Changeset 33414 in webkit

Timestamp:

May 13, 2008 3:31:22 PM (16 years ago)

Author:

timothy@apple.com

Message:

Fixes the assertion and crash that would happen when inspecting a element from a frame.
This change makes JSInspectedObjectWrapper pass unwrapped objects around for global objects
that share the same page group identifier. Also returns jsUndefined() instead of 0 to prevent
crashing in release builds if the page groups don't match.

Passes all the tests in: manual-tests/inspector-wrappers

Reviewed by Adam Roben.

• bindings/js/JSInspectedObjectWrapper.cpp:

(WebCore::JSInspectedObjectWrapper::prepareIncomingValue): Return jsUndefined() instead of 0.
Call allowsUnwrappedAccessFrom instead of unwrappedExecStateMatches.

• bindings/js/JSQuarantinedObjectWrapper.cpp:

(WebCore::JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom): Renamed from unwrappedExecStateMatches.
Return true if the pageGroupIdentifier of both wrappers match.
(WebCore::JSQuarantinedObjectWrapper::callAsFunction): Return jsUndefined() instead of 0.

• bindings/js/JSQuarantinedObjectWrapper.h: Renamed unwrappedExecStateMatches to allowsUnwrappedAccessFrom.

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/JSInspectedObjectWrapper.cpp (modified) (2 diffs)
• bindings/js/JSQuarantinedObjectWrapper.cpp (modified) (3 diffs)
• bindings/js/JSQuarantinedObjectWrapper.h (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2008-05-13  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes the assertion and crash that would happen when inspecting a element from a frame.
+        This change makes JSInspectedObjectWrapper pass unwrapped objects around for global objects
+        that share the same page group identifier. Also returns jsUndefined() instead of 0 to prevent
+        crashing in release builds if the page groups don't match.
+
+        Passes all the tests in: manual-tests/inspector-wrappers
+
+        Reviewed by Adam Roben.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::prepareIncomingValue): Return jsUndefined() instead of 0.
+        Call allowsUnwrappedAccessFrom instead of unwrappedExecStateMatches.
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom): Renamed from unwrappedExecStateMatches.
+        Return true if the pageGroupIdentifier of both wrappers match.
+        (WebCore::JSQuarantinedObjectWrapper::callAsFunction): Return jsUndefined() instead of 0.
+        * bindings/js/JSQuarantinedObjectWrapper.h: Renamed unwrappedExecStateMatches to allowsUnwrappedAccessFrom.
+
 2008-05-13  Timothy Hatcher  <timothy@apple.com>
 

trunk/WebCore/bindings/js/JSInspectedObjectWrapper.cpp

@@ -84 +84 @@
     ASSERT_WITH_MESSAGE(wrapper, "Objects passed to JSInspectedObjectWrapper must be wrapped");
     if (!wrapper)
-        return 0;
+        return jsUndefined();
 
-    if (wrapper->unwrappedExecStateMatches(unwrappedExecState())) {
+    if (wrapper->allowsUnwrappedAccessFrom(unwrappedExecState())) {
         ASSERT_WITH_MESSAGE(wrapper->inherits(&s_info), "A wrapper contains an object from the inspected page but is not a JSInspectedObjectWrapper");
         if (!wrapper->inherits(&s_info))
-            return 0;
+            return jsUndefined();
 
         // Return the unwrapped object so the inspected page never sees one of its own objects in wrapped form.
@@ -97 +97 @@
     ASSERT_WITH_MESSAGE(wrapper->inherits(&JSInspectorCallbackWrapper::s_info), "A wrapper that was not from the inspected page and is not an Inspector callback was passed to a JSInspectedObjectWrapper");
     if (!wrapper->inherits(&JSInspectorCallbackWrapper::s_info))
-        return 0;
+        return jsUndefined();
 
     return wrapper;

trunk/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp

@@ -70 +70 @@
 }
 
-bool JSQuarantinedObjectWrapper::unwrappedExecStateMatches(const ExecState* exec) const
-{
-    return m_unwrappedGlobalObject == exec->dynamicGlobalObject();
+bool JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom(const ExecState* exec) const
+{
+    return m_unwrappedGlobalObject->pageGroupIdentifier() == exec->dynamicGlobalObject()->pageGroupIdentifier();
 }
 
@@ -247 +247 @@
 {
     if (!allowsCallAsFunction())
-        return 0;
+        return jsUndefined();
 
     JSObject* preparedThisObj = static_cast<JSObject*>(prepareIncomingValue(exec, thisObj));
     if (!preparedThisObj)
-        return 0;
+        return jsUndefined();
 
     List preparedArgs;
@@ -257 +257 @@
         JSValue* preparedValue = prepareIncomingValue(exec, args[i]);
         if (!preparedValue)
-            return 0;
+            return jsUndefined();
         preparedArgs.append(preparedValue);
     }

trunk/WebCore/bindings/js/JSQuarantinedObjectWrapper.h

@@ -40 +40 @@
         KJS::ExecState* unwrappedExecState() const;
 
-        bool unwrappedExecStateMatches(const KJS::ExecState*) const;
+        bool allowsUnwrappedAccessFrom(const KJS::ExecState*) const;
 
         virtual bool getOwnPropertySlot(KJS::ExecState*, const KJS::Identifier&, KJS::PropertySlot&);