Attachment 200894 Details for Bug 113434 – Patch

[patch] Patch

bug-113434-20130507142857.patch (text/plain), 5.06 KB, created by Allan Sandfeld Jensen on 2013-05-07 05:29:51 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Allan Sandfeld Jensen

Created: 2013-05-07 05:29:51 PDT

Size: 5.06 KB

patch

obsolete

>Subversion Revision: 149095
>diff --git a/Source/WebKit/qt/ChangeLog b/Source/WebKit/qt/ChangeLog
>index b576d29246a5a59fd3a524fc779e395c5f322346..d61ca5cc05ea2350ecb9e91a6a08c7cd03b51947 100644
>--- a/Source/WebKit/qt/ChangeLog
>+++ b/Source/WebKit/qt/ChangeLog
>@@ -1,3 +1,18 @@
>+2013-05-07  Allan Sandfeld Jensen  <allan.jensen@digia.com>
>+
>+        Crash when calling QWebFrame::evaluateJavaScript
>+        https://bugs.webkit.org/show_bug.cgi?id=113434
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Ensure we hold the JSLock when converting JSValue to JSValueRef.
>+
>+        * Api/qwebelement.cpp:
>+        (setupScriptContext):
>+        (QWebElement::evaluateJavaScript):
>+        * WebCoreSupport/QWebFrameAdapter.cpp:
>+        (QWebFrameAdapter::evaluateJavaScript):
>+
> 2013-04-23  Allan Sandfeld Jensen  <allan.jensen@digia.com>
> 
>         [Qt][WK1] MemoryCache is not cleaned by default
>diff --git a/Source/WebKit/qt/Api/qwebelement.cpp b/Source/WebKit/qt/Api/qwebelement.cpp
>index 1974d4cce6b84f59048304877ca95c5a1302c3cc..8bd84689c7a0d1a35d41bd289169a713f141f6f4 100644
>--- a/Source/WebKit/qt/Api/qwebelement.cpp
>+++ b/Source/WebKit/qt/Api/qwebelement.cpp
>@@ -45,6 +45,7 @@
> #include "NodeList.h"
> #include "RenderImage.h"
> #include "ScriptController.h"
>+#include "ScriptSourceCode.h"
> #include "ScriptState.h"
> #include "StaticNodeList.h"
> #include "StyleResolver.h"
>@@ -710,7 +711,7 @@ QWebFrame *QWebElement::webFrame() const
>     return frameAdapter->apiHandle();
> }
> 
>-static bool setupScriptContext(WebCore::Element* element, JSC::JSValue& thisValue, ScriptState*& state, ScriptController*& scriptController)
>+static bool setupScriptContext(WebCore::Element* element, ScriptState*& state, ScriptController*& scriptController)
> {
>     if (!element)
>         return false;
>@@ -731,10 +732,6 @@ static bool setupScriptContext(WebCore::Element* element, JSC::JSValue& thisValu
>     if (!state)
>         return false;
> 
>-    thisValue = toJS(state, deprecatedGlobalObjectForPrototype(state), element);
>-    if (!thisValue)
>-        return false;
>-
>     return true;
> }
> 
>@@ -747,21 +744,29 @@ QVariant QWebElement::evaluateJavaScript(const QString& scriptSource)
>         return QVariant();
> 
>     ScriptState* state = 0;
>-    JSC::JSValue thisValue;
>     ScriptController* scriptController = 0;
> 
>-    if (!setupScriptContext(m_element, thisValue, state, scriptController))
>+    if (!setupScriptContext(m_element, state, scriptController))
>+        return QVariant();
>+
>+    JSC::JSLockHolder lock(state);
>+    RefPtr<Element> protect = m_element;
>+
>+    JSC::JSValue thisValue = toJS(state, toJSDOMGlobalObject(m_element->document(), state), m_element);
>+    if (!thisValue)
>         return QVariant();
>-    String script(reinterpret_cast_ptr<const UChar*>(scriptSource.data()), scriptSource.length());
>+
>+    ScriptSourceCode sourceCode(scriptSource);
> 
>     JSC::JSValue evaluationException;
>-    JSC::JSValue evaluationResult = JSC::evaluate(state, JSC::makeSource(script), thisValue, &evaluationException);
>+    JSC::JSValue evaluationResult = JSC::evaluate(state, sourceCode.jsSourceCode(), thisValue, &evaluationException);
>     if (evaluationException)
>         return QVariant();
>+    JSValueRef evaluationResultRef = toRef(state, evaluationResult);
> 
>     int distance = 0;
>     JSValueRef* ignoredException = 0;
>-    return JSC::Bindings::convertValueToQVariant(toRef(state), toRef(state, evaluationResult), QMetaType::Void, &distance, ignoredException);
>+    return JSC::Bindings::convertValueToQVariant(toRef(state), evaluationResultRef, QMetaType::Void, &distance, ignoredException);
> }
> 
> /*!
>diff --git a/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp b/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp
>index 393cc3789459d3bc2b9a6631aa6b0ac06dcb793e..b3c2398ab355dd8186a55a0705d544e239400cb8 100644
>--- a/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp
>+++ b/Source/WebKit/qt/WebCoreSupport/QWebFrameAdapter.cpp
>@@ -197,14 +197,17 @@ void QWebFrameAdapter::handleGestureEvent(QGestureEventFacade* gestureEvent)
> 
> QVariant QWebFrameAdapter::evaluateJavaScript(const QString &scriptSource)
> {
>-    ScriptController* proxy = frame->script();
>+    ScriptController* scriptController = frame->script();
>     QVariant rc;
>-    if (proxy) {
>+    if (scriptController) {
>         int distance = 0;
>-        JSC::JSValue v = frame->script()->executeScript(ScriptSourceCode(scriptSource)).jsValue();
>-        JSC::ExecState* exec = proxy->globalObject(mainThreadNormalWorld())->globalExec();
>+        ScriptValue value = scriptController->executeScript(ScriptSourceCode(scriptSource));
>+        JSC::ExecState* exec = scriptController->globalObject(mainThreadNormalWorld())->globalExec();
>         JSValueRef* ignoredException = 0;
>-        rc = JSC::Bindings::convertValueToQVariant(toRef(exec), toRef(exec, v), QMetaType::Void, &distance, ignoredException);
>+        exec->vm().apiLock().lock();
>+        JSValueRef valueRef = toRef(exec, value.jsValue());
>+        exec->vm().apiLock().unlock();
>+        rc = JSC::Bindings::convertValueToQVariant(toRef(exec), valueRef, QMetaType::Void, &distance, ignoredException);
>     }
>     return rc;
> }

Actions: View | Formatted Diff | Diff

Attachments on bug 113434: 199825 | 200310 | 200894