Title: [149496] trunk/Source/_javascript_Core
- Revision
- 149496
- Author
- [email protected]
- Date
- 2013-05-02 13:59:33 -0700 (Thu, 02 May 2013)
Log Message
Fix potential bug in lookup logic
https://bugs.webkit.org/show_bug.cgi?id=115522
Reviewed by Mark Hahnenberg.
Though not a problem in practise, it is technically possible
to inject an un-proxied global object into the scope chain
via the C API. This change makes sure that the scope walk
in BytecodeGenerator actually limits itself to scopes that
are statically bindable.
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::resolve):
* runtime/JSObject.h:
(JSObject):
(JSC):
(JSC::JSObject::isStaticScopeObject):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (149495 => 149496)
--- trunk/Source/_javascript_Core/ChangeLog 2013-05-02 20:56:41 UTC (rev 149495)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-05-02 20:59:33 UTC (rev 149496)
@@ -1,3 +1,23 @@
+2013-05-02 Oliver Hunt <[email protected]>
+
+ Fix potential bug in lookup logic
+ https://bugs.webkit.org/show_bug.cgi?id=115522
+
+ Reviewed by Mark Hahnenberg.
+
+ Though not a problem in practise, it is technically possible
+ to inject an un-proxied global object into the scope chain
+ via the C API. This change makes sure that the scope walk
+ in BytecodeGenerator actually limits itself to scopes that
+ are statically bindable.
+
+ * bytecompiler/BytecodeGenerator.cpp:
+ (JSC::BytecodeGenerator::resolve):
+ * runtime/JSObject.h:
+ (JSObject):
+ (JSC):
+ (JSC::JSObject::isStaticScopeObject):
+
2013-05-01 Roger Fong <[email protected]>
Set Path in makefile for AppleWin.
Modified: trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp (149495 => 149496)
--- trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp 2013-05-02 20:56:41 UTC (rev 149495)
+++ trunk/Source/_javascript_Core/bytecompiler/BytecodeGenerator.cpp 2013-05-02 20:59:33 UTC (rev 149496)
@@ -1187,7 +1187,7 @@
unsigned flags = 0;
for (; iter != end; ++iter, ++depth) {
JSObject* currentScope = iter.get();
- if (!currentScope->isVariableObject())
+ if (!currentScope->isStaticScopeObject())
return ResolveResult::dynamicResolve();
JSSymbolTableObject* currentVariableObject = jsCast<JSSymbolTableObject*>(currentScope);
Modified: trunk/Source/_javascript_Core/runtime/JSObject.h (149495 => 149496)
--- trunk/Source/_javascript_Core/runtime/JSObject.h 2013-05-02 20:56:41 UTC (rev 149495)
+++ trunk/Source/_javascript_Core/runtime/JSObject.h 2013-05-02 20:59:33 UTC (rev 149496)
@@ -571,6 +571,7 @@
bool isGlobalObject() const;
bool isVariableObject() const;
+ bool isStaticScopeObject() const;
bool isNameScopeObject() const;
bool isActivationObject() const;
bool isErrorInstance() const;
@@ -1081,6 +1082,14 @@
return structure()->typeInfo().type() >= VariableObjectType;
}
+
+inline bool JSObject::isStaticScopeObject() const
+{
+ JSType type = structure()->typeInfo().type();
+ return type == NameScopeObjectType || type == ActivationObjectType;
+}
+
+
inline bool JSObject::isNameScopeObject() const
{
return structure()->typeInfo().type() == NameScopeObjectType;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
