Changeset 21332 in webkit

Timestamp:

May 9, 2007 3:36:25 AM (17 years ago)

Author:

eseidel

Message:

2007-05-09 Eric Seidel <​eric@webkit.org>

Reviewed by mjs.

​http://bugs.webkit.org/show_bug.cgi?id=6985
Cyclic proto values cause WebKit to hang

• kjs/object.cpp: (KJS::JSObject::put): do a cycle check before setting proto

Location:

trunk

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/kjs/object.cpp (modified) (2 diffs)
• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/cyclic-prototypes.html (added)
• LayoutTests/fast/js/resources/cyclic-prototypes.js (added)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2007-05-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by mjs.
+        
+        http://bugs.webkit.org/show_bug.cgi?id=6985
+        Cyclic __proto__ values cause WebKit to hang
+
+        * kjs/object.cpp:
+        (KJS::JSObject::put): do a cycle check before setting __proto__
+
 2007-05-08  Kimmo Kinnunen  <kimmok@iki.fi>
 

trunk/JavaScriptCore/kjs/object.cpp

@@ -5 +5 @@
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ *  Copyright (C) 2007 Eric Seidel (eric@webkit.org)
  *
  *  This library is free software; you can redistribute it and/or
@@ -212 +213 @@
   // non-standard netscape extension
   if (propertyName == exec->propertyNames().underscoreProto) {
+    JSObject* proto = value->getObject();
+    while (proto) {
+      if (proto == this)
+        throwError(exec, GeneralError, "cyclic __proto__ value");
+      proto = proto->prototype() ? proto->prototype()->getObject() : 0;
+    }
+    
     setPrototype(value);
     return;

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2007-05-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by mjs.
+        
+        http://bugs.webkit.org/show_bug.cgi?id=6985
+        Cyclic __proto__ values cause webkit to hang
+
+        * fast/js/cyclic-prototypes-expected.txt: Added.
+        * fast/js/cyclic-prototypes.html: Added.
+        * fast/js/resources/cyclic-prototypes.js: Added.
+
 2007-05-08  Geoffrey Garen  <ggaren@apple.com>