Changeset 58084 in webkit

Timestamp:

Apr 22, 2010 3:41:05 AM (14 years ago)

Author:

eric@webkit.org

Message:

2010-04-22 Anton Muhin <​antonm@chromium.org>

Reviewed by Adam Barth.

[v8] Do not pass empty handle into SetHiddenValue which would crash.
​https://bugs.webkit.org/show_bug.cgi?id=37801

• bindings/v8/V8AbstractEventListener.cpp: (WebCore::V8AbstractEventListener::handleEvent): add couple of asserts to check for unexpected paths (WebCore::V8AbstractEventListener::invokeEventHandler): bail out of jsEvent is empty handle

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/v8/V8AbstractEventListener.cpp (modified) (3 diffs)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-04-22  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] Do not pass empty handle into SetHiddenValue which would crash.
+        https://bugs.webkit.org/show_bug.cgi?id=37801
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent): add couple of asserts to check for unexpected paths
+        (WebCore::V8AbstractEventListener::invokeEventHandler): bail out of jsEvent is empty handle
+
 2010-04-22  Stephan Aßmus  <superstippi@gmx.de>
 

trunk/WebCore/bindings/v8/V8AbstractEventListener.cpp

@@ -72 +72 @@
 void V8AbstractEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
 {
+    ASSERT(event);
+
     // The callback function on XMLHttpRequest can clear the event listener and destroys 'this' object. Keep a local reference to it.
     // See issue 889829.
@@ -87 +89 @@
     // Get the V8 wrapper for the event object.
     v8::Handle<v8::Value> jsEvent = toV8(event);
+    ASSERT(!jsEvent.IsEmpty());
 
     invokeEventHandler(context, event, jsEvent);
@@ -115 +118 @@
 void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context, Event* event, v8::Handle<v8::Value> jsEvent)
 {
+    // If jsEvent is empty, attempt to set it as a hidden value would crash v8.
+    if (jsEvent.IsEmpty())
+        return;
 
     v8::Local<v8::Context> v8Context = toV8Context(context, worldContext());