Title: [290916] branches/safari-613-branch/Source/_javascript_Core
- Revision
- 290916
- Author
- [email protected]
- Date
- 2022-03-07 14:08:54 -0800 (Mon, 07 Mar 2022)
Log Message
Cherry-pick r289001. rdar://problem/88404556
[JSC] Crash on several pages after r287986
https://bugs.webkit.org/show_bug.cgi?id=236033
Reviewed by Tim Horton.
I noticed that Safari crashes when opening https://linux.die.net/man/3/localtime.
This is happening after r287986: we are calling [self release], but the [JSValue dealloc]
cannot work if _context is nil. We should add a guard.
* API/JSValue.mm:
(-[JSValue dealloc]):
* API/tests/testapi.mm:
(testObjectiveCAPIMain):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289001 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-613-branch/Source/_javascript_Core/API/JSValue.mm (290915 => 290916)
--- branches/safari-613-branch/Source/_javascript_Core/API/JSValue.mm 2022-03-07 22:08:52 UTC (rev 290915)
+++ branches/safari-613-branch/Source/_javascript_Core/API/JSValue.mm 2022-03-07 22:08:54 UTC (rev 290916)
@@ -71,9 +71,11 @@
- (void)dealloc
{
- JSValueUnprotect([_context JSGlobalContextRef], m_value);
- [_context release];
- _context = nil;
+ if (_context) {
+ JSValueUnprotect([_context JSGlobalContextRef], m_value);
+ [_context release];
+ _context = nil;
+ }
[super dealloc];
}
Modified: branches/safari-613-branch/Source/_javascript_Core/API/tests/testapi.mm (290915 => 290916)
--- branches/safari-613-branch/Source/_javascript_Core/API/tests/testapi.mm 2022-03-07 22:08:52 UTC (rev 290915)
+++ branches/safari-613-branch/Source/_javascript_Core/API/tests/testapi.mm 2022-03-07 22:08:54 UTC (rev 290916)
@@ -561,6 +561,11 @@
static void testObjectiveCAPIMain()
{
@autoreleasepool {
+ JSValue *value = [JSValue valueWithJSValueRef:nil inContext:nil];
+ checkResult(@"nil JSValue creation", !value);
+ }
+
+ @autoreleasepool {
JSVirtualMachine* vm = [[JSVirtualMachine alloc] init];
JSContext* context = [[JSContext alloc] initWithVirtualMachine:vm];
[context evaluateScript:@"bad"];
Modified: branches/safari-613-branch/Source/_javascript_Core/ChangeLog (290915 => 290916)
--- branches/safari-613-branch/Source/_javascript_Core/ChangeLog 2022-03-07 22:08:52 UTC (rev 290915)
+++ branches/safari-613-branch/Source/_javascript_Core/ChangeLog 2022-03-07 22:08:54 UTC (rev 290916)
@@ -1,5 +1,42 @@
2022-03-07 Russell Epstein <[email protected]>
+ Cherry-pick r289001. rdar://problem/88404556
+
+ [JSC] Crash on several pages after r287986
+ https://bugs.webkit.org/show_bug.cgi?id=236033
+
+ Reviewed by Tim Horton.
+
+ I noticed that Safari crashes when opening https://linux.die.net/man/3/localtime.
+ This is happening after r287986: we are calling [self release], but the [JSValue dealloc]
+ cannot work if _context is nil. We should add a guard.
+
+ * API/JSValue.mm:
+ (-[JSValue dealloc]):
+ * API/tests/testapi.mm:
+ (testObjectiveCAPIMain):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@289001 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2022-02-02 Yusuke Suzuki <[email protected]>
+
+ [JSC] Crash on several pages after r287986
+ https://bugs.webkit.org/show_bug.cgi?id=236033
+
+ Reviewed by Tim Horton.
+
+ I noticed that Safari crashes when opening https://linux.die.net/man/3/localtime.
+ This is happening after r287986: we are calling [self release], but the [JSValue dealloc]
+ cannot work if _context is nil. We should add a guard.
+
+ * API/JSValue.mm:
+ (-[JSValue dealloc]):
+ * API/tests/testapi.mm:
+ (testObjectiveCAPIMain):
+
+2022-03-07 Russell Epstein <[email protected]>
+
Cherry-pick r287986. rdar://problem/87489048
Fix a few Objective-C object leaks due to early returns in `init`
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
