Changeset 51536 in webkit

Timestamp:

Dec 1, 2009 7:45:23 AM (14 years ago)

Author:

eric@webkit.org

Message:

2009-12-01 Mads Ager <​ager@chromium.org>

Reviewed by Eric Seidel.

[V8] Don't crash in DOMWindow event getter in OOM situations
​https://bugs.webkit.org/show_bug.cgi?id=32017

Add missing null handle checks in DOMWindow event property
accessors. V8Proxy::context(frame) can return a null handle in
OOM situations either if failing to initialize a context or if an
OOM is handled gracefully and javascript is disabled.

No new tests because we don't have a good way to test
out-of-memory bugs.

• bindings/v8/custom/V8DOMWindowCustom.cpp: (WebCore::ACCESSOR_GETTER): (WebCore::ACCESSOR_SETTER):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/v8/custom/V8DOMWindowCustom.cpp (modified) (2 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-12-01  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Don't crash in DOMWindow event getter in OOM situations
+        https://bugs.webkit.org/show_bug.cgi?id=32017
+
+        Add missing null handle checks in DOMWindow event property
+        accessors.  V8Proxy::context(frame) can return a null handle in
+        OOM situations either if failing to initialize a context or if an
+        OOM is handled gracefully and javascript is disabled.
+
+        No new tests because we don't have a good way to test
+        out-of-memory bugs.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
 2009-12-01  Chris Marrin  <cmarrin@apple.com>
 

trunk/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp

@@ -176 +176 @@
 
     v8::Local<v8::Context> context = V8Proxy::context(frame);
+    if (context.IsEmpty())
+        return v8::Undefined();
+
     v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
     v8::Handle<v8::Value> jsEvent = context->Global()->GetHiddenValue(eventSymbol);
@@ -194 +197 @@
 
     v8::Local<v8::Context> context = V8Proxy::context(frame);
+    if (context.IsEmpty())
+        return;
+
     v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
     context->Global()->SetHiddenValue(eventSymbol, value);