Title: [125513] trunk
- Revision
- 125513
- Author
- [email protected]
- Date
- 2012-08-14 00:22:31 -0700 (Tue, 14 Aug 2012)
Log Message
regression(r124510) webintents/web-intents-obj-constructor.html is crashing
https://bugs.webkit.org/show_bug.cgi?id=93096
Patch by Christophe Dumez <[email protected]> on 2012-08-14
Reviewed by Kentaro Hara.
Source/WebCore:
Add null-check for JSC::ExecState pointer in JSDictionary constructor
before using it. The exec may indeed be null, thus causing crashes.
No new test, already tested by webintents/web-intents-obj-constructor.html
* bindings/js/JSDictionary.cpp:
(WebCore::JSDictionary::tryGetProperty):
(WebCore::JSDictionary::getWithUndefinedOrNullCheck):
* bindings/js/JSDictionary.h:
(WebCore::JSDictionary::JSDictionary):
LayoutTests:
Unskip webintents/web-intents-obj-constructor.html now that the
crash is fixed in WebCore.
* platform/efl-wk2/TestExpectations:
* platform/efl/TestExpectations:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (125512 => 125513)
--- trunk/LayoutTests/ChangeLog 2012-08-14 07:17:54 UTC (rev 125512)
+++ trunk/LayoutTests/ChangeLog 2012-08-14 07:22:31 UTC (rev 125513)
@@ -1,3 +1,16 @@
+2012-08-14 Christophe Dumez <[email protected]>
+
+ regression(r124510) webintents/web-intents-obj-constructor.html is crashing
+ https://bugs.webkit.org/show_bug.cgi?id=93096
+
+ Reviewed by Kentaro Hara.
+
+ Unskip webintents/web-intents-obj-constructor.html now that the
+ crash is fixed in WebCore.
+
+ * platform/efl-wk2/TestExpectations:
+ * platform/efl/TestExpectations:
+
2012-08-13 Zan Dobersek <[email protected]>
Unreviewed GTK gardening.
Modified: trunk/LayoutTests/platform/efl/TestExpectations (125512 => 125513)
--- trunk/LayoutTests/platform/efl/TestExpectations 2012-08-14 07:17:54 UTC (rev 125512)
+++ trunk/LayoutTests/platform/efl/TestExpectations 2012-08-14 07:22:31 UTC (rev 125513)
@@ -146,7 +146,6 @@
// CRASHES
//////////////////////////////////////////////////////////////////////////////////////////
-BUGWK93096 : webintents/web-intents-obj-constructor.html = CRASH
BUGWK93654 DEBUG : fast/events/keyevent-iframe-removed-crash.html = CRASH
//////////////////////////////////////////////////////////////////////////////////////////
Modified: trunk/LayoutTests/platform/efl-wk2/TestExpectations (125512 => 125513)
--- trunk/LayoutTests/platform/efl-wk2/TestExpectations 2012-08-14 07:17:54 UTC (rev 125512)
+++ trunk/LayoutTests/platform/efl-wk2/TestExpectations 2012-08-14 07:22:31 UTC (rev 125513)
@@ -281,5 +281,5 @@
// WTR does not print information about Web Intents MessagePorts
BUGWK89072 : webintents/web-intents-invoke-port.html = TEXT
-BUGWK89072 : webintents/web-intents-obj-constructor.html = CRASH
+BUGWK89072 : webintents/web-intents-obj-constructor.html = TEXT
Modified: trunk/Source/WebCore/ChangeLog (125512 => 125513)
--- trunk/Source/WebCore/ChangeLog 2012-08-14 07:17:54 UTC (rev 125512)
+++ trunk/Source/WebCore/ChangeLog 2012-08-14 07:22:31 UTC (rev 125513)
@@ -1,3 +1,21 @@
+2012-08-14 Christophe Dumez <[email protected]>
+
+ regression(r124510) webintents/web-intents-obj-constructor.html is crashing
+ https://bugs.webkit.org/show_bug.cgi?id=93096
+
+ Reviewed by Kentaro Hara.
+
+ Add null-check for JSC::ExecState pointer in JSDictionary constructor
+ before using it. The exec may indeed be null, thus causing crashes.
+
+ No new test, already tested by webintents/web-intents-obj-constructor.html
+
+ * bindings/js/JSDictionary.cpp:
+ (WebCore::JSDictionary::tryGetProperty):
+ (WebCore::JSDictionary::getWithUndefinedOrNullCheck):
+ * bindings/js/JSDictionary.h:
+ (WebCore::JSDictionary::JSDictionary):
+
2012-08-13 Keishi Hattori <[email protected]>
Remove fade in transition from calendar picker
Modified: trunk/Source/WebCore/bindings/js/JSDictionary.cpp (125512 => 125513)
--- trunk/Source/WebCore/bindings/js/JSDictionary.cpp 2012-08-14 07:17:54 UTC (rev 125512)
+++ trunk/Source/WebCore/bindings/js/JSDictionary.cpp 2012-08-14 07:22:31 UTC (rev 125513)
@@ -46,6 +46,7 @@
JSDictionary::GetPropertyResult JSDictionary::tryGetProperty(const char* propertyName, JSValue& finalResult) const
{
+ ASSERT(isValid());
Identifier identifier(m_exec, propertyName);
PropertySlot slot(m_initializerObject.get());
@@ -196,6 +197,7 @@
bool JSDictionary::getWithUndefinedOrNullCheck(const String& propertyName, String& result) const
{
+ ASSERT(isValid());
JSValue value;
if (tryGetProperty(propertyName.utf8().data(), value) != PropertyFound || value.isUndefinedOrNull())
return false;
Modified: trunk/Source/WebCore/bindings/js/JSDictionary.h (125512 => 125513)
--- trunk/Source/WebCore/bindings/js/JSDictionary.h 2012-08-14 07:17:54 UTC (rev 125512)
+++ trunk/Source/WebCore/bindings/js/JSDictionary.h 2012-08-14 07:22:31 UTC (rev 125513)
@@ -48,8 +48,9 @@
public:
JSDictionary(JSC::ExecState* exec, JSC::JSObject* initializerObject)
: m_exec(exec)
- , m_initializerObject(exec->globalData(), initializerObject)
{
+ if (exec && initializerObject)
+ m_initializerObject = JSC::Strong<JSC::JSObject>(exec->globalData(), initializerObject);
}
// Returns false if any exceptions were thrown, regardless of whether the property was found.
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
