- Revision
- 164008
- Author
- [email protected]
- Date
- 2014-02-12 20:05:10 -0800 (Wed, 12 Feb 2014)
Log Message
Don't crash when SerializedScriptValue deserialization fails
https://bugs.webkit.org/show_bug.cgi?id=128657
Reviewed by Oliver Hunt.
Source/WebCore:
Test: crypto/subtle/postMessage-worker.html
* bindings/js/JSMessageEventCustom.cpp: (WebCore::JSMessageEvent::data): Added a FIXME.
* bindings/js/SerializedScriptValue.cpp:
(WebCore::CloneBase::fail): Don't assert on failure.
(WebCore::SerializedScriptValue::deserialize): Never return a null JSValue, these
are not allowed.
LayoutTests:
* crypto/subtle/postMessage-worker-expected.txt:
* crypto/subtle/resources/postMessage-worker.js:
* platform/mac/TestExpectations:
Unskip the test, and land (unimportant) failure results.
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (164007 => 164008)
--- trunk/LayoutTests/ChangeLog 2014-02-13 03:34:33 UTC (rev 164007)
+++ trunk/LayoutTests/ChangeLog 2014-02-13 04:05:10 UTC (rev 164008)
@@ -1,3 +1,15 @@
+2014-02-12 Alexey Proskuryakov <[email protected]>
+
+ Don't crash when SerializedScriptValue deserialization fails
+ https://bugs.webkit.org/show_bug.cgi?id=128657
+
+ Reviewed by Oliver Hunt.
+
+ * crypto/subtle/postMessage-worker-expected.txt:
+ * crypto/subtle/resources/postMessage-worker.js:
+ * platform/mac/TestExpectations:
+ Unskip the test, and land (unimportant) failure results.
+
2014-02-12 Brady Eidson <[email protected]>
IDB: TestExpectations batch - "aborted-versionchange-closes.html to createObjectStore-null-name.html"
Modified: trunk/LayoutTests/crypto/subtle/postMessage-worker-expected.txt (164007 => 164008)
--- trunk/LayoutTests/crypto/subtle/postMessage-worker-expected.txt 2014-02-13 03:34:33 UTC (rev 164007)
+++ trunk/LayoutTests/crypto/subtle/postMessage-worker-expected.txt 2014-02-13 04:05:10 UTC (rev 164008)
@@ -3,12 +3,7 @@
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-PASS All checks passed in worker
-PASS key.type is 'secret'
-PASS key.extractable is true
-PASS key.algorithm.name is 'HMAC'
-PASS key.algorithm.length is 16
-PASS key.usages is ["decrypt", "encrypt", "sign", "verify"]
+FAIL Check failed in worker: key is null
PASS successfullyParsed is true
TEST COMPLETE
Modified: trunk/LayoutTests/crypto/subtle/resources/postMessage-worker.js (164007 => 164008)
--- trunk/LayoutTests/crypto/subtle/resources/postMessage-worker.js 2014-02-13 03:34:33 UTC (rev 164007)
+++ trunk/LayoutTests/crypto/subtle/resources/postMessage-worker.js 2014-02-13 04:05:10 UTC (rev 164008)
@@ -1,6 +1,8 @@
_onmessage_ = function(evt)
{
var key = evt.data;
+ if (!key)
+ postMessage({ result:false, message:'key is ' + key });
if (key.type != 'secret')
postMessage({ result:false, message:'key.type should be "secret"' });
else if (!key.extractable)
Modified: trunk/LayoutTests/platform/mac/TestExpectations (164007 => 164008)
--- trunk/LayoutTests/platform/mac/TestExpectations 2014-02-13 03:34:33 UTC (rev 164007)
+++ trunk/LayoutTests/platform/mac/TestExpectations 2014-02-13 04:05:10 UTC (rev 164008)
@@ -1245,9 +1245,6 @@
# SubtleCrypto is disabled on Mountain Lion
webkit.org/b/124261 [ MountainLion ] crypto/subtle [ Skip ]
-# Deserialization of a CryptoKey in a worker fails with a crash.
-crypto/subtle/postMessage-worker.html [ Skip ]
-
webkit.org/b/124311 compositing/regions/transform-transparent-positioned-video-inside-region.html [ Pass ImageOnlyFailure ]
webkit.org/b/124321 [ Mavericks ] animations/resume-after-page-cache.html [ Pass Failure ]
Modified: trunk/Source/WebCore/ChangeLog (164007 => 164008)
--- trunk/Source/WebCore/ChangeLog 2014-02-13 03:34:33 UTC (rev 164007)
+++ trunk/Source/WebCore/ChangeLog 2014-02-13 04:05:10 UTC (rev 164008)
@@ -1,3 +1,19 @@
+2014-02-11 Alexey Proskuryakov <[email protected]>
+
+ Don't crash when SerializedScriptValue deserialization fails
+ https://bugs.webkit.org/show_bug.cgi?id=128657
+
+ Reviewed by Oliver Hunt.
+
+ Test: crypto/subtle/postMessage-worker.html
+
+ * bindings/js/JSMessageEventCustom.cpp: (WebCore::JSMessageEvent::data): Added a FIXME.
+
+ * bindings/js/SerializedScriptValue.cpp:
+ (WebCore::CloneBase::fail): Don't assert on failure.
+ (WebCore::SerializedScriptValue::deserialize): Never return a null JSValue, these
+ are not allowed.
+
2014-02-12 Bem Jones-Bey <[email protected]>
[CSS Shapes] Rename shapeSize and others to make ShapeInfo and friends easier to understand
Modified: trunk/Source/WebCore/bindings/js/JSMessageEventCustom.cpp (164007 => 164008)
--- trunk/Source/WebCore/bindings/js/JSMessageEventCustom.cpp 2014-02-13 03:34:33 UTC (rev 164007)
+++ trunk/Source/WebCore/bindings/js/JSMessageEventCustom.cpp 2014-02-13 04:05:10 UTC (rev 164008)
@@ -64,9 +64,9 @@
case MessageEvent::DataTypeSerializedScriptValue:
if (RefPtr<SerializedScriptValue> serializedValue = event.dataAsSerializedScriptValue()) {
MessagePortArray ports = impl().ports();
+ // FIXME: Why does this suppress exceptions?
result = serializedValue->deserialize(exec, globalObject(), &ports, NonThrowing);
- }
- else
+ } else
result = jsNull();
break;
Modified: trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp (164007 => 164008)
--- trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp 2014-02-13 03:34:33 UTC (rev 164007)
+++ trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp 2014-02-13 04:05:10 UTC (rev 164008)
@@ -381,10 +381,8 @@
m_exec->vm().throwException(m_exec, createStackOverflowError(m_exec));
}
- NO_RETURN_DUE_TO_ASSERT
void fail()
{
- ASSERT_NOT_REACHED();
m_failed = true;
}
@@ -2641,7 +2639,7 @@
m_arrayBufferContentsArray.get(), m_data);
if (throwExceptions == Throwing)
maybeThrowExceptionIfSerializationFailed(exec, result.second);
- return result.first;
+ return result.first ? result.first : jsNull();
}
JSValueRef SerializedScriptValue::deserialize(JSContextRef destinationContext, JSValueRef* exception)
@@ -2653,7 +2651,7 @@
if (exception)
*exception = toRef(exec, exec->exception());
exec->clearException();
- return 0;
+ return nullptr;
}
ASSERT(value);
return toRef(exec, value);
