Changeset 86899 in webkit


Ignore:
Timestamp:
May 19, 2011 3:29:24 PM (13 years ago)
Author:
atwilson@chromium.org
Message:

2011-05-19 Andrew Wilson <​atwilson@chromium.org>

Reviewed by Darin Adler.

MessagePortArray cloning code needs to verify source before copying
​https://bugs.webkit.org/show_bug.cgi?id=61130

  • fast/events/message-port-multi-expected.txt:
  • fast/events/resources/message-port-multi.js: Added test for "passing an array with an item at a really large index" to postMessage().

2011-05-19 Andrew Wilson <​atwilson@chromium.org>

Reviewed by Darin Adler.

MessagePortArray cloning code needs to verify source before copying.
​https://bugs.webkit.org/show_bug.cgi?id=61130

  • bindings/js/JSMessagePortCustom.cpp: (WebCore::fillMessagePortArray): Changed code to not pre-allocate the destination array.
  • bindings/v8/custom/V8MessagePortCustom.cpp: (WebCore::getMessagePortArray): Changed code to not pre-allocate the destination array.
Location:
trunk
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r86888 r86899  
     12011-05-19  Andrew Wilson  <atwilson@chromium.org>
     2
     3        Reviewed by Darin Adler.
     4
     5        MessagePortArray cloning code needs to verify source before copying
     6        https://bugs.webkit.org/show_bug.cgi?id=61130
     7
     8        * fast/events/message-port-multi-expected.txt:
     9        * fast/events/resources/message-port-multi.js:
     10        Added test for "passing an array with an item at a really large index" to postMessage().
     11
    1122011-05-19  Justin Schuh  <jschuh@chromium.org>
    213

  • trunk/LayoutTests/fast/events/message-port-multi-expected.txt

    r48926 r86899  
    1010PASS channel.port1.postMessage("notAnArray", channel3.port1) threw exception TypeError: Type error.
    1111PASS channel.port1.postMessage("notASequence", [{length: 3}]) threw exception TypeError: Type error.
     12PASS channel.port1.postMessage("largeSequence", largePortArray) threw exception Error: INVALID_STATE_ERR: DOM Exception 11.
    1213PASS event.ports is null when no port sent
    1314PASS event.ports is null when empty array sent

  • trunk/LayoutTests/fast/events/resources/message-port-multi.js

    r48926 r86899  
    99var channel2 = new MessageChannel();
    1010var channel3 = new MessageChannel();
     11var channel4 = new MessageChannel();
    1112
    1213channel.port1.postMessage("noport");
    … …  
    2425shouldThrow('channel.port1.postMessage("notAnArray", channel3.port1)')
    2526shouldThrow('channel.port1.postMessage("notASequence", [{length: 3}])');
     27
     28// Should not crash (we should figure out that the array contains undefined
     29// entries).
     30var largePortArray = [];
     31largePortArray[1234567890] = channel4.port1;
     32shouldThrow('channel.port1.postMessage("largeSequence", largePortArray)');
    2633
    2734channel.port1.postMessage("done");

  • trunk/Source/WebCore/ChangeLog

    r86879 r86899  
     12011-05-19  Andrew Wilson  <atwilson@chromium.org>
     2
     3        Reviewed by Darin Adler.
     4
     5        MessagePortArray cloning code needs to verify source before copying.
     6        https://bugs.webkit.org/show_bug.cgi?id=61130
     7
     8        * bindings/js/JSMessagePortCustom.cpp:
     9        (WebCore::fillMessagePortArray):
     10        Changed code to not pre-allocate the destination array.
     11        * bindings/v8/custom/V8MessagePortCustom.cpp:
     12        (WebCore::getMessagePortArray):
     13        Changed code to not pre-allocate the destination array.
     14
    1152011-05-19  Sheriff Bot  <webkit.review.bot@gmail.com>
    216

  • trunk/Source/WebCore/bindings/js/JSMessagePortCustom.cpp

    r86499 r86899  
    7676        return;
    7777
    78     portArray.resize(length);
    7978    for (unsigned i = 0 ; i < length; ++i) {
    8079        JSValue value = object->get(exec, i);
    … …  
    9392            return;
    9493        }
    95         portArray[i] = port.release();
     94        portArray.append(port.release());
    9695    }
    9796}

  • trunk/Source/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp

    r57207 r86899  
    8787        length = sequenceLength->Uint32Value();
    8888    }
    89     portArray.resize(length);
    9089
     90    // Validate the passed array of ports.
    9191    for (unsigned int i = 0; i < length; ++i) {
    9292        v8::Local<v8::Value> port = ports->Get(v8::Integer::New(i));
    … …  
    101101            return false;
    102102        }
    103         portArray[i] = V8MessagePort::toNative(v8::Handle<v8::Object>::Cast(port));
     103        portArray.append(V8MessagePort::toNative(v8::Handle<v8::Object>::Cast(port)));
    104104    }
    105105    return true;
Note: See TracChangeset for help on using the changeset viewer.