Changeset 149521 in webkit

Timestamp:

May 3, 2013 2:34:36 AM (11 years ago)

Author:

allan.jensen@digia.com

Message:

Crash when calling QWebFrame::evaluateJavaScript
​https://bugs.webkit.org/show_bug.cgi?id=113434

Reviewed by Simon Hausmann.

We must take the JS API lock before accessing internal JS methods.

• bridge/qt/qt_runtime.cpp:

(JSC::Bindings::unwrapBoxedPrimitive):
(JSC::Bindings::getGregorianDateTimeUTC):
(JSC::Bindings::convertQVariantToValue):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bridge/qt/qt_runtime.cpp (modified) (7 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2013-05-03  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Crash when calling QWebFrame::evaluateJavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=113434
+
+        Reviewed by Simon Hausmann.
+
+        We must take the JS API lock before accessing internal JS methods.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::unwrapBoxedPrimitive):
+        (JSC::Bindings::getGregorianDateTimeUTC):
+        (JSC::Bindings::convertQVariantToValue):
+
 2013-05-02  Xan Lopez  <xlopez@igalia.com>
 

trunk/Source/WebCore/bridge/qt/qt_runtime.cpp

@@ -22 +22 @@
 
 #include "APICast.h"
+#include "APIShims.h"
 #include "BooleanObject.h"
 #include "DateInstance.h"
@@ -200 +201 @@
 static JSValueRef unwrapBoxedPrimitive(JSContextRef context, JSValueRef value, JSObjectRef obj)
 {
+    ExecState* exec = toJS(context);
+    APIEntryShim entryShim(exec);
     JSObject* object = toJS(obj);
-    ExecState* exec = toJS(context);
     if (object->inherits(&NumberObject::s_info))
         return toRef(exec, jsNumber(object->toNumber(exec)));
@@ -282 +284 @@
 {
     ExecState* exec = toJS(context);
+    APIEntryShim entryShim(exec);
     if (type == Date) {
         JSObject* jsObject = toJS(object);
@@ -730 +733 @@
         memcpy(wtfByteArray->data(), qtByteArray.constData(), qtByteArray.length());
         ExecState* exec = toJS(context);
+        APIEntryShim entryShim(exec);
         return toRef(exec, toJS(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), wtfByteArray.get()));
     }
@@ -738 +742 @@
             return JSValueMakeNull(context);
         ExecState* exec = toJS(context);
+        APIEntryShim entryShim(exec);
         return toRef(exec, QtInstance::getQtInstance(obj, root, QtInstance::QtOwnership)->createRuntimeObject(exec));
     }
@@ -752 +757 @@
             return JSValueMakeUndefined(context);
         ExecState* exec = toJS(context);
+        APIEntryShim entryShim(exec);
         return toRef(exec, customRuntimeConversions()->value(type).toJSValueFunc(exec, toJSDOMGlobalObject(document, exec), variant));
     }
@@ -801 +807 @@
         JSObjectRef array = JSObjectMakeArray(context, 0, 0, exception);
         ExecState* exec = toJS(context);
+        APIEntryShim entryShim(exec);
         for (int i = 0; i < ol.count(); ++i) {
             JSValueRef jsObject = toRef(exec, QtInstance::getQtInstance(ol.at(i), root, QtInstance::QtOwnership)->createRuntimeObject(exec));