Attachment 271663 Details for Bug 154378 – Patch

[patch] Patch

bug-154378-20160218084707.patch (text/plain), 2.66 KB, created by Chris Dumez on 2016-02-18 08:47:26 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Dumez

Created: 2016-02-18 08:47:26 PST

Size: 2.66 KB

patch

obsolete

>Subversion Revision: 196738
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 079d751f2b0a29e744d820ff4826e9b442e2c3ef..c661c29936b5675056d2f1e3f25ae0af9b9f0dd3 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,27 @@
>+2016-02-18  Chris Dumez  <cdumez@apple.com>
>+
>+        Crash on SES selftest page when loading the page while WebInspector is open
>+        https://bugs.webkit.org/show_bug.cgi?id=154378
>+        <rdar://problem/24713422>
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Do a partial revert of r196676 so that JSObject::getOwnPropertyDescriptor()
>+        returns early again if it detects that getOwnPropertySlot() returns a
>+        non-own property. This check was removed in r196676 because we assumed that
>+        only JSDOMWindow::getOwnPropertySlot() could return non-own properties.
>+        However, as it turns out, DebuggerScope::getOwnPropertySlot() does so as
>+        well.
>+
>+        Not having the check would lead to crashes when using the debugger because
>+        we would get a slot with the CustomAccessor attribute but getDirect() would
>+        then fail to return the property (because it is not an own property). We
>+        would then cast the value returned by getDirect() to a CustomGetterSetter*
>+        and dereference it.
>+
>+        * runtime/JSObject.cpp:
>+        (JSC::JSObject::getOwnPropertyDescriptor):
>+
> 2016-02-17  Benjamin Poulain  <bpoulain@apple.com>
> 
>         [JSC] ARM64: Support the immediate format used for bit operations in Air
>diff --git a/Source/JavaScriptCore/runtime/JSObject.cpp b/Source/JavaScriptCore/runtime/JSObject.cpp
>index 706459382b3fe8be3ed650e626e3664bba082e3b..1e1d20e6a6ce900786916afb586e56e13b71a254 100644
>--- a/Source/JavaScriptCore/runtime/JSObject.cpp
>+++ b/Source/JavaScriptCore/runtime/JSObject.cpp
>@@ -2556,6 +2556,15 @@ bool JSObject::getOwnPropertyDescriptor(ExecState* exec, PropertyName propertyNa
>     if (!methodTable(exec->vm())->getOwnPropertySlot(this, exec, propertyName, slot))
>         return false;
> 
>+    // DebuggerScope::getOwnPropertySlot() (and possibly others) may return attributes from the prototype chain
>+    // but getOwnPropertyDescriptor() should only work for 'own' properties so we exit early if we detect that
>+    // the property is not an own property.
>+    if (slot.slotBase() != this && slot.slotBase()) {
>+        auto* proxy = jsDynamicCast<JSProxy*>(this);
>+        if (!proxy || proxy->target() != slot.slotBase())
>+            return false;
>+    }
>+
>     if (slot.isAccessor())
>         descriptor.setAccessorDescriptor(slot.getterSetter(), slot.attributes());
>     else if (slot.attributes() & CustomAccessor) {

Actions: View | Formatted Diff | Diff

Attachments on bug 154378: 271663