Changeset 243824 in webkit

Timestamp:

Apr 3, 2019 1:37:22 PM (5 years ago)

Author:

sihui_liu@apple.com

Message:

Follow up fix for r243807: Use MarkedArgumentBuffer instead of Vector for JSValue
​https://bugs.webkit.org/show_bug.cgi?id=196547

Reviewed by Geoffrey Garen.

JSValue in Vector could be garbage collected because GC doesn't know Vector memory on C++ heap.

• bindings/js/JSIDBRequestCustom.cpp:

(WebCore::JSIDBRequest::result const):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/JSIDBRequestCustom.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2019-04-03  Sihui Liu  <sihui_liu@apple.com>
+
+        Follow up fix for r243807: Use MarkedArgumentBuffer instead of Vector for JSValue
+        https://bugs.webkit.org/show_bug.cgi?id=196547
+
+        Reviewed by Geoffrey Garen.
+
+        JSValue in Vector could be garbage collected because GC doesn't know Vector memory on C++ heap.
+
+        * bindings/js/JSIDBRequestCustom.cpp:
+        (WebCore::JSIDBRequest::result const):
+
 2019-04-03  Chris Dumez  <cdumez@apple.com>
 

trunk/Source/WebCore/bindings/js/JSIDBRequestCustom.cpp

@@ -65 +65 @@
             auto& values = getAllResult.values();
             auto& keyPath = getAllResult.keyPath();
-            Vector<JSC::JSValue> results;
+            auto scope = DECLARE_THROW_SCOPE(state.vm());
+            JSC::MarkedArgumentBuffer list;
             for (unsigned i = 0; i < values.size(); i ++) {
                 auto result = deserializeIDBValueWithKeyInjection(state, values[i], keys[i], keyPath);
                 if (!result)
                     return jsNull();
-                results.append(result.value());
+                list.append(result.value());
+                if (UNLIKELY(list.hasOverflowed())) {
+                    propagateException(state, scope, Exception(UnknownError));
+                    return jsNull();
+                }
             }
-            return JSValue(JSC::constructArray(&state, nullptr, state.lexicalGlobalObject(), results.data(), results.size()));
+            return JSValue(JSC::constructArray(&state, nullptr, state.lexicalGlobalObject(), list));
         }, [] (uint64_t number) {
             return toJS<IDLUnsignedLongLong>(number);