Changeset 129077 in webkit

Timestamp:

Sep 19, 2012 5:41:26 PM (12 years ago)

Author:

haraken@chromium.org

Message:

[V8] ScriptController::compileAndRunScript() can crash
​https://bugs.webkit.org/show_bug.cgi?id=96567

Reviewed by Adam Barth.

See chromium bug: ​http://code.google.com/p/chromium/issues/detail?id=146776

The root cause is that v8::PreCompile() can return 0 when the stack of
V8's parser overflows (c.f. ​http://code.google.com/codesearch#OAMlx_jo-ck/src/v8/src/parser.cc&exact_package=chromium&q=kPreParseStackOverflow&type=cs&l=6021).

This patch adds the 0 check to the caller side. Given that precompileScript()
is just trying to speculatively precompile a script, it's OK to give up
precompiling for such edge cases.

Manually tested with the html generated by the following shell script:

echo '<script language="JavaScript" type="text/javascript" src="asan-crash.js"></script>' > asan-crash.html
echo 'if(wURLF.search("")>=0) {}' > asan-crash.js
for i in seq 14830
do

echo 'else if(wURLF.search("")>=0) {}' >> asan-crash.js

done

I didn't add the test because '14380' depends on an environment
and because we don't want to add a huge html test.

• bindings/v8/ScriptSourceCode.cpp:

(WebCore::ScriptSourceCode::precompileScript):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/v8/ScriptSourceCode.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-09-19  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] ScriptController::compileAndRunScript() can crash
+        https://bugs.webkit.org/show_bug.cgi?id=96567
+
+        Reviewed by Adam Barth.
+
+        See chromium bug: http://code.google.com/p/chromium/issues/detail?id=146776
+
+        The root cause is that v8::PreCompile() can return 0 when the stack of
+        V8's parser overflows (c.f. http://code.google.com/codesearch#OAMlx_jo-ck/src/v8/src/parser.cc&exact_package=chromium&q=kPreParseStackOverflow&type=cs&l=6021).
+
+        This patch adds the 0 check to the caller side. Given that precompileScript()
+        is just trying to speculatively precompile a script, it's OK to give up
+        precompiling for such edge cases.
+
+        Manually tested with the html generated by the following shell script:
+
+          echo '<script language="JavaScript" type="text/javascript" src="asan-crash.js"></script>' > asan-crash.html
+          echo 'if(wURLF.search("")>=0) {}' > asan-crash.js
+          for i in `seq 14830`
+          do
+            echo 'else if(wURLF.search("")>=0) {}' >> asan-crash.js
+          done
+
+        I didn't add the test because '14380' depends on an environment
+        and because we don't want to add a huge html test.
+
+        * bindings/v8/ScriptSourceCode.cpp:
+        (WebCore::ScriptSourceCode::precompileScript):
+
 2012-09-19  Joshua Bell  <jsbell@chromium.org>
 

trunk/Source/WebCore/bindings/v8/ScriptSourceCode.cpp

@@ -50 +50 @@
 
     OwnPtr<v8::ScriptData> scriptData = adoptPtr(v8::ScriptData::PreCompile(code));
+    if (!scriptData)
+        return nullptr;
+
     cachedScript->setCachedMetadata(dataTypeID, scriptData->Data(), scriptData->Length());