Changeset 140887 in webkit

Timestamp:

Jan 25, 2013 5:28:40 PM (11 years ago)

Author:

haraken@chromium.org

Message:

[V8] Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() (part 1)
​https://bugs.webkit.org/show_bug.cgi?id=107891

Reviewed by Abhishek Arya.

If you use a raw SerializedScriptValue* for serialize()/deserialize(),
it can potentially cause a use-after-free. This is because serialize()/
deserialize() can destruct a RefPtr of the SerializedScriptValue*,
depending on data that is serialized/deserialized. So we should keep a
RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
(See ​https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

No tests. This is just a just-in-case fix. I couldn't find any bug
even in an ASAN build.

• bindings/v8/custom/V8CustomEventCustom.cpp:

(WebCore::V8CustomEvent::detailAccessorGetter):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/v8/custom/V8CustomEventCustom.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-01-25  Kentaro Hara  <haraken@chromium.org>
+
+        [V8] Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() (part 1)
+        https://bugs.webkit.org/show_bug.cgi?id=107891
+
+        Reviewed by Abhishek Arya.
+
+        If you use a raw SerializedScriptValue* for serialize()/deserialize(),
+        it can potentially cause a use-after-free. This is because serialize()/
+        deserialize() can destruct a RefPtr of the SerializedScriptValue*,
+        depending on data that is serialized/deserialized. So we should keep a
+        RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
+        (See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)
+
+        No tests. This is just a just-in-case fix. I couldn't find any bug
+        even in an ASAN build.
+
+        * bindings/v8/custom/V8CustomEventCustom.cpp:
+        (WebCore::V8CustomEvent::detailAccessorGetter):
+
 2013-01-25  Kentaro Hara  <haraken@chromium.org>
 

trunk/Source/WebCore/bindings/v8/custom/V8CustomEventCustom.cpp

@@ -50 +50 @@
 {
     CustomEvent* imp = V8CustomEvent::toNative(info.Holder());
-    SerializedScriptValue* serialized = imp->serializedScriptValue().get();
+    RefPtr<SerializedScriptValue> serialized = imp->serializedScriptValue();
     if (serialized) {
         v8::Handle<v8::Value> value = info.Holder()->GetHiddenValue(V8HiddenPropertyName::detail());