Changeset 127644 in webkit

Timestamp:

Sep 5, 2012 1:58:54 PM (12 years ago)

Author:

commit-queue@webkit.org

Message:

[BlackBerry] JavaScriptVariant can crash when operator= is called with itself
​https://bugs.webkit.org/show_bug.cgi?id=95859

Patch by Benjamin C Meyer <​bmeyer@rim.com> on 2012-09-05
Reviewed by George Staikos.

• Api/JavaScriptVariant.cpp:

(BlackBerry::WebKit::JavaScriptVariant::operator=):
When JavaScriptVariant contains a string and operator= is
called with itself the memory will be free'd in 'this' and
then a copy will be attempted from 'that' resulting in a crash.

Location:

trunk/Source/WebKit/blackberry

Files:

• Api/JavaScriptVariant.cpp (modified) (1 diff)
• ChangeLog (modified) (1 diff)

trunk/Source/WebKit/blackberry/Api/JavaScriptVariant.cpp

@@ -148 +148 @@
 JavaScriptVariant& JavaScriptVariant::operator=(const JavaScriptVariant& v)
 {
+    if (&v == this)
+        return *this;
+
     switch (v.type()) {
     case Boolean:

trunk/Source/WebKit/blackberry/ChangeLog

@@ +1 @@
+2012-09-05  Benjamin C Meyer  <bmeyer@rim.com>
+
+        [BlackBerry] JavaScriptVariant can crash when operator= is called with itself
+        https://bugs.webkit.org/show_bug.cgi?id=95859
+
+        Reviewed by George Staikos.
+
+        * Api/JavaScriptVariant.cpp:
+        (BlackBerry::WebKit::JavaScriptVariant::operator=):
+        When JavaScriptVariant contains a string and operator= is
+        called with itself the memory will be free'd in 'this' and
+        then a copy will be attempted from 'that' resulting in a crash.
+
 2012-09-05  Leo Yang  <leoyang@rim.com>