Title: [257746] trunk/Source/WebCore
- Revision
- 257746
- Author
- [email protected]
- Date
- 2020-03-02 16:16:02 -0800 (Mon, 02 Mar 2020)
Log Message
ScriptController::executeIfJavaScriptURL() uses wrong JSGlobalObject.
https://bugs.webkit.org/show_bug.cgi?id=208290
<rdar://problem/59839476>
Reviewed by Chris Dumez.
The call to executeScriptIgnoringException() may have changed the current global
object of the window. We should be using the original global object that produced
the result string.
Also added a missing exception check needed after a potential rope resolution.
* bindings/js/ScriptController.cpp:
(WebCore::ScriptController::executeIfJavaScriptURL):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (257745 => 257746)
--- trunk/Source/WebCore/ChangeLog 2020-03-02 23:58:56 UTC (rev 257745)
+++ trunk/Source/WebCore/ChangeLog 2020-03-03 00:16:02 UTC (rev 257746)
@@ -1,3 +1,20 @@
+2020-03-02 Mark Lam <[email protected]>
+
+ ScriptController::executeIfJavaScriptURL() uses wrong JSGlobalObject.
+ https://bugs.webkit.org/show_bug.cgi?id=208290
+ <rdar://problem/59839476>
+
+ Reviewed by Chris Dumez.
+
+ The call to executeScriptIgnoringException() may have changed the current global
+ object of the window. We should be using the original global object that produced
+ the result string.
+
+ Also added a missing exception check needed after a potential rope resolution.
+
+ * bindings/js/ScriptController.cpp:
+ (WebCore::ScriptController::executeIfJavaScriptURL):
+
2020-03-02 Jacob Uphoff <[email protected]>
Unreviewed, rolling out r257725.
Modified: trunk/Source/WebCore/bindings/js/ScriptController.cpp (257745 => 257746)
--- trunk/Source/WebCore/bindings/js/ScriptController.cpp 2020-03-02 23:58:56 UTC (rev 257745)
+++ trunk/Source/WebCore/bindings/js/ScriptController.cpp 2020-03-03 00:16:02 UTC (rev 257746)
@@ -811,8 +811,13 @@
const int _javascript_SchemeLength = sizeof("_javascript_:") - 1;
+ JSDOMGlobalObject* globalObject = jsWindowProxy(mainThreadNormalWorld()).window();
+ VM& vm = globalObject->vm();
+ auto throwScope = DECLARE_THROW_SCOPE(vm);
+
String decodedURL = decodeURLEscapeSequences(url.string());
auto result = executeScriptIgnoringException(decodedURL.substring(_javascript_SchemeLength));
+ RELEASE_ASSERT(&vm == &jsWindowProxy(mainThreadNormalWorld()).window()->vm());
// If executing script caused this frame to be removed from the page, we
// don't want to try to replace its document!
@@ -819,8 +824,14 @@
if (!m_frame.page())
return true;
+ if (!result)
+ return true;
+
String scriptResult;
- if (!result || !result.getString(jsWindowProxy(mainThreadNormalWorld()).window(), scriptResult))
+ bool isString = result.getString(globalObject, scriptResult);
+ RETURN_IF_EXCEPTION(throwScope, true);
+
+ if (!isString)
return true;
// FIXME: We should always replace the document, but doing so
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
