[webkit-changes] [194409] trunk/Source/JavaScriptCore

[akling]

Title: [194409] trunk/Source/_javascript_Core

Revision

194409

Author

akl...@apple.com

Date

2015-12-23 18:17:03 -0800 (Wed, 23 Dec 2015)

Log Message

jsc CLI tool crashes on EOF.
<https://webkit.org/b/152522>

Reviewed by Benjamin Poulain.

SourceProvider should treat String() like the empty string for hashing purposes.
This was a subtle behavior change in r194017 due to how zero-length strings are
treated by StringImpl::createSubstringSharingImpl().

I made these SourceProviders store a Ref<StringImpl> internally instead of a
String, to codify the fact that these strings can't be null strings.

I couldn't find a way to cause this crash through the API.

* API/JSScriptRef.cpp:
(OpaqueJSScript::OpaqueJSScript):
* parser/SourceProvider.h:
(JSC::StringSourceProvider::StringSourceProvider):

Modified Paths

• trunk/Source/_javascript_Core/API/JSScriptRef.cpp
• trunk/Source/_javascript_Core/ChangeLog
• trunk/Source/_javascript_Core/parser/SourceProvider.h

Diff

Modified: trunk/Source/_javascript_Core/API/JSScriptRef.cpp (194408 => 194409)

--- trunk/Source/_javascript_Core/API/JSScriptRef.cpp	2015-12-24 01:36:43 UTC (rev 194408)
+++ trunk/Source/_javascript_Core/API/JSScriptRef.cpp	2015-12-24 02:17:03 UTC (rev 194409)
@@ -48,12 +48,12 @@
 
     unsigned hash() const override
     {
-        return m_source.impl()->hash();
+        return m_source.get().hash();
     }
 
     StringView source() const override
     {
-        return m_source;
+        return m_source.get();
     }
 
     VM* vm() const { return m_vm; }
@@ -62,14 +62,14 @@
     OpaqueJSScript(VM* vm, const String& url, int startingLineNumber, const String& source)
         : SourceProvider(url, TextPosition(OrdinalNumber::fromOneBasedInt(startingLineNumber), OrdinalNumber::first()))
         , m_vm(vm)
-        , m_source(source)
+        , m_source(source.isNull() ? *StringImpl::empty() : *source.impl())
     {
     }
 
     virtual ~OpaqueJSScript() { }
 
     VM* m_vm;
-    String m_source;
+    Ref<StringImpl> m_source;
 };
 
 static bool parseScript(VM* vm, const SourceCode& source, ParserError& error)

Modified: trunk/Source/_javascript_Core/ChangeLog (194408 => 194409)

--- trunk/Source/_javascript_Core/ChangeLog	2015-12-24 01:36:43 UTC (rev 194408)
+++ trunk/Source/_javascript_Core/ChangeLog	2015-12-24 02:17:03 UTC (rev 194409)
@@ -1,3 +1,24 @@
+2015-12-23  Andreas Kling  <akl...@apple.com>
+
+        jsc CLI tool crashes on EOF.
+        <https://webkit.org/b/152522>
+
+        Reviewed by Benjamin Poulain.
+
+        SourceProvider should treat String() like the empty string for hashing purposes.
+        This was a subtle behavior change in r194017 due to how zero-length strings are
+        treated by StringImpl::createSubstringSharingImpl().
+
+        I made these SourceProviders store a Ref<StringImpl> internally instead of a
+        String, to codify the fact that these strings can't be null strings.
+
+        I couldn't find a way to cause this crash through the API.
+
+        * API/JSScriptRef.cpp:
+        (OpaqueJSScript::OpaqueJSScript):
+        * parser/SourceProvider.h:
+        (JSC::StringSourceProvider::StringSourceProvider):
+
 2015-12-23  Filip Pizlo  <fpi...@apple.com>
 
         FTL B3 should be able to run crypto-sha1 in eager mode

Modified: trunk/Source/_javascript_Core/parser/SourceProvider.h (194408 => 194409)

--- trunk/Source/_javascript_Core/parser/SourceProvider.h	2015-12-24 01:36:43 UTC (rev 194408)
+++ trunk/Source/_javascript_Core/parser/SourceProvider.h	2015-12-24 02:17:03 UTC (rev 194409)
@@ -90,22 +90,22 @@
         
         unsigned hash() const override
         {
-            return m_source.impl()->hash();
+            return m_source.get().hash();
         }
 
         virtual StringView source() const override
         {
-            return m_source;
+            return m_source.get();
         }
 
     private:
         StringSourceProvider(const String& source, const String& url, const TextPosition& startPosition)
             : SourceProvider(url, startPosition)
-            , m_source(source)
+            , m_source(source.isNull() ? *StringImpl::empty() : *source.impl())
         {
         }
 
-        String m_source;
+        Ref<StringImpl> m_source;
     };
     
 #if ENABLE(WEBASSEMBLY)

_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes