Changeset 155495 in webkit for trunk/Source/JavaScriptCore/API

Timestamp:

Sep 10, 2013, 6:16:50 PM (12 years ago)

Author:

[email protected]

Message:

WebKit crashes when trying to send a msg via 'today's birthdays' dialogue box on Facebook
​https://bugs.webkit.org/show_bug.cgi?id=120612#add_comment
Patch by Chris Curtis <​[email protected]> on 2013-09-10
Reviewed by Geoffrey Garen.

The codeBlock was assumed to exist when appendSourceToMessage was set.
This was an invalid assumption. I added a check to ensure that there is a
valid codeBlock before accessing it.

• API/tests/testapi.c:

(valueToObjectExceptionCallAsFunction):
(valueToObjectExceptionTest):
(main):

• runtime/VM.cpp:

(JSC::VM::throwException):

File:

• trunk/Source/JavaScriptCore/API/tests/testapi.c (modified) (2 diffs)

trunk/Source/JavaScriptCore/API/tests/testapi.c

@@ -1044 +1044 @@
 }
 
+static JSValueRef valueToObjectExceptionCallAsFunction(JSContextRef ctx, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    UNUSED_PARAM(function);
+    UNUSED_PARAM(thisObject);
+    UNUSED_PARAM(argumentCount);
+    UNUSED_PARAM(arguments);
+    JSValueRef jsUndefined = JSValueMakeUndefined(JSContextGetGlobalContext(ctx));
+    JSValueToObject(JSContextGetGlobalContext(ctx), jsUndefined, exception);
+    
+    return JSValueMakeUndefined(ctx);
+}
+static bool valueToObjectExceptionTest()
+{
+    JSGlobalContextRef testContext;
+    JSClassDefinition globalObjectClassDefinition = kJSClassDefinitionEmpty;
+    globalObjectClassDefinition.initialize = globalObject_initialize;
+    globalObjectClassDefinition.staticValues = globalObject_staticValues;
+    globalObjectClassDefinition.staticFunctions = globalObject_staticFunctions;
+    globalObjectClassDefinition.attributes = kJSClassAttributeNoAutomaticPrototype;
+    JSClassRef globalObjectClass = JSClassCreate(&globalObjectClassDefinition);
+    testContext = JSGlobalContextCreateInGroup(NULL, globalObjectClass);
+    JSObjectRef globalObject = JSContextGetGlobalObject(testContext);
+
+    JSStringRef valueToObject = JSStringCreateWithUTF8CString("valueToObject");
+    JSObjectRef valueToObjectFunction = JSObjectMakeFunctionWithCallback(testContext, valueToObject, valueToObjectExceptionCallAsFunction);
+    JSObjectSetProperty(testContext, globalObject, valueToObject, valueToObjectFunction, kJSPropertyAttributeNone, NULL);
+    JSStringRelease(valueToObject);
+
+    JSStringRef test = JSStringCreateWithUTF8CString("valueToObject();");
+    JSEvaluateScript(testContext, test, NULL, NULL, 1, NULL);
+    
+    JSStringRelease(test);
+    JSClassRelease(globalObjectClass);
+    JSGlobalContextRelease(testContext);
+    
+    return true;
+}
+
 static void checkConstnessInJSObjectNames()
 {
@@ -1976 +2014 @@
         failed = true;
     }
+    if (valueToObjectExceptionTest())
+        printf("PASS: throwException did not crash when handling an error with appendMessageToError set and no codeBlock available.\n");
 
     if (failed) {