WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
[patch]
Patch
jsc-jsdictionary-array.patch (text/plain), 13.86 KB, created by
Michael Pruett
on 2012-12-05 19:03:29 PST
(
hide
)
Description:
Patch
Filename:
MIME Type:
Creator:
Michael Pruett
Created:
2012-12-05 19:03:29 PST
Size:
13.86 KB
patch
obsolete
>From: Michael Pruett <michael@68k.org> >Date: Wed, 5 Dec 2012 18:56:39 -0800 >Subject: [JSC] Check whether property is an array before attempting conversion to array in JSDictionary > >--- > Source/WebCore/ChangeLog | 21 +++++++ > Source/WebCore/bindings/js/JSDictionary.cpp | 90 ++++++++++++++++++--------- > Source/WebCore/bindings/js/JSDictionary.h | 59 ++++++++++-------- > 3 files changed, 113 insertions(+), 57 deletions(-) > >diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog >index 77cba8f..2bfb4ba 100644 >--- a/Source/WebCore/ChangeLog >+++ b/Source/WebCore/ChangeLog >@@ -1,3 +1,24 @@ >+2012-12-05 Michael Pruett <michael@68k.org> >+ >+ [JSC] Check whether property is an array before attempting conversion to array in JSDictionary >+ https://bugs.webkit.org/show_bug.cgi?id=96614 >+ >+ Reviewed by NOBODY (OOPS!). >+ >+ JSDictionary should check whether the property being accessed in get() >+ is an array before attempting to convert the value to an array. >+ >+ Previously calling get() with a result type of Vector<String> when >+ the named property could not be converted to an array would generate >+ an exception. >+ >+ Tests: storage/indexeddb/* >+ >+ * bindings/js/JSDictionary.cpp: >+ (WebCore::JSDictionary::convertValue): >+ * bindings/js/JSDictionary.h: >+ (WebCore::JSDictionary::tryGetPropertyAndResult): >+ > 2012-12-05 Robert Hogan <robert@webkit.org> > > REGRESSION(r126683): Table cell are getting borders when the style doesn't mention any >diff --git a/Source/WebCore/bindings/js/JSDictionary.cpp b/Source/WebCore/bindings/js/JSDictionary.cpp >index 4e2dd4c..d939b02 100644 >--- a/Source/WebCore/bindings/js/JSDictionary.cpp >+++ b/Source/WebCore/bindings/js/JSDictionary.cpp >@@ -68,152 +68,182 @@ JSDictionary::GetPropertyResult JSDictionary::tryGetProperty(const char* propert > return PropertyFound; > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, bool& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, bool& result) > { > result = value.toBoolean(exec); >+ return true; > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, int& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, int& result) > { > result = value.toInt32(exec); >+ return true; > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned& result) > { > result = value.toUInt32(exec); >+ return true; > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned short& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned short& result) > { > result = static_cast<unsigned short>(value.toUInt32(exec)); >+ return true; > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned long& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned long& result) > { > result = static_cast<unsigned long>(value.toUInt32(exec)); >+ return true; > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned long long& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, unsigned long long& result) > { > double d = value.toNumber(exec); > doubleToInteger(d, result); >+ return true; > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, double& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, double& result) > { > result = value.toNumber(exec); >+ return true; > } > >-void JSDictionary::convertValue(JSC::ExecState* exec, JSC::JSValue value, Dictionary& result) >+bool JSDictionary::convertValue(JSC::ExecState* exec, JSC::JSValue value, Dictionary& result) > { > result = Dictionary(exec, value); >+ return true; > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, String& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, String& result) > { > result = value.toString(exec)->value(exec); >+ return !exec->hadException(); > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, Vector<String>& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, Vector<String>& result) > { > if (value.isUndefinedOrNull()) >- return; >+ return false; >+ >+ if (!value.isObject()) >+ return false; >+ JSObject* object = asObject(value); >+ if (!isJSArray(object) && !object->inherits(&JSArray::s_info)) >+ return false; > > unsigned length = 0; >- JSObject* object = toJSSequence(exec, value, length); >+ object = toJSSequence(exec, value, length); > if (exec->hadException()) >- return; >+ return false; > > for (unsigned i = 0 ; i < length; ++i) { > JSValue itemValue = object->get(exec, i); > if (exec->hadException()) >- return; >+ return false; > result.append(itemValue.toString(exec)->value(exec)); > } >+ >+ return !exec->hadException(); > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, ScriptValue& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, ScriptValue& result) > { > result = ScriptValue(exec->globalData(), value); >+ return true; > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, RefPtr<SerializedScriptValue>& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, RefPtr<SerializedScriptValue>& result) > { > result = SerializedScriptValue::create(exec, value, 0, 0); >+ return !exec->hadException(); > } > >-void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<DOMWindow>& result) >+bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<DOMWindow>& result) > { > result = toDOMWindow(value); >+ return true; > } > >-void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<EventTarget>& result) >+bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<EventTarget>& result) > { > result = toEventTarget(value); >+ return true; > } > >-void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Node>& result) >+bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Node>& result) > { > result = toNode(value); >+ return true; > } > >-void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Storage>& result) >+bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Storage>& result) > { > result = toStorage(value); >+ return true; > } > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, MessagePortArray& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, MessagePortArray& result) > { > ArrayBufferArray arrayBuffers; > fillMessagePortArray(exec, value, result, arrayBuffers); >+ return true; > } > > #if ENABLE(VIDEO_TRACK) >-void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<TrackBase>& result) >+bool JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<TrackBase>& result) > { > result = toTrack(value); >+ return true; > } > #endif > > #if ENABLE(MUTATION_OBSERVERS) || ENABLE(WEB_INTENTS) >-void JSDictionary::convertValue(ExecState* exec, JSValue value, HashSet<AtomicString>& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, HashSet<AtomicString>& result) > { > result.clear(); > > if (value.isUndefinedOrNull()) >- return; >+ return false; > > unsigned length = 0; > JSObject* object = toJSSequence(exec, value, length); > if (exec->hadException()) >- return; >+ return false; > > for (unsigned i = 0 ; i < length; ++i) { > JSValue itemValue = object->get(exec, i); > if (exec->hadException()) >- return; >+ return false; > result.add(itemValue.toString(exec)->value(exec)); > } >+ >+ return !exec->hadException(); > } > #endif > >-void JSDictionary::convertValue(ExecState* exec, JSValue value, ArrayValue& result) >+bool JSDictionary::convertValue(ExecState* exec, JSValue value, ArrayValue& result) > { > if (value.isUndefinedOrNull()) >- return; >+ return false; > > result = ArrayValue(exec, value); >+ return true; > } > >-void JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue value, RefPtr<Uint8Array>& result) >+bool JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue value, RefPtr<Uint8Array>& result) > { > result = toUint8Array(value); >+ return true; > } > > #if ENABLE(ENCRYPTED_MEDIA) >-void JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue value, RefPtr<MediaKeyError>& result) >+bool JSDictionary::convertValue(JSC::ExecState*, JSC::JSValue value, RefPtr<MediaKeyError>& result) > { > result = toMediaKeyError(value); >+ return true; > } > #endif > >diff --git a/Source/WebCore/bindings/js/JSDictionary.h b/Source/WebCore/bindings/js/JSDictionary.h >index e17f868..e96ba8c 100644 >--- a/Source/WebCore/bindings/js/JSDictionary.h >+++ b/Source/WebCore/bindings/js/JSDictionary.h >@@ -81,40 +81,41 @@ private: > enum GetPropertyResult { > ExceptionThrown, > NoPropertyFound, >- PropertyFound >+ PropertyFound, >+ ConversionFailed > }; > > template <typename T, typename Result> > GetPropertyResult tryGetPropertyAndResult(const char* propertyName, T* context, void (*setter)(T* context, const Result&)) const; > GetPropertyResult tryGetProperty(const char* propertyName, JSC::JSValue&) const; > >- static void convertValue(JSC::ExecState*, JSC::JSValue, bool& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, int& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, unsigned& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, unsigned short& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, unsigned long& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, unsigned long long& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, double& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, Dictionary& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, String& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, ScriptValue& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, Vector<String>& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<SerializedScriptValue>& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<DOMWindow>& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<EventTarget>& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Node>& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Storage>& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, MessagePortArray& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, bool& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, int& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned short& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned long& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, unsigned long long& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, double& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, Dictionary& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, String& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, ScriptValue& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, Vector<String>& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<SerializedScriptValue>& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<DOMWindow>& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<EventTarget>& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Node>& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Storage>& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, MessagePortArray& result); > #if ENABLE(VIDEO_TRACK) >- static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<TrackBase>& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<TrackBase>& result); > #endif > #if ENABLE(MUTATION_OBSERVERS) || ENABLE(WEB_INTENTS) >- static void convertValue(JSC::ExecState*, JSC::JSValue, HashSet<AtomicString>& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, HashSet<AtomicString>& result); > #endif >- static void convertValue(JSC::ExecState*, JSC::JSValue, ArrayValue& result); >- static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Uint8Array>& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, ArrayValue& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<Uint8Array>& result); > #if ENABLE(ENCRYPTED_MEDIA) >- static void convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<MediaKeyError>& result); >+ static bool convertValue(JSC::ExecState*, JSC::JSValue, RefPtr<MediaKeyError>& result); > #endif > > JSC::ExecState* m_exec; >@@ -149,16 +150,20 @@ JSDictionary::GetPropertyResult JSDictionary::tryGetPropertyAndResult(const char > return getPropertyResult; > case PropertyFound: { > Result result; >- convertValue(m_exec, value, result); >- >- if (m_exec->hadException()) >- return ExceptionThrown; >+ if (!convertValue(m_exec, value, result)) { >+ if (m_exec->hadException()) >+ return ExceptionThrown; >+ return ConversionFailed; >+ } > > setter(context, result); > break; > } > case NoPropertyFound: > break; >+ case ConversionFailed: >+ ASSERT_NOT_REACHED(); >+ break; > } > > return getPropertyResult; >-- >1.7.9.5 >
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=177907">View the attachment on a separate page</a>.</b>
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 96614
:
163809
|
164065
|
173253
|
173261
|
173304
|
173306
|
173540
|
177806
|
177865
|
177906
|
177907
|
178728
|
179040
|
179158
|
179326
|
179456