Attachment #200310 for bug #113434

View Details Raw Unified Return to Bug 113434

| Differences between



2013-05-02  Allan Sandfeld Jensen  <allan.jensen@digia.com>

        Crash when calling QWebFrame::evaluateJavaScript
        https://bugs.webkit.org/show_bug.cgi?id=113434

        Reviewed by NOBODY (OOPS!).

        We must take the JS API lock before accessing internal JS methods.

        * bridge/qt/qt_runtime.cpp:
        (JSC::Bindings::unwrapBoxedPrimitive):
        (JSC::Bindings::getGregorianDateTimeUTC):
        (JSC::Bindings::convertQVariantToValue):

2013-05-01  Enrica Casucci  <enrica@apple.com>

        text-combine: horizontal does not work properly for some fonts.

Lines 21-26 a/Source/WebCore/bridge/qt/qt_runtime.cpp_sec1
- a/Source/WebCore/bridge/qt/qt_runtime.cpp -1 / +8 lines
21	#include "qt_runtime.h"	21	#include "qt_runtime.h"
22		22
23	#include "APICast.h"	23	#include "APICast.h"
		24	#include "APIShims.h"
24	#include "BooleanObject.h"	25	#include "BooleanObject.h"
25	#include "DateInstance.h"	26	#include "DateInstance.h"
26	#include "DatePrototype.h"	27	#include "DatePrototype.h"
Lines 199-206 static QString toString(JSStringRef stringRef) a/Source/WebCore/bridge/qt/qt_runtime.cpp_sec2
199		200
200	static JSValueRef unwrapBoxedPrimitive(JSContextRef context, JSValueRef value, JSObjectRef obj)	201	static JSValueRef unwrapBoxedPrimitive(JSContextRef context, JSValueRef value, JSObjectRef obj)
201	{	202	{
202	JSObject* object = toJS(obj);
203	ExecState* exec = toJS(context);	203	ExecState* exec = toJS(context);
		204	APIEntryShim entryShim(exec);
		205	JSObject* object = toJS(obj);
204	if (object->inherits(&NumberObject::s_info))	206	if (object->inherits(&NumberObject::s_info))
205	return toRef(exec, jsNumber(object->toNumber(exec)));	207	return toRef(exec, jsNumber(object->toNumber(exec)));
206	if (object->inherits(&StringObject::s_info))	208	if (object->inherits(&StringObject::s_info))
Lines 281-286 static QString toQString(JSContextRef context, JSValueRef value) a/Source/WebCore/bridge/qt/qt_runtime.cpp_sec3
281	static void getGregorianDateTimeUTC(JSContextRef context, JSRealType type, JSValueRef value, JSObjectRef object, JSValueRef* exception, GregorianDateTime* gdt)	283	static void getGregorianDateTimeUTC(JSContextRef context, JSRealType type, JSValueRef value, JSObjectRef object, JSValueRef* exception, GregorianDateTime* gdt)
282	{	284	{
283	ExecState* exec = toJS(context);	285	ExecState* exec = toJS(context);
		286	APIEntryShim entryShim(exec);
284	if (type == Date) {	287	if (type == Date) {
285	JSObject* jsObject = toJS(object);	288	JSObject* jsObject = toJS(object);
286	DateInstance* date = asDateInstance(jsObject);	289	DateInstance* date = asDateInstance(jsObject);
Lines 729-734 JSValueRef convertQVariantToValue(JSContextRef context, PassRefPtr<RootObject> r a/Source/WebCore/bridge/qt/qt_runtime.cpp_sec4
729	WTF::RefPtr<WTF::Uint8ClampedArray> wtfByteArray = WTF::Uint8ClampedArray::createUninitialized(qtByteArray.length());	732	WTF::RefPtr<WTF::Uint8ClampedArray> wtfByteArray = WTF::Uint8ClampedArray::createUninitialized(qtByteArray.length());
730	memcpy(wtfByteArray->data(), qtByteArray.constData(), qtByteArray.length());	733	memcpy(wtfByteArray->data(), qtByteArray.constData(), qtByteArray.length());
731	ExecState* exec = toJS(context);	734	ExecState* exec = toJS(context);
		735	APIEntryShim entryShim(exec);
732	return toRef(exec, toJS(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), wtfByteArray.get()));	736	return toRef(exec, toJS(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), wtfByteArray.get()));
733	}	737	}
734		738
Lines 737-742 JSValueRef convertQVariantToValue(JSContextRef context, PassRefPtr<RootObject> r a/Source/WebCore/bridge/qt/qt_runtime.cpp_sec5
737	if (!obj)	741	if (!obj)
738	return JSValueMakeNull(context);	742	return JSValueMakeNull(context);
739	ExecState* exec = toJS(context);	743	ExecState* exec = toJS(context);
		744	APIEntryShim entryShim(exec);
740	return toRef(exec, QtInstance::getQtInstance(obj, root, QtInstance::QtOwnership)->createRuntimeObject(exec));	745	return toRef(exec, QtInstance::getQtInstance(obj, root, QtInstance::QtOwnership)->createRuntimeObject(exec));
741	}	746	}
742		747
Lines 751-756 JSValueRef convertQVariantToValue(JSContextRef context, PassRefPtr<RootObject> r a/Source/WebCore/bridge/qt/qt_runtime.cpp_sec6
751	if (!document)	756	if (!document)
752	return JSValueMakeUndefined(context);	757	return JSValueMakeUndefined(context);
753	ExecState* exec = toJS(context);	758	ExecState* exec = toJS(context);
		759	APIEntryShim entryShim(exec);
754	return toRef(exec, customRuntimeConversions()->value(type).toJSValueFunc(exec, toJSDOMGlobalObject(document, exec), variant));	760	return toRef(exec, customRuntimeConversions()->value(type).toJSValueFunc(exec, toJSDOMGlobalObject(document, exec), variant));
755	}	761	}
756		762
Lines 800-805 JSValueRef convertQVariantToValue(JSContextRef context, PassRefPtr<RootObject> r a/Source/WebCore/bridge/qt/qt_runtime.cpp_sec7
800	QObjectList ol = variant.value<QObjectList>();	806	QObjectList ol = variant.value<QObjectList>();
801	JSObjectRef array = JSObjectMakeArray(context, 0, 0, exception);	807	JSObjectRef array = JSObjectMakeArray(context, 0, 0, exception);
802	ExecState* exec = toJS(context);	808	ExecState* exec = toJS(context);
		809	APIEntryShim entryShim(exec);
803	for (int i = 0; i < ol.count(); ++i) {	810	for (int i = 0; i < ol.count(); ++i) {
804	JSValueRef jsObject = toRef(exec, QtInstance::getQtInstance(ol.at(i), root, QtInstance::QtOwnership)->createRuntimeObject(exec));	811	JSValueRef jsObject = toRef(exec, QtInstance::getQtInstance(ol.at(i), root, QtInstance::QtOwnership)->createRuntimeObject(exec));
805	JSObjectSetPropertyAtIndex(context, array, i, jsObject, /ignored exception/0);	812	JSObjectSetPropertyAtIndex(context, array, i, jsObject, /ignored exception/0);

Return to Bug 113434

Lines 1-3 a/Source/WebCore/ChangeLog_sec1
- a/Source/WebCore/ChangeLog +14 lines
		1	2013-05-02 Allan Sandfeld Jensen <allan.jensen@digia.com>
		2
		3	Crash when calling QWebFrame::evaluateJavaScript
		4	https://bugs.webkit.org/show_bug.cgi?id=113434
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	We must take the JS API lock before accessing internal JS methods.
		9
		10	* bridge/qt/qt_runtime.cpp:
		11	(JSC::Bindings::unwrapBoxedPrimitive):
		12	(JSC::Bindings::getGregorianDateTimeUTC):
		13	(JSC::Bindings::convertQVariantToValue):
		14
1	2013-05-01 Enrica Casucci <enrica@apple.com>	15	2013-05-01 Enrica Casucci <enrica@apple.com>
2		16
3	text-combine: horizontal does not work properly for some fonts.	17	text-combine: horizontal does not work properly for some fonts.