Changeset 149671 in webkit

Timestamp:

May 7, 2013 8:33:02 AM (11 years ago)

Author:

allan.jensen@digia.com

Message:

Crash when calling QWebFrame::evaluateJavaScript
​https://bugs.webkit.org/show_bug.cgi?id=113434

Reviewed by Simon Hausmann.

Ensure we hold the JSLock when converting JSValue to JSValueRef.

• Api/qwebelement.cpp:

(setupScriptContext):
(QWebElement::evaluateJavaScript):

• WebCoreSupport/QWebFrameAdapter.cpp:

(QWebFrameAdapter::evaluateJavaScript):

Location:

trunk/Source/WebKit/qt

Files:

• Api/qwebelement.cpp (modified) (4 diffs)
• ChangeLog (modified) (1 diff)
• WebCoreSupport/QWebFrameAdapter.cpp (modified) (1 diff)

trunk/Source/WebKit/qt/Api/qwebelement.cpp

@@ -46 +46 @@
 #include "RenderImage.h"
 #include "ScriptController.h"
+#include "ScriptSourceCode.h"
 #include "ScriptState.h"
 #include "StaticNodeList.h"
@@ -711 +712 @@
 }
 
-static bool setupScriptContext(WebCore::Element* element, JSC::JSValue& thisValue, ScriptState*& state, ScriptController*& scriptController)
+static bool setupScriptContext(WebCore::Element* element, ScriptState*& state, ScriptController*& scriptController)
 {
     if (!element)
@@ -732 +733 @@
         return false;
 
-    thisValue = toJS(state, deprecatedGlobalObjectForPrototype(state), element);
-    if (!thisValue)
-        return false;
-
     return true;
 }
@@ -748 +745 @@
 
     ScriptState* state = 0;
-    JSC::JSValue thisValue;
     ScriptController* scriptController = 0;
 
-    if (!setupScriptContext(m_element, thisValue, state, scriptController))
+    if (!setupScriptContext(m_element, state, scriptController))
         return QVariant();
-    String script(reinterpret_cast_ptr<const UChar*>(scriptSource.data()), scriptSource.length());
+
+    JSC::JSLockHolder lock(state);
+    RefPtr<Element> protect = m_element;
+
+    JSC::JSValue thisValue = toJS(state, toJSDOMGlobalObject(m_element->document(), state), m_element);
+    if (!thisValue)
+        return QVariant();
+
+    ScriptSourceCode sourceCode(scriptSource);
 
     JSC::JSValue evaluationException;
-    JSC::JSValue evaluationResult = JSC::evaluate(state, JSC::makeSource(script), thisValue, &evaluationException);
+    JSC::JSValue evaluationResult = JSC::evaluate(state, sourceCode.jsSourceCode(), thisValue, &evaluationException);
     if (evaluationException)
         return QVariant();
+    JSValueRef evaluationResultRef = toRef(state, evaluationResult);
 
     int distance = 0;
     JSValueRef* ignoredException = 0;
-    return JSC::Bindings::convertValueToQVariant(toRef(state), toRef(state, evaluationResult), QMetaType::Void, &distance, ignoredException);
+    return JSC::Bindings::convertValueToQVariant(toRef(state), evaluationResultRef, QMetaType::Void, &distance, ignoredException);
 }
 

trunk/Source/WebKit/qt/ChangeLog

@@ +1 @@
+2013-05-07  Allan Sandfeld Jensen  <allan.jensen@digia.com>
+
+        Crash when calling QWebFrame::evaluateJavaScript
+        https://bugs.webkit.org/show_bug.cgi?id=113434
+
+        Reviewed by Simon Hausmann.
+
+        Ensure we hold the JSLock when converting JSValue to JSValueRef.
+
+        * Api/qwebelement.cpp:
+        (setupScriptContext):
+        (QWebElement::evaluateJavaScript):
+        * WebCoreSupport/QWebFrameAdapter.cpp:
+        (QWebFrameAdapter::evaluateJavaScript):
+
 2013-05-03  Andreas Kling  <akling@apple.com>
 

trunk/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp

@@ -198 +198 @@
 QVariant QWebFrameAdapter::evaluateJavaScript(const QString &scriptSource)
 {
-    ScriptController* proxy = frame->script();
+    ScriptController* scriptController = frame->script();
     QVariant rc;
-    if (proxy) {
+    if (scriptController) {
         int distance = 0;
-        JSC::JSValue v = frame->script()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
-        JSC::ExecState* exec = proxy->globalObject(mainThreadNormalWorld())->globalExec();
+        ScriptValue value = scriptController->executeScript(ScriptSourceCode(scriptSource));
+        JSC::ExecState* exec = scriptController->globalObject(mainThreadNormalWorld())->globalExec();
         JSValueRef* ignoredException = 0;
-        rc = JSC::Bindings::convertValueToQVariant(toRef(exec), toRef(exec, v), QMetaType::Void, &distance, ignoredException);
+        exec->vm().apiLock().lock();
+        JSValueRef valueRef = toRef(exec, value.jsValue());
+        exec->vm().apiLock().unlock();
+        rc = JSC::Bindings::convertValueToQVariant(toRef(exec), valueRef, QMetaType::Void, &distance, ignoredException);
     }
     return rc;