Changeset 90614 in webkit

Timestamp:

Jul 8, 2011 3:12:56 AM (13 years ago)

Author:

yurys@chromium.org

Message:

Web Inspector: typing undefined = 1 in console crashes browser
​https://bugs.webkit.org/show_bug.cgi?id=64155

Source/WebCore:

Do not access undefined value directly when producing JSON objects as undefined
may be overriden by the inspected page.

Reviewed by Pavel Feldman.

Test: inspector/console/console-eval-undefined-override.html

• inspector/InjectedScriptSource.js:

(.):
():

LayoutTests:

Reviewed by Pavel Feldman.

• inspector/console/console-eval-undefined-override-expected.txt: Added.
• inspector/console/console-eval-undefined-override.html: Added.
• platform/chromium/inspector/console/console-eval-undefined-override-expected.txt: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/inspector/console/console-eval-undefined-override-expected.txt (added)
• LayoutTests/inspector/console/console-eval-undefined-override.html (added)
• LayoutTests/platform/chromium/inspector/console/console-eval-undefined-override-expected.txt (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/inspector/InjectedScriptSource.js (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-07-08  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: typing undefined = 1 in console crashes browser
+        https://bugs.webkit.org/show_bug.cgi?id=64155
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/console/console-eval-undefined-override-expected.txt: Added.
+        * inspector/console/console-eval-undefined-override.html: Added.
+        * platform/chromium/inspector/console/console-eval-undefined-override-expected.txt: Added.
+
 2011-07-08  Andrey Kosyakov  <caseq@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-07-08  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: typing undefined = 1 in console crashes browser
+        https://bugs.webkit.org/show_bug.cgi?id=64155
+
+        Do not access undefined value directly when producing JSON objects as undefined
+        may be overriden by the inspected page.
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/console/console-eval-undefined-override.html
+
+        * inspector/InjectedScriptSource.js:
+        (.):
+        ():
+
 2011-07-07  Emil A Eklund  <eae@chromium.org>
 

trunk/Source/WebCore/inspector/InjectedScriptSource.js

@@ -190 +190 @@
         if (!expressionLength) {
             delete object[propertyName];
-            return propertyName in object ? "Cound not delete property." : undefined;
+            // Avoid explicit assignment to undefined as its value can be overriden (see crbug.com/88414).
+            var result;
+            if (propertyName in object)
+                result = "Cound not delete property.";
+            return result;
         }
 
@@ -449 +453 @@
     var rawType = typeof object;
     var hasChildren = (rawType === "object" && object !== null && (!!Object.getOwnPropertyNames(object).length || !!object.__proto__)) || rawType === "function";
-    var className = typeof object === "object" || typeof object === "function" ? InjectedScriptHost.internalConstructorName(object) : undefined;
+    var className;
+    // Avoid explicit assignment to undefined as its value can be overriden (see crbug.com/88414).
+    if (typeof object === "object" || typeof object === "function")
+        className = InjectedScriptHost.internalConstructorName(object);
     var description = injectedScript._describe(object);
     return new InjectedScript.RemoteObject(objectId, type, className, description, hasChildren);