage() in fast/events/message-port-multi.html.
     10
     11        According to the structured clone specification, we should throw
     12        a DataCloneError for such input types.
     13
     14        * fast/dom/Window/anonymous-slot-with-changes-expected.txt:
     15        * fast/dom/Window/anonymous-slot-with-changes.html: Update test to expect
     16        an exception when passing a function to postMessage().
     17        * fast/events/message-port-multi-expected.txt: Update expected result
     18        accordingly.
     19        * fast/events/resources/message-port-multi.js:
     20        (testTransfers.try.f1):
     21        * platform/chromium/fast/events/message-port-multi-expected.txt: Removed.
     22        Now identical to global expectation.
     23
    1242012-08-20  Ken Buchanan  <kenrb@chromium.org>
    225        Line boxes not being dirtied correctly during inline removal

  • trunk/LayoutTests/fast/dom/Window/anonymous-slot-with-changes-expected.txt

    r54129 r126067  
    11Tests that we clone object hierarchies
     2PASS: 'postMessage((function(){}))' threw Error: DATA_CLONE_ERR: DOM Exception 25
    23PASS: eventData is null of type object
    34PASS: eventData is null of type object
    … …  
    5051PASS: eventData is ,,1 of type object
    5152PASS: eventData is ,,1 of type object
    52 PASS: eventData is null of type object
    53 PASS: eventData is null of type object
    54 PASS: eventData is null of type object
    55 PASS: eventData is null of type object
    56 PASS: eventData is null of type object
    5753PASS: eventData is 2009-02-13T23:31:30.000Z of type object
    5854PASS: eventData is 2009-02-13T23:31:30.000Z of type object

  • trunk/LayoutTests/fast/dom/Window/anonymous-slot-with-changes.html

    r120792 r126067  
    124124tryPostMessage('[1,2,3]');
    125125tryPostMessage('[,,1]');
    126 tryPostMessage('(function(){})', false, 'null');
     126tryPostMessage('(function(){})', true);
    127127tryPostMessage('new Date(1234567890000)');
    128128tryPostMessage('"done"');

  • trunk/LayoutTests/fast/events/message-port-multi-expected.txt

    r119087 r126067  
    1515PASS event.ports contains two ports when two ports sent
    1616PASS event.ports contains two ports when two ports re-sent after error
    17 PASS Sending host object has thrown TypeError: Unable to deserialize data.
     17PASS Sending host object has thrown Error: DATA_CLONE_ERR: DOM Exception 25
     18PASS Sending host object has thrown Error: DATA_CLONE_ERR: DOM Exception 25
     19PASS Sending Function object has thrown Error: DATA_CLONE_ERR: DOM Exception 25
     20PASS Sending Error object has thrown Error: DATA_CLONE_ERR: DOM Exception 25
    1821PASS send-port: transferred one port
    1922PASS send-port-twice: transferred one port twice

  • trunk/LayoutTests/fast/events/resources/message-port-multi.js

    r120792 r126067  
    4848        testFailed("Sending host object should throw");
    4949    } catch(e) {
    50         testPassed("Sending host object has thrown " + e);
     50        if (e.code == DOMException.DATA_CLONE_ERR)
     51          testPassed("Sending host object has thrown " + e);
     52        else
     53          testFailed("Sending host object should throw a DataCloneError, got: " + e);
     54    }
     55    try {
     56        channel0.port1.webkitPostMessage({id:"host-object2", hostObject:navigator, port:c4.port1}, [c4.port1]);
     57        testFailed("Sending host object should throw");
     58    } catch(e) {
     59        if (e.code == DOMException.DATA_CLONE_ERR)
     60          testPassed("Sending host object has thrown " + e);
     61        else
     62          testFailed("Sending host object should throw a DataCloneError, got: " + e);
     63    }
     64    try {
     65        var f1 = function() {}
     66        channel0.port1.webkitPostMessage({id:"function-object", function:f1, port:c4.port1}, [c4.port1]);
     67        testFailed("Sending Function object should throw");
     68    } catch(e) {
     69        if (e.code == DOMException.DATA_CLONE_ERR)
     70          testPassed("Sending Function object has thrown " + e);
     71        else
     72          testFailed("Sending Function object should throw a DataCloneError, got: " + e);
     73    }
     74    try {
     75        var err = new Error();
     76        channel0.port1.webkitPostMessage({id:"error-object", error:err, port:c4.port1}, [c4.port1]);
     77        testFailed("Sending Error object should throw");
     78    } catch(e) {
     79        if (e.code == DOMException.DATA_CLONE_ERR)
     80          testPassed("Sending Error object has thrown " + e);
     81        else
     82          testPassed("Sending Error object should throw a DataCloneError, got: " + e);
    5183    }
    5284    c4.port1.postMessage("Should succeed");

  • trunk/Source/WebCore/ChangeLog

    r126066 r126067  
     12012-08-20  Christophe Dumez  <christophe.dumez@intel.com>
     2
     3        [JSC] SerializedScriptValue::create() should throw a DataCloneError if input is an unsupported object
     4        https://bugs.webkit.org/show_bug.cgi?id=94493
     5
     6        Reviewed by Oliver Hunt.
     7
     8        Update JSC implementation for SerializedScriptValue::create() so that
     9        a DataCloneError is thrown when the input value is an unsupported
     10        object. The previous implementation was not throwing any error.
     11
     12        This change is according to the structured clone specification at:
     13        http://www.w3.org/TR/html5/common-dom-interfaces.html#structured-clone
     14
     15        This also matches the corresponding V8 implementation.
     16
     17        Test: fast/events/message-port-multi.html.
     18
     19        * bindings/js/SerializedScriptValue.cpp:
     20        (WebCore::CloneSerializer::dumpIfTerminal):
     21        (WebCore::CloneSerializer::serialize):
     22        (WebCore::SerializedScriptValue::maybeThrowExceptionIfSerializationFailed):
     23        * bindings/js/SerializedScriptValue.h:
     24
    1252012-08-20  Sheriff Bot  <webkit.review.bot@gmail.com>
    226

  • trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp

    r119563 r126067  
    583583        if (isArray(value))
    584584            return false;
    585            
    586         // Object cannot be serialized because the act of walking the object creates new objects
    587         if (value.isObject() && asObject(value)->inherits(&JSNavigator::s_info)) {
    588             fail();
    589             write(NullTag);
    590             return true;
    591         }
    592585
    593586        if (value.isObject()) {
    … …  
    678671            }
    679672
    680             CallData unusedData;
    681             if (getCallData(value, unusedData) == CallTypeNone)
    682                 return false;
     673            return false;
    683674        }
    684675        // Any other types are expected to serialize as null.
    … …  
    899890                if (!startObject(inObject))
    900891                    break;
     892                // At this point, all supported objects other than Object
     893                // objects have been handled. If we reach this point and
     894                // the input is not an Object object then we should throw
     895                // a DataCloneError.
     896                if (inObject->classInfo() != &JSFinalObject::s_info)
     897                    return DataCloneError;
    901898                inputObjectStack.append(inObject);
    902899                indexStack.append(0);
    … …  
    19211918        throwError(exec, createTypeError(exec, "Unable to deserialize data."));
    19221919        break;
     1920    case DataCloneError:
     1921        setDOMException(exec, DATA_CLONE_ERR);
     1922        break;
    19231923    case ExistingExceptionError:
    19241924        break;

  • trunk/Source/WebCore/bindings/js/SerializedScriptValue.h

    r117377 r126067  
    5252    ValidationError,
    5353    ExistingExceptionError,
     54    DataCloneError,
    5455    UnspecifiedError
    5556};
Note: See TracChangeset for help on using the changeset viewer.