Changeset 50964 in webkit

Timestamp:

Nov 13, 2009 12:42:16 PM (14 years ago)

Author:

oliver@apple.com

Message:

JSValueProtect and JSValueUnprotect don't protect API wrapper values
​https://bugs.webkit.org/show_bug.cgi?id=31485

Reviewed by Geoff Garen.

Make JSValueProtect/Unprotect use a new 'toJS' function, 'toJSForGC' that
does not attempt to to strip out API wrapper objects.

Location:

trunk/JavaScriptCore

Files:

• API/APICast.h (modified) (1 diff)
• API/JSValueRef.cpp (modified) (2 diffs)
• API/tests/testapi.c (modified) (2 diffs)
• ChangeLog (modified) (1 diff)

trunk/JavaScriptCore/API/APICast.h

@@ -74 +74 @@
 }
 
+inline JSC::JSValue toJSForGC(JSC::ExecState*, JSValueRef v)
+{
+#if USE(JSVALUE32_64)
+    JSC::JSCell* jsCell = reinterpret_cast<JSC::JSCell*>(const_cast<OpaqueJSValue*>(v));
+    if (!jsCell)
+        return JSC::JSValue();
+    return jsCell;
+#else
+    return JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
+#endif
+}
+
 inline JSC::JSObject* toJS(JSObjectRef o)
 {

trunk/JavaScriptCore/API/JSValueRef.cpp

@@ -308 +308 @@
     JSLock lock(exec);
 
-    JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJSForGC(exec, value);
     gcProtect(jsValue);
 }
@@ -318 +318 @@
     JSLock lock(exec);
 
-    JSValue jsValue = toJS(exec, value);
+    JSValue jsValue = toJSForGC(exec, value);
     gcUnprotect(jsValue);
 }

trunk/JavaScriptCore/API/tests/testapi.c

@@ -738 +738 @@
 }
 
+static JSValueRef jsNumberValue =  NULL;
+
+static void makeGlobalNumberValue(JSContextRef context) {
+    JSValueRef v = JSValueMakeNumber(context, 420);
+    JSValueProtect(context, v);
+    jsNumberValue = v;
+    v = NULL;
+}
+
 int main(int argc, char* argv[])
 {
@@ -949 +958 @@
     
     jsGlobalValue = JSObjectMake(context, NULL, NULL);
+    makeGlobalNumberValue(context);
     JSValueProtect(context, jsGlobalValue);
     JSGarbageCollect(context);
     ASSERT(JSValueIsObject(context, jsGlobalValue));
     JSValueUnprotect(context, jsGlobalValue);
+    JSValueUnprotect(context, jsNumberValue);
 
     JSStringRef goodSyntax = JSStringCreateWithUTF8CString("x = 1;");

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-11-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        JSValueProtect and JSValueUnprotect don't protect API wrapper values
+        https://bugs.webkit.org/show_bug.cgi?id=31485
+
+        Make JSValueProtect/Unprotect use a new 'toJS' function, 'toJSForGC' that
+        does not attempt to to strip out API wrapper objects.
+
+        * API/APICast.h:
+        (toJSForGC):
+        * API/JSValueRef.cpp:
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * API/tests/testapi.c:
+        (makeGlobalNumberValue):
+        (main):
+
 2009-11-13  İsmail Dönmez  <ismail@namtrac.org>