Changeset 206876 in webkit

Timestamp:

Oct 6, 2016 1:13:50 PM (8 years ago)

Author:

keith_miller@apple.com

Message:

getInternalObjcObject should validate the JSManagedObject's value.
​https://bugs.webkit.org/show_bug.cgi?id=162985

Reviewed by Geoffrey Garen.

Previously, if, for instance, the JSManagedObject's weak value had been
cleared we would call tryUnwrapObjcObject with a nil context and value.
This triggered assertions failures as those functions expect their inputs
to be valid.

• API/JSVirtualMachine.mm:

(getInternalObjcObject):

Location:

trunk/Source/JavaScriptCore

Files:

• API/JSVirtualMachine.mm (modified) (1 diff)
• API/tests/testapi.mm (modified) (1 diff)
• ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/API/JSVirtualMachine.mm

@@ -133 +133 @@
     if ([object isKindOfClass:[JSManagedValue class]]) {
         JSValue* value = [static_cast<JSManagedValue *>(object) value];
+        if (!value)
+            return nil;
         id temp = tryUnwrapObjcObject([value.context JSGlobalContextRef], [value JSValueRef]);
         if (temp)

trunk/Source/JavaScriptCore/API/tests/testapi.mm

@@ -1183 +1183 @@
 
     @autoreleasepool {
+        static const unsigned count = 100;
+        NSMutableArray *array = [NSMutableArray arrayWithCapacity:count];
+        JSContext *context = [[JSContext alloc] init];
+        @autoreleasepool {
+            for (unsigned i = 0; i < count; ++i) {
+                JSValue *object = [JSValue valueWithNewObjectInContext:context];
+                JSManagedValue *managedObject = [JSManagedValue managedValueWithValue:object];
+                [array addObject:managedObject];
+            }
+        }
+        JSSynchronousGarbageCollectForDebugging([context JSGlobalContextRef]);
+        for (unsigned i = 0; i < count; ++i)
+            [context.virtualMachine addManagedReference:array[i] withOwner:array];
+    }
+
+    @autoreleasepool {
         TestObject *testObject = [TestObject testObject];
         JSManagedValue *managedTestObject;

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-10-06  Keith Miller  <keith_miller@apple.com>
+
+        getInternalObjcObject should validate the JSManagedObject's value.
+        https://bugs.webkit.org/show_bug.cgi?id=162985
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, if, for instance, the JSManagedObject's weak value had been
+        cleared we would call tryUnwrapObjcObject with a nil context and value.
+        This triggered assertions failures as those functions expect their inputs
+        to be valid.
+
+        * API/JSVirtualMachine.mm:
+        (getInternalObjcObject):
+
 2016-10-06  Brian Burg  <bburg@apple.com>