Title: [90405] trunk
- Revision
- 90405
- Author
- [email protected]
- Date
- 2011-07-05 13:51:06 -0700 (Tue, 05 Jul 2011)
Log Message
2011-07-05 Sam Weinig <[email protected]>
Null deref accessing CustomEvent.detail
<rdar://problem/9724577>
https://bugs.webkit.org/show_bug.cgi?id=63885
Reviewed by Anders Carlsson.
Test: fast/events/custom-event-uninitialized.html
* bindings/scripts/CodeGeneratorJS.pm:
Guard against uninitialized script value.
2011-07-05 Sam Weinig <[email protected]>
Null deref accessing CustomEvent.detail
<rdar://problem/9724577>
https://bugs.webkit.org/show_bug.cgi?id=63885
Reviewed by Anders Carlsson.
Add test which exercises an initialized details property on
a CustomEvent instance.
* fast/events/custom-event-uninitialized-expected.txt: Added.
* fast/events/custom-event-uninitialized.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (90404 => 90405)
--- trunk/LayoutTests/ChangeLog 2011-07-05 20:09:05 UTC (rev 90404)
+++ trunk/LayoutTests/ChangeLog 2011-07-05 20:51:06 UTC (rev 90405)
@@ -1,3 +1,17 @@
+2011-07-05 Sam Weinig <[email protected]>
+
+ Null deref accessing CustomEvent.detail
+ <rdar://problem/9724577>
+ https://bugs.webkit.org/show_bug.cgi?id=63885
+
+ Reviewed by Anders Carlsson.
+
+ Add test which exercises an initialized details property on
+ a CustomEvent instance.
+
+ * fast/events/custom-event-uninitialized-expected.txt: Added.
+ * fast/events/custom-event-uninitialized.html: Added.
+
2011-07-05 Gavin Barraclough <[email protected]>
https://bugs.webkit.org/show_bug.cgi?id=63947
Added: trunk/LayoutTests/fast/events/custom-event-uninitialized-expected.txt (0 => 90405)
--- trunk/LayoutTests/fast/events/custom-event-uninitialized-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/events/custom-event-uninitialized-expected.txt 2011-07-05 20:51:06 UTC (rev 90405)
@@ -0,0 +1 @@
+This test passes if it does not crash. (https://bugs.webkit.org/show_bug.cgi?id=63885)
Added: trunk/LayoutTests/fast/events/custom-event-uninitialized.html (0 => 90405)
--- trunk/LayoutTests/fast/events/custom-event-uninitialized.html (rev 0)
+++ trunk/LayoutTests/fast/events/custom-event-uninitialized.html 2011-07-05 20:51:06 UTC (rev 90405)
@@ -0,0 +1,8 @@
+<p>This test passes if it does not crash. (https://bugs.webkit.org/show_bug.cgi?id=63885)</p>
+
+<script>
+ if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+ String(document.createEvent("CustomEvent").detail);
+</script>
Modified: trunk/Source/WebCore/ChangeLog (90404 => 90405)
--- trunk/Source/WebCore/ChangeLog 2011-07-05 20:09:05 UTC (rev 90404)
+++ trunk/Source/WebCore/ChangeLog 2011-07-05 20:51:06 UTC (rev 90405)
@@ -1,3 +1,16 @@
+2011-07-05 Sam Weinig <[email protected]>
+
+ Null deref accessing CustomEvent.detail
+ <rdar://problem/9724577>
+ https://bugs.webkit.org/show_bug.cgi?id=63885
+
+ Reviewed by Anders Carlsson.
+
+ Test: fast/events/custom-event-uninitialized.html
+
+ * bindings/scripts/CodeGeneratorJS.pm:
+ Guard against uninitialized script value.
+
2011-07-05 Pratik Solanki <[email protected]>
Reviewed by Dan Bernstein.
Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (90404 => 90405)
--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2011-07-05 20:09:05 UTC (rev 90404)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm 2011-07-05 20:51:06 UTC (rev 90405)
@@ -2685,7 +2685,7 @@
if ($implClassName eq "Document") {
$implIncludes{"JSCanvasRenderingContext2D.h"} = 1;
} else {
- return "$value.jsValue();";
+ return "($value.hasNoValue() ? jsNull() : $value.jsValue())";
}
} elsif ($type =~ /SVGPathSeg/) {
$implIncludes{"JS$type.h"} = 1;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
