Title: [103728] trunk
- Revision
- 103728
- Author
- [email protected]
- Date
- 2011-12-27 14:09:16 -0800 (Tue, 27 Dec 2011)
Log Message
https://bugs.webkit.org/show_bug.cgi?id=75260
Null name for host function can result in dereference of uninitialize memory
Reviewed by Filip Pizlo.
Source/_javascript_Core:
This is a recent regression in ToT, if the name passed to finishCreation of a host function is null,
we are currently skipping the putDirect, which leaves memory uninitialized. This patch reverts the
aspect of the change that introduced the issue. It might be better if functions that don't have a
name don't have this property at all, but that's change should be separate from fixing the bug.
* runtime/JSFunction.cpp:
(JSC::JSFunction::finishCreation):
- Always initialize the name property.
LayoutTests:
Added a test for String applies to the ThrowTypeError function object -
if this does not crash, it passes!
* fast/js/basic-strict-mode-expected.txt:
* fast/js/script-tests/basic-strict-mode.js:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (103727 => 103728)
--- trunk/LayoutTests/ChangeLog 2011-12-27 22:04:20 UTC (rev 103727)
+++ trunk/LayoutTests/ChangeLog 2011-12-27 22:09:16 UTC (rev 103728)
@@ -1,3 +1,16 @@
+2011-12-27 Gavin Barraclough <[email protected]>
+
+ https://bugs.webkit.org/show_bug.cgi?id=75260
+ Null name for host function can result in dereference of uninitialize memory
+
+ Reviewed by Filip Pizlo.
+
+ Added a test for String applies to the ThrowTypeError function object -
+ if this does not crash, it passes!
+
+ * fast/js/basic-strict-mode-expected.txt:
+ * fast/js/script-tests/basic-strict-mode.js:
+
2011-12-27 Ryosuke Niwa <[email protected]>
Chromium rebaseline after r98596 part 2.
Modified: trunk/LayoutTests/fast/js/basic-strict-mode-expected.txt (103727 => 103728)
--- trunk/LayoutTests/fast/js/basic-strict-mode-expected.txt 2011-12-27 22:04:20 UTC (rev 103727)
+++ trunk/LayoutTests/fast/js/basic-strict-mode-expected.txt 2011-12-27 22:09:16 UTC (rev 103728)
@@ -205,6 +205,7 @@
PASS try { throw 1; } catch (e) { aGlobal = true; } is true
PASS (function () { try { throw 1; } catch (e) { aGlobal = true; }})(); aGlobal; is true
PASS (function () {try { throw 1; } catch (e) { aGlobal = true; }})(); aGlobal; is true
+PASS String(Object.getOwnPropertyDescriptor(function() { "use strict"; }, "caller").get) is 'function () {\n [native code]\n}'
PASS successfullyParsed is true
TEST COMPLETE
Modified: trunk/LayoutTests/fast/js/script-tests/basic-strict-mode.js (103727 => 103728)
--- trunk/LayoutTests/fast/js/script-tests/basic-strict-mode.js 2011-12-27 22:04:20 UTC (rev 103727)
+++ trunk/LayoutTests/fast/js/script-tests/basic-strict-mode.js 2011-12-27 22:09:16 UTC (rev 103728)
@@ -203,3 +203,6 @@
shouldBeTrue("(function () { try { throw 1; } catch (e) { aGlobal = true; }})(); aGlobal;");
aGlobal = false;
shouldBeTrue("(function () {try { throw 1; } catch (e) { aGlobal = true; }})(); aGlobal;");
+
+// Make sure this doesn't crash!
+shouldBe('String(Object.getOwnPropertyDescriptor(function() { "use strict"; }, "caller").get)', "'function () {\\n [native code]\\n}'");
Modified: trunk/Source/_javascript_Core/ChangeLog (103727 => 103728)
--- trunk/Source/_javascript_Core/ChangeLog 2011-12-27 22:04:20 UTC (rev 103727)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-12-27 22:09:16 UTC (rev 103728)
@@ -1,3 +1,19 @@
+2011-12-27 Gavin Barraclough <[email protected]>
+
+ https://bugs.webkit.org/show_bug.cgi?id=75260
+ Null name for host function can result in dereference of uninitialize memory
+
+ Reviewed by Filip Pizlo.
+
+ This is a recent regression in ToT, if the name passed to finishCreation of a host function is null,
+ we are currently skipping the putDirect, which leaves memory uninitialized. This patch reverts the
+ aspect of the change that introduced the issue. It might be better if functions that don't have a
+ name don't have this property at all, but that's change should be separate from fixing the bug.
+
+ * runtime/JSFunction.cpp:
+ (JSC::JSFunction::finishCreation):
+ - Always initialize the name property.
+
2011-12-27 Anders Carlsson <[email protected]>
Function should handle wrapping/unwrapping RefPtr and PassRefPtr
Modified: trunk/Source/_javascript_Core/runtime/JSFunction.cpp (103727 => 103728)
--- trunk/Source/_javascript_Core/runtime/JSFunction.cpp 2011-12-27 22:04:20 UTC (rev 103727)
+++ trunk/Source/_javascript_Core/runtime/JSFunction.cpp 2011-12-27 22:09:16 UTC (rev 103728)
@@ -92,8 +92,7 @@
Base::finishCreation(exec->globalData());
ASSERT(inherits(&s_info));
m_executable.set(exec->globalData(), this, executable);
- if (!name.isNull())
- putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name.ustring()), DontDelete | ReadOnly | DontEnum);
+ putDirect(exec->globalData(), exec->globalData().propertyNames->name, jsString(exec, name.isNull() ? "" : name.ustring()), DontDelete | ReadOnly | DontEnum);
putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(length), DontDelete | ReadOnly | DontEnum);
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
