Changeset 136064 in webkit

Timestamp:

Nov 28, 2012 2:57:17 PM (11 years ago)

Author:

kareng@chromium.org

Message:

Merge 135804 - Check for empty perContextData while creating NP V8 Object.
​https://bugs.webkit.org/show_bug.cgi?id=98448

Patch by Istiaque Ahmed <​lazyboy@chromium.org> on 2012-11-26
Reviewed by Adam Barth.

Fixes crash in npCreateV8ScriptObject(), if NP Invoke is called from a document
that is no longer displayed in frame (isCurrentlyDisplayedInFrame() ==
false), we have empty perContextData and this results in invalid memory access.

Source/WebCore:

Test: platform/chromium/plugins/empty-per-context-data.html

• bindings/v8/NPV8Object.cpp:

(WebCore::npCreateV8ScriptObject):

LayoutTests:

• platform/chromium/plugins/empty-per-context-data-expected.txt: Added.
• platform/chromium/plugins/empty-per-context-data.html: Added.
• platform/chromium/plugins/resources/script-container.html: Added.

TBR=​commit-queue@webkit.org
Review URL: ​https://codereview.chromium.org/11411245

Location:

branches/chromium/1312

Files:

• LayoutTests/platform/chromium/plugins/empty-per-context-data-expected.txt (copied) (copied from trunk/LayoutTests/platform/chromium/plugins/empty-per-context-data-expected.txt)
• LayoutTests/platform/chromium/plugins/empty-per-context-data.html (copied) (copied from trunk/LayoutTests/platform/chromium/plugins/empty-per-context-data.html)
• LayoutTests/platform/chromium/plugins/resources/script-container.html (copied) (copied from trunk/LayoutTests/platform/chromium/plugins/resources/script-container.html)
• Source/WebCore/bindings/v8/NPV8Object.cpp (modified) (1 diff)

branches/chromium/1312/Source/WebCore/bindings/v8/NPV8Object.cpp

@@ -144 +144 @@
     }
 
-    int v8ObjectHash = object->GetIdentityHash();
-    ASSERT(v8ObjectHash);
-    V8NPObjectMap* v8NPObjectMap = V8PerContextData::from(object->CreationContext())->v8NPObjectMap();
-    V8NPObjectMap::iterator iter = v8NPObjectMap->find(v8ObjectHash);
-    if (iter != v8NPObjectMap->end()) {
-        V8NPObjectVector& objects = iter->value;
-        for (size_t index = 0; index < objects.size(); ++index) {
-            V8NPObject* v8npObject = objects.at(index);
-            if (v8npObject->rootObject == root) {
-                ASSERT(v8npObject->v8Object == object);
-                _NPN_RetainObject(&v8npObject->object);
-                return reinterpret_cast<NPObject*>(v8npObject);
+    V8NPObjectVector* objectVector = 0;
+    if (V8PerContextData* perContextData = V8PerContextData::from(object->CreationContext())) {
+        int v8ObjectHash = object->GetIdentityHash();
+        ASSERT(v8ObjectHash);
+        V8NPObjectMap* v8NPObjectMap = perContextData->v8NPObjectMap();
+        V8NPObjectMap::iterator iter = v8NPObjectMap->find(v8ObjectHash);
+        if (iter != v8NPObjectMap->end()) {
+            V8NPObjectVector& objects = iter->value;
+            for (size_t index = 0; index < objects.size(); ++index) {
+                V8NPObject* v8npObject = objects.at(index);
+                if (v8npObject->rootObject == root) {
+                    ASSERT(v8npObject->v8Object == object);
+                    _NPN_RetainObject(&v8npObject->object);
+                    return reinterpret_cast<NPObject*>(v8npObject);
+                }
             }
+        } else {
+            iter = v8NPObjectMap->set(v8ObjectHash, V8NPObjectVector()).iterator;
+            objectVector = &iter->value;
         }
-    } else {
-        iter = v8NPObjectMap->set(v8ObjectHash, V8NPObjectVector()).iterator;
-    }
-
+    }
     V8NPObject* v8npObject = reinterpret_cast<V8NPObject*>(_NPN_CreateObject(npp, &V8NPObjectClass));
     v8npObject->v8Object = v8::Persistent<v8::Object>::New(object);
     v8npObject->rootObject = root;
 
-    iter->value.append(v8npObject);
+    if (objectVector)
+        objectVector->append(v8npObject);
 
     return reinterpret_cast<NPObject*>(v8npObject);