Changeset 49047 in webkit

Timestamp:

Oct 2, 2009 3:15:23 PM (15 years ago)

Author:

eric@webkit.org

Message:

2009-10-02 Vitaly Repeshko <​vitalyr@chromium.org>

Reviewed by Dimitri Glazkov.

Test that having infinite recursion in XMLHttpRequest event handler does not crash.
​https://bugs.webkit.org/show_bug.cgi?id=29974

• fast/xmlhttprequest/xmlhttprequest-recursive-sync-event-expected.txt: Added.
• fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html: Added.

2009-10-02 Vitaly Repeshko <​vitalyr@chromium.org>

Reviewed by Dimitri Glazkov.

[V8] Recursion guard for V8Proxy::callFunction.
Fixes ​http://crbug.com/23278.
​https://bugs.webkit.org/show_bug.cgi?id=29974

Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html

• bindings/v8/V8Proxy.cpp: (WebCore::V8Proxy::callFunction):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/xmlhttprequest/xmlhttprequest-recursive-sync-event-expected.txt (added)
• LayoutTests/fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/bindings/v8/V8Proxy.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Test that having infinite recursion in XMLHttpRequest event handler does not crash.
+        https://bugs.webkit.org/show_bug.cgi?id=29974
+
+        * fast/xmlhttprequest/xmlhttprequest-recursive-sync-event-expected.txt: Added.
+        * fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html: Added.
+
 2009-10-02  Victor Wang  <victorw@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Recursion guard for V8Proxy::callFunction.
+        Fixes http://crbug.com/23278.
+        https://bugs.webkit.org/show_bug.cgi?id=29974
+
+        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+
 2009-10-02  Brian Weinstein  <bweinstein@apple.com>
 

trunk/WebCore/bindings/v8/V8Proxy.cpp

@@ -417 +417 @@
     {
         V8ConsoleMessage::Scope scope;
+
+        if (m_recursion >= kMaxRecursionDepth) {
+            v8::Local<v8::String> code = v8::String::New("throw new RangeError('Maximum call stack size exceeded.')");
+            if (code.IsEmpty())
+                return result;
+            v8::Local<v8::Script> script = v8::Script::Compile(code);
+            if (script.IsEmpty())
+                return result;
+            script->Run();
+            return result;
+        }
 
         // Evaluating the JavaScript could cause the frame to be deallocated,