Changeset 30235 in webkit for trunk/JavaScriptCore

Timestamp:

Feb 14, 2008, 3:29:51 PM (17 years ago)

Author:

[email protected]

Message:

JavaScriptCore:

Reviewed by Sam Weinig.

Fixed <rdar://problem/5737835> nee ​http://bugs.webkit.org/show_bug.cgi?id=17329
Crash in JSGlobalObject::popActivation when inserting hyperlink in Wordpress (17329)

Don't reset the "activations" stack in JSGlobalObject::reset, since we
might be executing a script during the call to reset, and the script
needs to safely run to completion.

Instead, initialize the "activations" stack when the global object is
created, and subsequently rely on pushing and popping during normal
execution to maintain the stack's state.

• kjs/JSGlobalObject.cpp: (KJS::JSGlobalObject::init): (KJS::JSGlobalObject::reset):

LayoutTests:

Reviewed by Sam Weinig.

Layout test for <rdar://problem/5737835> nee ​http://bugs.webkit.org/show_bug.cgi?id=17329
Crash in JSGlobalObject::popActivation when inserting hyperlink in Wordpress (17329)

• fast/dom/javascript-url-crash-function.html: Added.
• fast/dom/javascript-url-crash-function-expected.txt: Added.
• fast/dom/resources/javascript-url-crash-function-iframe.html: Added.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• kjs/JSGlobalObject.cpp (modified) (3 diffs)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-02-14  Geoffrey Garen  <[email protected]>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/5737835> nee http://bugs.webkit.org/show_bug.cgi?id=17329
+        Crash in JSGlobalObject::popActivation when inserting hyperlink in Wordpress (17329)
+        
+        Don't reset the "activations" stack in JSGlobalObject::reset, since we
+        might be executing a script during the call to reset, and the script
+        needs to safely run to completion.
+        
+        Instead, initialize the "activations" stack when the global object is
+        created, and subsequently rely on pushing and popping during normal
+        execution to maintain the stack's state.
+        
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::init):
+        (KJS::JSGlobalObject::reset):
+
 2008-02-13  Bernhard Rosenkraenzer  <[email protected]>
 

trunk/JavaScriptCore/kjs/JSGlobalObject.cpp

@@ -140 +140 @@
     d()->debugger = 0;
     
-    d()->activations = 0;
-    
+    ActivationStackNode* newStackNode = new ActivationStackNode;
+    newStackNode->prev = 0;    
+    d()->activations = newStackNode;
+    d()->activationCount = 0;
+
     reset(prototype());
 }
@@ -215 +218 @@
 
     ExecState* exec = &d()->globalExec;
-
-    deleteActivationStack();
-    ActivationStackNode* newStackNode = new ActivationStackNode;
-    newStackNode->prev = 0;    
-    d()->activations = newStackNode;
-    d()->activationCount = 0;
 
     // Prototypes
@@ -531 +528 @@
     if (!d()->activationCount) {
         ActivationStackNode* prev = d()->activations->prev;
+        ASSERT(prev);
         delete d()->activations;
         d()->activations = prev;