[Webkit-unassigned] [Bug 70464] New: Add a ConstructorMode check to all existing custom V8 constructors

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=70464

           Summary: Add a ConstructorMode check to all existing custom V8
                    constructors
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: haraken at chromium.org
                CC: abarth at webkit.org, dominicc at chromium.org


We should add the following two lines to all existing custom V8 constructors:

    if (ConstructorMode::current() == ConstructorMode::WrapExistingObject)
        return args.Holder();

This checks whether a programmer is trying to allocate an object via "new X", or C++ is trying to allocate an object via the function template and wrap the object with a JS flavor. In the latter case, a constructor callback should not be executed (i.e. should return immediately).

As for existing custom V8 constructors, no bugs have been occurring without this check for now. However, without the check, the problems that I described in the bug 70015 can happen in the future if someone changes code. In addition, if the check does not exist in existing custom constructors, people will add a new custom constructor without the check without considering the possibility of the problems, which may result in ugly bugs.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.