Changeset 225658 in webkit

Timestamp:

Dec 7, 2017 5:12:18 PM (6 years ago)

Author:

sbarati@apple.com

Message:

We need to grab the JSLock in InjectedBundle::createWebDataFromUint8Array
​https://bugs.webkit.org/show_bug.cgi?id=180492

Reviewed by Alex Christensen.

InjectedBundle::createWebDataFromUint8Array calls into WebCore APIs that allocate
out of the JS heap. It's only legal to allocate out of the JS heap when holding the JS lock.

• WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::createWebDataFromUint8Array):

Location:

trunk/Source/WebKit

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/InjectedBundle/InjectedBundle.cpp (modified) (1 diff)

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2017-12-07  Saam Barati  <sbarati@apple.com>
+
+        We need to grab the JSLock in InjectedBundle::createWebDataFromUint8Array
+        https://bugs.webkit.org/show_bug.cgi?id=180492
+
+        Reviewed by Alex Christensen.
+
+        InjectedBundle::createWebDataFromUint8Array calls into WebCore APIs that allocate
+        out of the JS heap. It's only legal to allocate out of the JS heap when holding the JS lock.
+
+        * WebProcess/InjectedBundle/InjectedBundle.cpp:
+        (WebKit::InjectedBundle::createWebDataFromUint8Array):
+
 2017-12-07  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebKit/WebProcess/InjectedBundle/InjectedBundle.cpp

@@ -582 +582 @@
 {
     JSC::ExecState* execState = toJS(context);
+    JSLockHolder lock(execState);
     RefPtr<Uint8Array> arrayData = WebCore::toUnsharedUint8Array(execState->vm(), toJS(execState, data));
     return API::Data::create(static_cast<unsigned char*>(arrayData->baseAddress()), arrayData->byteLength());