Attachment #177906 for bug #96614

View Details Raw Unified Return to Bug 96614

| Differences between



2012-12-05  Michael Pruett  <michael@68k.org>

        [JSC] Check whether property is an array before attempting conversion to array in JSDictionary
        https://bugs.webkit.org/show_bug.cgi?id=96614

        Reviewed by NOBODY (OOPS!).

        JSDictionary should check whether the property being accessed in get()
        is an array before attempting to convert the value to an array.

        Previously calling get() with a result type of Vector<String> when
        the named property could not be converted to an array would generate
        an exception.

        Tests: storage/indexeddb/*

        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDictionary.h:
        (WebCore::JSDictionary::tryGetPropertyAndResult):

2012-12-05  Robert Hogan  <robert@webkit.org>

        REGRESSION(r126683): Table cell are getting borders when the style doesn't mention any



    return PropertyFound;
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, bool& result)
{
    result = value.toBoolean(exec);
    return true;
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, int& result)
{
    result = value.toInt32(exec);
    return true;
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned& result)
{
    result = value.toUInt32(exec);
    return true;
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned short& result)
{
    result = static_cast<unsigned short>(value.toUInt32(exec));
    return true;
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned long& result)
{
    result = static_cast<unsigned long>(value.toUInt32(exec));
    return true;
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned long long& result)
{
    double d = value.toNumber(exec);
    doubleToInteger(d, result);
    return true;
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, double& result)
{
    result = value.toNumber(exec);
    return true;
}

bool JSDictionary::convertValue(JSC::ExecState* exec, JSC::JSValue value, Dictionary& result)
{
    result = Dictionary(exec, value);
    return true;
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, String& result)
{
    result = value.toString(exec)->value(exec);
    return !exec->hadException();
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, Vector<String>& result)
{
    if (value.isUndefinedOrNull())
        return false;

    if (!value.isObject())
        return false;
    JSObject* object = asObject(value);
    if (!isJSArray(object) && !object->inherits(&JSArray::s_info))
        return false;

    unsigned length = 0;
    object = toJSSequence(exec, value, length);
    if (exec->hadException())
        return false;

    for (unsigned i = 0 ; i < length; ++i) {
        JSValue itemValue = object->get(exec, i);
        if (exec->hadException())
            return false;
        result.append(itemValue.toString(exec)->value(exec));
    }

    return !exec->hadException();
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, ScriptValue& result)
{
    result = ScriptValue(exec->globalData(), value);
    return true;
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, RefPtr<SerializedScriptValue>& result)
{
    result = SerializedScriptValue::create(exec, value, 0, 0);
    return !exec->hadException();
}

bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<DOMWindow>& result)
{
    result = toDOMWindow(value);
    return true;
}

bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<EventTarget>& result)
{
    result = toEventTarget(value);
    return true;
}

bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Node>& result)
{
    result = toNode(value);
    return true;
}

bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Storage>& result)
{
    result = toStorage(value);
    return true;
}

bool JSDictionary::convertValue(ExecState* exec, JSValue value, MessagePortArray& result)
{
    ArrayBufferArray arrayBuffers;
    fillMessagePortArray(exec, value, result, arrayBuffers);
    return true;
}

#if ENABLE(VIDEO_TRACK)
bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<TrackBase>& result)
{
    result = toTrack(value);
    return true;
}
#endif

#if ENABLE(MUTATION_OBSERVERS) || ENABLE(WEB_INTENTS)
bool JSDictionary::convertValue(ExecState* exec, JSValue value, HashSet<AtomicString>& result)
{
    result.clear();

    if (value.isUndefinedOrNull())
        return false;

    unsigned length = 0;
    JSObject* object = toJSSequence(exec, value, length);
    if (exec->hadException())
        return false;

    for (unsigned i = 0 ; i < length; ++i) {
        JSValue itemValue = object->get(exec, i);
        if (exec->hadException())
            return false;
        result.add(itemValue.toString(exec)->value(exec));
    }

    return !exec->hadException();
}
#endif

bool JSDictionary::convertValue(ExecState* exec, JSValue value, ArrayValue& result)
{
    if (value.isUndefinedOrNull())
        return false;

    result = ArrayValue(exec, value);
    return true;
}

bool JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue value, RefPtr<Uint8Array>& result)
{
    result = toUint8Array(value);
    return true;
}

#if ENABLE(ENCRYPTED_MEDIA)
bool JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue value, RefPtr<MediaKeyError>& result)
{
    result = toMediaKeyError(value);
    return true;
}
#endif




    enum GetPropertyResult {
        ExceptionThrown,
        NoPropertyFound,
        PropertyFound,
        ConversionFailed
    };
    
    template <typename T, typename Result>
    GetPropertyResult tryGetPropertyAndResult(const char* propertyName, T* context, void (*setter)(T* context, const Result&)) const;
    GetPropertyResult tryGetProperty(const char* propertyName, JSC::JSValue&) const;

    static bool convertValue(JSC::ExecState*, JSC::JSValue, bool& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, int& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned short& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned long& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned long long& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, double& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, Dictionary& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, String& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, ScriptValue& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, Vector<String>& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<SerializedScriptValue>& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<DOMWindow>& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<EventTarget>& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Node>& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Storage>& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, MessagePortArray& result);
#if ENABLE(VIDEO_TRACK)
    static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<TrackBase>& result);
#endif
#if ENABLE(MUTATION_OBSERVERS) || ENABLE(WEB_INTENTS)
    static bool convertValue(JSC::ExecState*, JSC::JSValue, HashSet<AtomicString>& result);
#endif
    static bool convertValue(JSC::ExecState*, JSC::JSValue, ArrayValue& result);
    static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Uint8Array>& result);
#if ENABLE(ENCRYPTED_MEDIA)
    static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<MediaKeyError>& result);
#endif

    JSC::ExecState* m_exec;

        return getPropertyResult;
    case PropertyFound: {
        Result result;
        if (!convertValue(m_exec, value, result)) {
            if (m_exec->hadException())
                return ExceptionThrown;
            return ConversionFailed;
        }

        setter(context, result);
        break;
    }
    case NoPropertyFound:
    case ConversionFailed:
        break;
    }

- 

Return to Bug 96614

Lines 68-219 JSDictionary::GetPropertyResult JSDictionary::tryGetProperty(const char* propert a/Source/WebCore/bindings/js/JSDictionary.cpp_sec1
- a/Source/WebCore/bindings/js/JSDictionary.cpp -30 / +60 lines
68	return PropertyFound;	68	return PropertyFound;
69	}	69	}
70		70
71	void JSDictionary::convertValue(ExecState* exec, JSValue value, bool& result)	71	bool JSDictionary::convertValue(ExecState* exec, JSValue value, bool& result)
72	{	72	{
73	result = value.toBoolean(exec);	73	result = value.toBoolean(exec);
		74	return true;
74	}	75	}
75		76
76	void JSDictionary::convertValue(ExecState* exec, JSValue value, int& result)	77	bool JSDictionary::convertValue(ExecState* exec, JSValue value, int& result)
77	{	78	{
78	result = value.toInt32(exec);	79	result = value.toInt32(exec);
		80	return true;
79	}	81	}
80		82
81	void JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned& result)	83	bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned& result)
82	{	84	{
83	result = value.toUInt32(exec);	85	result = value.toUInt32(exec);
		86	return true;
84	}	87	}
85		88
86	void JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned short& result)	89	bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned short& result)
87	{	90	{
88	result = static_cast<unsigned short>(value.toUInt32(exec));	91	result = static_cast<unsigned short>(value.toUInt32(exec));
		92	return true;
89	}	93	}
90		94
91	void JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned long& result)	95	bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned long& result)
92	{	96	{
93	result = static_cast<unsigned long>(value.toUInt32(exec));	97	result = static_cast<unsigned long>(value.toUInt32(exec));
		98	return true;
94	}	99	}
95		100
96	void JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned long long& result)	101	bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned long long& result)
97	{	102	{
98	double d = value.toNumber(exec);	103	double d = value.toNumber(exec);
99	doubleToInteger(d, result);	104	doubleToInteger(d, result);
		105	return true;
100	}	106	}
101		107
102	void JSDictionary::convertValue(ExecState* exec, JSValue value, double& result)	108	bool JSDictionary::convertValue(ExecState* exec, JSValue value, double& result)
103	{	109	{
104	result = value.toNumber(exec);	110	result = value.toNumber(exec);
		111	return true;
105	}	112	}
106		113
107	void JSDictionary::convertValue(JSC::ExecState* exec, JSC::JSValue value, Dictionary& result)	114	bool JSDictionary::convertValue(JSC::ExecState* exec, JSC::JSValue value, Dictionary& result)
108	{	115	{
109	result = Dictionary(exec, value);	116	result = Dictionary(exec, value);
		117	return true;
110	}	118	}
111		119
112	void JSDictionary::convertValue(ExecState* exec, JSValue value, String& result)	120	bool JSDictionary::convertValue(ExecState* exec, JSValue value, String& result)
113	{	121	{
114	result = value.toString(exec)->value(exec);	122	result = value.toString(exec)->value(exec);
		123	return !exec->hadException();
115	}	124	}
116		125
117	void JSDictionary::convertValue(ExecState* exec, JSValue value, Vector<String>& result)	126	bool JSDictionary::convertValue(ExecState* exec, JSValue value, Vector<String>& result)
118	{	127	{
119	if (value.isUndefinedOrNull())	128	if (value.isUndefinedOrNull())
120	return;	129	return false;
		130
		131	if (!value.isObject())
		132	return false;
		133	JSObject* object = asObject(value);
		134	if (!isJSArray(object) && !object->inherits(&JSArray::s_info))
		135	return false;
121		136
122	unsigned length = 0;	137	unsigned length = 0;
123	JSObject* object = toJSSequence(exec, value, length);	138	object = toJSSequence(exec, value, length);
124	if (exec->hadException())	139	if (exec->hadException())
125	return;	140	return false;
126		141
127	for (unsigned i = 0 ; i < length; ++i) {	142	for (unsigned i = 0 ; i < length; ++i) {
128	JSValue itemValue = object->get(exec, i);	143	JSValue itemValue = object->get(exec, i);
129	if (exec->hadException())	144	if (exec->hadException())
130	return;	145	return false;
131	result.append(itemValue.toString(exec)->value(exec));	146	result.append(itemValue.toString(exec)->value(exec));
132	}	147	}
		148
		149	return !exec->hadException();
133	}	150	}
134		151
135	void JSDictionary::convertValue(ExecState* exec, JSValue value, ScriptValue& result)	152	bool JSDictionary::convertValue(ExecState* exec, JSValue value, ScriptValue& result)
136	{	153	{
137	result = ScriptValue(exec->globalData(), value);	154	result = ScriptValue(exec->globalData(), value);
		155	return true;
138	}	156	}
139		157
140	void JSDictionary::convertValue(ExecState* exec, JSValue value, RefPtr<SerializedScriptValue>& result)	158	bool JSDictionary::convertValue(ExecState* exec, JSValue value, RefPtr<SerializedScriptValue>& result)
141	{	159	{
142	result = SerializedScriptValue::create(exec, value, 0, 0);	160	result = SerializedScriptValue::create(exec, value, 0, 0);
		161	return !exec->hadException();
143	}	162	}
144		163
145	void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<DOMWindow>& result)	164	bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<DOMWindow>& result)
146	{	165	{
147	result = toDOMWindow(value);	166	result = toDOMWindow(value);
		167	return true;
148	}	168	}
149		169
150	void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<EventTarget>& result)	170	bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<EventTarget>& result)
151	{	171	{
152	result = toEventTarget(value);	172	result = toEventTarget(value);
		173	return true;
153	}	174	}
154		175
155	void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Node>& result)	176	bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Node>& result)
156	{	177	{
157	result = toNode(value);	178	result = toNode(value);
		179	return true;
158	}	180	}
159		181
160	void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Storage>& result)	182	bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Storage>& result)
161	{	183	{
162	result = toStorage(value);	184	result = toStorage(value);
		185	return true;
163	}	186	}
164		187
165	void JSDictionary::convertValue(ExecState* exec, JSValue value, MessagePortArray& result)	188	bool JSDictionary::convertValue(ExecState* exec, JSValue value, MessagePortArray& result)
166	{	189	{
167	ArrayBufferArray arrayBuffers;	190	ArrayBufferArray arrayBuffers;
168	fillMessagePortArray(exec, value, result, arrayBuffers);	191	fillMessagePortArray(exec, value, result, arrayBuffers);
		192	return true;
169	}	193	}
170		194
171	#if ENABLE(VIDEO_TRACK)	195	#if ENABLE(VIDEO_TRACK)
172	void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<TrackBase>& result)	196	bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<TrackBase>& result)
173	{	197	{
174	result = toTrack(value);	198	result = toTrack(value);
		199	return true;
175	}	200	}
176	#endif	201	#endif
177		202
178	#if ENABLE(MUTATION_OBSERVERS) \|\| ENABLE(WEB_INTENTS)	203	#if ENABLE(MUTATION_OBSERVERS) \|\| ENABLE(WEB_INTENTS)
179	void JSDictionary::convertValue(ExecState* exec, JSValue value, HashSet<AtomicString>& result)	204	bool JSDictionary::convertValue(ExecState* exec, JSValue value, HashSet<AtomicString>& result)
180	{	205	{
181	result.clear();	206	result.clear();
182		207
183	if (value.isUndefinedOrNull())	208	if (value.isUndefinedOrNull())
184	return;	209	return false;
185		210
186	unsigned length = 0;	211	unsigned length = 0;
187	JSObject* object = toJSSequence(exec, value, length);	212	JSObject* object = toJSSequence(exec, value, length);
188	if (exec->hadException())	213	if (exec->hadException())
189	return;	214	return false;
190		215
191	for (unsigned i = 0 ; i < length; ++i) {	216	for (unsigned i = 0 ; i < length; ++i) {
192	JSValue itemValue = object->get(exec, i);	217	JSValue itemValue = object->get(exec, i);
193	if (exec->hadException())	218	if (exec->hadException())
194	return;	219	return false;
195	result.add(itemValue.toString(exec)->value(exec));	220	result.add(itemValue.toString(exec)->value(exec));
196	}	221	}
		222
		223	return !exec->hadException();
197	}	224	}
198	#endif	225	#endif
199		226
200	void JSDictionary::convertValue(ExecState* exec, JSValue value, ArrayValue& result)	227	bool JSDictionary::convertValue(ExecState* exec, JSValue value, ArrayValue& result)
201	{	228	{
202	if (value.isUndefinedOrNull())	229	if (value.isUndefinedOrNull())
203	return;	230	return false;
204		231
205	result = ArrayValue(exec, value);	232	result = ArrayValue(exec, value);
		233	return true;
206	}	234	}
207		235
208	void JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue value, RefPtr<Uint8Array>& result)	236	bool JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue value, RefPtr<Uint8Array>& result)
209	{	237	{
210	result = toUint8Array(value);	238	result = toUint8Array(value);
		239	return true;
211	}	240	}
212		241
213	#if ENABLE(ENCRYPTED_MEDIA)	242	#if ENABLE(ENCRYPTED_MEDIA)
214	void JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue value, RefPtr<MediaKeyError>& result)	243	bool JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue value, RefPtr<MediaKeyError>& result)
215	{	244	{
216	result = toMediaKeyError(value);	245	result = toMediaKeyError(value);
		246	return true;
217	}	247	}
218	#endif	248	#endif
219		249

Lines 81-120 private: a/Source/WebCore/bindings/js/JSDictionary.h_sec1
- a/Source/WebCore/bindings/js/JSDictionary.h -28 / +30 lines
81	enum GetPropertyResult {	81	enum GetPropertyResult {
82	ExceptionThrown,	82	ExceptionThrown,
83	NoPropertyFound,	83	NoPropertyFound,
84	PropertyFound	84	PropertyFound,
		85	ConversionFailed
85	};	86	};
86		87
87	template <typename T, typename Result>	88	template <typename T, typename Result>
88	GetPropertyResult tryGetPropertyAndResult(const char* propertyName, T* context, void (setter)(T context, const Result&)) const;	89	GetPropertyResult tryGetPropertyAndResult(const char* propertyName, T* context, void (setter)(T context, const Result&)) const;
89	GetPropertyResult tryGetProperty(const char* propertyName, JSC::JSValue&) const;	90	GetPropertyResult tryGetProperty(const char* propertyName, JSC::JSValue&) const;
90		91
91	static void convertValue(JSC::ExecState*, JSC::JSValue, bool& result);	92	static bool convertValue(JSC::ExecState*, JSC::JSValue, bool& result);
92	static void convertValue(JSC::ExecState*, JSC::JSValue, int& result);	93	static bool convertValue(JSC::ExecState*, JSC::JSValue, int& result);
93	static void convertValue(JSC::ExecState*, JSC::JSValue, unsigned& result);	94	static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned& result);
94	static void convertValue(JSC::ExecState*, JSC::JSValue, unsigned short& result);	95	static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned short& result);
95	static void convertValue(JSC::ExecState*, JSC::JSValue, unsigned long& result);	96	static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned long& result);
96	static void convertValue(JSC::ExecState*, JSC::JSValue, unsigned long long& result);	97	static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned long long& result);
97	static void convertValue(JSC::ExecState*, JSC::JSValue, double& result);	98	static bool convertValue(JSC::ExecState*, JSC::JSValue, double& result);
98	static void convertValue(JSC::ExecState*, JSC::JSValue, Dictionary& result);	99	static bool convertValue(JSC::ExecState*, JSC::JSValue, Dictionary& result);
99	static void convertValue(JSC::ExecState*, JSC::JSValue, String& result);	100	static bool convertValue(JSC::ExecState*, JSC::JSValue, String& result);
100	static void convertValue(JSC::ExecState*, JSC::JSValue, ScriptValue& result);	101	static bool convertValue(JSC::ExecState*, JSC::JSValue, ScriptValue& result);
101	static void convertValue(JSC::ExecState*, JSC::JSValue, Vector<String>& result);	102	static bool convertValue(JSC::ExecState*, JSC::JSValue, Vector<String>& result);
102	static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<SerializedScriptValue>& result);	103	static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<SerializedScriptValue>& result);
103	static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<DOMWindow>& result);	104	static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<DOMWindow>& result);
104	static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<EventTarget>& result);	105	static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<EventTarget>& result);
105	static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Node>& result);	106	static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Node>& result);
106	static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Storage>& result);	107	static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Storage>& result);
107	static void convertValue(JSC::ExecState*, JSC::JSValue, MessagePortArray& result);	108	static bool convertValue(JSC::ExecState*, JSC::JSValue, MessagePortArray& result);
108	#if ENABLE(VIDEO_TRACK)	109	#if ENABLE(VIDEO_TRACK)
109	static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<TrackBase>& result);	110	static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<TrackBase>& result);
110	#endif	111	#endif
111	#if ENABLE(MUTATION_OBSERVERS) \|\| ENABLE(WEB_INTENTS)	112	#if ENABLE(MUTATION_OBSERVERS) \|\| ENABLE(WEB_INTENTS)
112	static void convertValue(JSC::ExecState*, JSC::JSValue, HashSet<AtomicString>& result);	113	static bool convertValue(JSC::ExecState*, JSC::JSValue, HashSet<AtomicString>& result);
113	#endif	114	#endif
114	static void convertValue(JSC::ExecState*, JSC::JSValue, ArrayValue& result);	115	static bool convertValue(JSC::ExecState*, JSC::JSValue, ArrayValue& result);
115	static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Uint8Array>& result);	116	static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Uint8Array>& result);
116	#if ENABLE(ENCRYPTED_MEDIA)	117	#if ENABLE(ENCRYPTED_MEDIA)
117	static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<MediaKeyError>& result);	118	static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<MediaKeyError>& result);
118	#endif	119	#endif
119		120
120	JSC::ExecState* m_exec;	121	JSC::ExecState* m_exec;
Lines 149-163 JSDictionary::GetPropertyResult JSDictionary::tryGetPropertyAndResult(const char a/Source/WebCore/bindings/js/JSDictionary.h_sec2
149	return getPropertyResult;	150	return getPropertyResult;
150	case PropertyFound: {	151	case PropertyFound: {
151	Result result;	152	Result result;
152	convertValue(m_exec, value, result);	153	if (!convertValue(m_exec, value, result)) {
153		154	if (m_exec->hadException())
154	if (m_exec->hadException())	155	return ExceptionThrown;
155	return ExceptionThrown;	156	return ConversionFailed;
		157	}
156		158
157	setter(context, result);	159	setter(context, result);
158	break;	160	break;
159	}	161	}
160	case NoPropertyFound:	162	case NoPropertyFound:
		163	case ConversionFailed:
161	break;	164	break;
162	}	165	}
163		166
164	-

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +21 lines
		1	2012-12-05 Michael Pruett <michael@68k.org>
		2
		3	[JSC] Check whether property is an array before attempting conversion to array in JSDictionary
		4	https://bugs.webkit.org/show_bug.cgi?id=96614
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	JSDictionary should check whether the property being accessed in get()
		9	is an array before attempting to convert the value to an array.
		10
		11	Previously calling get() with a result type of Vector<String> when
		12	the named property could not be converted to an array would generate
		13	an exception.
		14
		15	Tests: storage/indexeddb/*
		16
		17	* bindings/js/JSDictionary.cpp:
		18	(WebCore::JSDictionary::convertValue):
		19	* bindings/js/JSDictionary.h:
		20	(WebCore::JSDictionary::tryGetPropertyAndResult):
		21
1	2012-12-05 Robert Hogan <robert@webkit.org>	22	2012-12-05 Robert Hogan <robert@webkit.org>
2		23
3	REGRESSION(r126683): Table cell are getting borders when the style doesn't mention any	24	REGRESSION(r126683): Table cell are getting borders when the style doesn't mention any