Changeset 148303 in webkit

Timestamp:

Apr 12, 2013 2:39:09 PM (11 years ago)

Author:

oliver@apple.com

Message:

make the codegenerator actually emit polymorphism check in the "no vtable" path
​https://bugs.webkit.org/show_bug.cgi?id=114533

Reviewed by David Kilzer.

Make the "no vtable" check correct so that we actually plant a polymorphism
check. Update a few interfaces to have the correct validation attributes.

• Modules/webdatabase/SQLTransaction.idl:
• bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

• bindings/scripts/test/JS/JSTestInterface.cpp:

(WebCore::toJS):

• bindings/scripts/test/TestInterface.idl:
• html/track/TextTrackCue.idl:
• svg/SVGAnimatedAngle.idl:
• svg/SVGAnimatedBoolean.idl:
• svg/SVGAnimatedEnumeration.idl:
• svg/SVGAnimatedInteger.idl:
• svg/SVGAnimatedLength.idl:
• svg/SVGAnimatedLengthList.idl:
• svg/SVGAnimatedNumber.idl:
• svg/SVGAnimatedNumberList.idl:
• svg/SVGAnimatedPreserveAspectRatio.idl:
• svg/SVGAnimatedRect.idl:
• svg/SVGAnimatedString.idl:
• svg/SVGAnimatedTransformList.idl:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• Modules/webdatabase/SQLTransaction.idl (modified) (1 diff)
• bindings/scripts/CodeGeneratorJS.pm (modified) (1 diff)
• bindings/scripts/test/JS/JSTestInterface.cpp (modified) (2 diffs)
• bindings/scripts/test/TestInterface.idl (modified) (1 diff)
• html/track/TextTrackCue.idl (modified) (1 diff)
• svg/SVGAnimatedAngle.idl (modified) (1 diff)
• svg/SVGAnimatedBoolean.idl (modified) (1 diff)
• svg/SVGAnimatedEnumeration.idl (modified) (1 diff)
• svg/SVGAnimatedInteger.idl (modified) (1 diff)
• svg/SVGAnimatedLength.idl (modified) (1 diff)
• svg/SVGAnimatedLengthList.idl (modified) (1 diff)
• svg/SVGAnimatedNumber.idl (modified) (1 diff)
• svg/SVGAnimatedNumberList.idl (modified) (1 diff)
• svg/SVGAnimatedPreserveAspectRatio.idl (modified) (1 diff)
• svg/SVGAnimatedRect.idl (modified) (1 diff)
• svg/SVGAnimatedString.idl (modified) (1 diff)
• svg/SVGAnimatedTransformList.idl (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-04-12  Oliver Hunt  <oliver@apple.com>
+
+        make the codegenerator actually emit polymorphism check in the "no vtable" path
+        https://bugs.webkit.org/show_bug.cgi?id=114533
+
+        Reviewed by David Kilzer.
+
+        Make the "no vtable" check correct so that we actually plant a polymorphism
+        check.  Update a few interfaces to have the correct validation attributes.        
+
+        * Modules/webdatabase/SQLTransaction.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/test/TestInterface.idl:
+        * html/track/TextTrackCue.idl:
+        * svg/SVGAnimatedAngle.idl:
+        * svg/SVGAnimatedBoolean.idl:
+        * svg/SVGAnimatedEnumeration.idl:
+        * svg/SVGAnimatedInteger.idl:
+        * svg/SVGAnimatedLength.idl:
+        * svg/SVGAnimatedLengthList.idl:
+        * svg/SVGAnimatedNumber.idl:
+        * svg/SVGAnimatedNumberList.idl:
+        * svg/SVGAnimatedPreserveAspectRatio.idl:
+        * svg/SVGAnimatedRect.idl:
+        * svg/SVGAnimatedString.idl:
+        * svg/SVGAnimatedTransformList.idl:
+
 2013-04-12  Oliver Hunt  <oliver@apple.com>
 

trunk/Source/WebCore/Modules/webdatabase/SQLTransaction.idl

@@ -31 +31 @@
     OmitConstructor,
     JSNoStaticTables,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SQLTransaction {
     [Custom] void executeSql(in DOMString sqlStatement,

trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

@@ -2748 +2748 @@
 #endif
 END
-        push(@implContent, <<END) if $interface->extendedAttributes->{"ImplementationLacksVTable"} && $vtableNameGnu;
+        push(@implContent, <<END) if $interface->extendedAttributes->{"ImplementationLacksVTable"};
 #if COMPILER(CLANG)
     // If you hit this failure the interface definition has the ImplementationLacksVTable

trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp

@@ -500 +500 @@
 }
 
-#if ENABLE(BINDING_INTEGRITY)
-#if PLATFORM(WIN)
-#pragma warning(disable: 4483)
-extern "C" { extern void (*const __identifier("??_7TestInterface@WebCore@@6B@")[])(); }
-#else
-extern "C" { extern void* _ZTVN7WebCore13TestInterfaceE[]; }
-#endif
-#endif
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, TestInterface* impl)
 {
@@ -513 +505 @@
         return jsNull();
     if (JSValue result = getExistingWrapper<JSTestInterface>(exec, impl)) return result;
-
-#if ENABLE(BINDING_INTEGRITY)
-    void* actualVTablePointer = *(reinterpret_cast<void**>(impl));
-#if PLATFORM(WIN)
-    void* expectedVTablePointer = reinterpret_cast<void*>(__identifier("??_7TestInterface@WebCore@@6B@"));
-#else
-    void* expectedVTablePointer = &_ZTVN7WebCore13TestInterfaceE[2];
 #if COMPILER(CLANG)
-    // If this fails TestInterface does not have a vtable, so you need to add the
-    // ImplementationLacksVTable attribute to the interface definition
-    COMPILE_ASSERT(__is_polymorphic(TestInterface), TestInterface_is_not_polymorphic);
-#endif
-#endif
-    // If you hit this assertion you either have a use after free bug, or
-    // TestInterface has subclasses. If TestInterface has subclasses that get passed
-    // to toJS() we currently require TestInterface you to opt out of binding hardening
-    // by adding the SkipVTableValidation attribute to the interface IDL definition
-    RELEASE_ASSERT(actualVTablePointer == expectedVTablePointer);
+    // If you hit this failure the interface definition has the ImplementationLacksVTable
+    // attribute. You should remove that attribute. If the class has subclasses
+    // that may be passed through this toJS() function you should use the SkipVTableValidation
+    // attribute to TestInterface.
+    COMPILE_ASSERT(!__is_polymorphic(TestInterface), TestInterface_is_polymorphic_but_idl_claims_not_to_be);
 #endif
     return createNewWrapper<JSTestInterface>(exec, globalObject, impl);

trunk/Source/WebCore/bindings/scripts/test/TestInterface.idl

@@ -36 +36 @@
     Constructor(in DOMString str1, in [Optional=DefaultIsUndefined] DOMString str2),
     ConstructorRaisesException,
-    ConstructorConditional=TEST_INTERFACE
+    ConstructorConditional=TEST_INTERFACE,
+    ImplementationLacksVTable
 ] interface TestInterface {
 };

trunk/Source/WebCore/html/track/TextTrackCue.idl

@@ -33 +33 @@
     JSCustomMarkFunction,
     JSCustomIsReachable,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface TextTrackCue {
     readonly attribute TextTrack track;

trunk/Source/WebCore/svg/SVGAnimatedAngle.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedAngle {
     readonly attribute SVGAngle baseVal;

trunk/Source/WebCore/svg/SVGAnimatedBoolean.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedBoolean {
     [StrictTypeChecking] attribute boolean baseVal

trunk/Source/WebCore/svg/SVGAnimatedEnumeration.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedEnumeration {
     [StrictTypeChecking] attribute unsigned short baseVal

trunk/Source/WebCore/svg/SVGAnimatedInteger.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedInteger {
     [StrictTypeChecking] attribute long baseVal

trunk/Source/WebCore/svg/SVGAnimatedLength.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedLength {
     readonly attribute SVGLength baseVal;

trunk/Source/WebCore/svg/SVGAnimatedLengthList.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedLengthList {
     readonly attribute SVGLengthList baseVal;

trunk/Source/WebCore/svg/SVGAnimatedNumber.idl

@@ -27 +27 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedNumber {
     [StrictTypeChecking] attribute float baseVal

trunk/Source/WebCore/svg/SVGAnimatedNumberList.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedNumberList {
     readonly attribute SVGNumberList baseVal;

trunk/Source/WebCore/svg/SVGAnimatedPreserveAspectRatio.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedPreserveAspectRatio {
     readonly attribute SVGPreserveAspectRatio baseVal;

trunk/Source/WebCore/svg/SVGAnimatedRect.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedRect {
     readonly attribute SVGRect baseVal;

trunk/Source/WebCore/svg/SVGAnimatedString.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedString {
     attribute DOMString baseVal

trunk/Source/WebCore/svg/SVGAnimatedTransformList.idl

@@ -26 +26 @@
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedTransformList {
     readonly attribute SVGTransformList baseVal;