<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[196760] trunk/Source/JavaScriptCore</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/196760">196760</a></dd>
<dt>Author</dt> <dd>cdumez@apple.com</dd>
<dt>Date</dt> <dd>2016-02-18 09:19:33 -0800 (Thu, 18 Feb 2016)</dd>
</dl>
<h3>Log Message</h3>
<pre>Crash on SES selftest page when loading the page while WebInspector is open
https://bugs.webkit.org/show_bug.cgi?id=154378
<rdar://problem/24713422>
Reviewed by Mark Lam.
Do a partial revert of <a href="http://trac.webkit.org/projects/webkit/changeset/196676">r196676</a> so that JSObject::getOwnPropertyDescriptor()
returns early again if it detects that getOwnPropertySlot() returns a
non-own property. This check was removed in <a href="http://trac.webkit.org/projects/webkit/changeset/196676">r196676</a> because we assumed that
only JSDOMWindow::getOwnPropertySlot() could return non-own properties.
However, as it turns out, DebuggerScope::getOwnPropertySlot() does so as
well.
Not having the check would lead to crashes when using the debugger because
we would get a slot with the CustomAccessor attribute but getDirect() would
then fail to return the property (because it is not an own property). We
would then cast the value returned by getDirect() to a CustomGetterSetter*
and dereference it.
* runtime/JSObject.cpp:
(JSC::JSObject::getOwnPropertyDescriptor):</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (196759 => 196760)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog 2016-02-18 16:55:58 UTC (rev 196759)
+++ trunk/Source/JavaScriptCore/ChangeLog 2016-02-18 17:19:33 UTC (rev 196760)
</span><span class="lines">@@ -1,3 +1,27 @@
</span><ins>+2016-02-18 Chris Dumez <cdumez@apple.com>
+
+ Crash on SES selftest page when loading the page while WebInspector is open
+ https://bugs.webkit.org/show_bug.cgi?id=154378
+ <rdar://problem/24713422>
+
+ Reviewed by Mark Lam.
+
+ Do a partial revert of r196676 so that JSObject::getOwnPropertyDescriptor()
+ returns early again if it detects that getOwnPropertySlot() returns a
+ non-own property. This check was removed in r196676 because we assumed that
+ only JSDOMWindow::getOwnPropertySlot() could return non-own properties.
+ However, as it turns out, DebuggerScope::getOwnPropertySlot() does so as
+ well.
+
+ Not having the check would lead to crashes when using the debugger because
+ we would get a slot with the CustomAccessor attribute but getDirect() would
+ then fail to return the property (because it is not an own property). We
+ would then cast the value returned by getDirect() to a CustomGetterSetter*
+ and dereference it.
+
+ * runtime/JSObject.cpp:
+ (JSC::JSObject::getOwnPropertyDescriptor):
+
</ins><span class="cx"> 2016-02-18 Filip Pizlo <fpizlo@apple.com>
</span><span class="cx">
</span><span class="cx"> Unreviewed, fix VS build. I didn't know we still did that, but apparently there's a bot
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (196759 => 196760)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-02-18 16:55:58 UTC (rev 196759)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp 2016-02-18 17:19:33 UTC (rev 196760)
</span><span class="lines">@@ -2556,6 +2556,15 @@
</span><span class="cx"> if (!methodTable(exec->vm())->getOwnPropertySlot(this, exec, propertyName, slot))
</span><span class="cx"> return false;
</span><span class="cx">
</span><ins>+ // DebuggerScope::getOwnPropertySlot() (and possibly others) may return attributes from the prototype chain
+ // but getOwnPropertyDescriptor() should only work for 'own' properties so we exit early if we detect that
+ // the property is not an own property.
+ if (slot.slotBase() != this && slot.slotBase()) {
+ auto* proxy = jsDynamicCast<JSProxy*>(this);
+ if (!proxy || proxy->target() != slot.slotBase())
+ return false;
+ }
+
</ins><span class="cx"> if (slot.isAccessor())
</span><span class="cx"> descriptor.setAccessorDescriptor(slot.getterSetter(), slot.attributes());
</span><span class="cx"> else if (slot.attributes() & CustomAccessor) {
</span></span></pre>
</div>
</div>
</body>
</html>