27218 2009-07-13 08:56:16 -0700 [V8] Add missing check for constructor call in WebKitCSSMatrixConstructor 2009-07-13 09:41:20 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) All All RESOLVED FIXED http://crbug.com/12651 P2 Normal --- 1 dglazkov dglazkov oldest_to_newest 131324 0 dglazkov 2009-07-13 08:56:16 -0700 Found by skylined+cevans. 131330 1 32662 dglazkov 2009-07-13 09:28:29 -0700 Created attachment 32662 Add missing cosntructor call check, v1. LayoutTests/ChangeLog | 10 +++++++ .../fast/css/matrix-as-function-crash-expected.txt | 3 ++ LayoutTests/fast/css/matrix-as-function-crash.html | 27 ++++++++++++++++++++ WebCore/ChangeLog | 11 ++++++++ .../v8/custom/V8WebKitCSSMatrixConstructor.cpp | 4 +++ 5 files changed, 55 insertions(+), 0 deletions(-) 131331 2 32662 fishd 2009-07-13 09:30:15 -0700 Comment on attachment 32662 Add missing cosntructor call check, v1. > +++ b/WebCore/ChangeLog > @@ -1,3 +1,14 @@ > +2009-07-13 Dimitri Glazkov <dglazkov@chromium.org> > + > + Reviewed by NOBODY (OOPS!). > + > + [V8] Add a missing check for constructor call in WebKitCSSMatrixConstructor. > + > + Test: fast/css/matrix-as-function-crash.html > + > + * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp: > + (WebCore::CALLBACK_FUNC_DECL): Added a check for constructor call. ^^^ needs a bug link r=me 131335 3 dglazkov 2009-07-13 09:41:20 -0700 Landed as http://trac.webkit.org/changeset/45826. 32662 2009-07-13 09:28:29 -0700 2009-07-13 09:30:14 -0700 Add missing cosntructor call check, v1. Add-missing-cosntructor-call-check-v1..patch text/plain 3489 dglazkov YzQxMDkyN2FhMDc2MGU2NmE5M2Y5YTcxNjc4YjhhYTRlMmIyNGJiMwpkaWZmIC0tZ2l0IGEvTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGNiZjM1MjIu LmU4NjgyYTkgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRU ZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAwOS0wNy0xMyAgRGltaXRyaSBHbGF6 a292ICA8ZGdsYXprb3ZAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIE1ha2Ugc3VyZSB0aGF0IGNhbGxpbmcgV2ViS2l0Q1NTTWF0 cml4IGFzIGZ1bmN0aW9uIGRvZXMgbm90IHJlc3VsdCBpbiBjcmFzaC4KKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTI3MjE4CisKKyAgICAgICAgKiBmYXN0 L2Nzcy9tYXRyaXgtYXMtZnVuY3Rpb24tY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAg ICAgKiBmYXN0L2Nzcy9tYXRyaXgtYXMtZnVuY3Rpb24tY3Jhc2guaHRtbDogQWRkZWQuCisKIDIw MDktMDctMTAgIERpcmsgUHJhbmtlICA8ZHByYW5rZUBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAg UmV2aWV3ZWQgYnkgRGFyaW4gQWRsZXIuCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2Nz cy9tYXRyaXgtYXMtZnVuY3Rpb24tY3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFz dC9jc3MvbWF0cml4LWFzLWZ1bmN0aW9uLWNyYXNoLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2Rl IDEwMDY0NAppbmRleCAwMDAwMDAwLi5iZTkwODdiCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0 VGVzdHMvZmFzdC9jc3MvbWF0cml4LWFzLWZ1bmN0aW9uLWNyYXNoLWV4cGVjdGVkLnR4dApAQCAt MCwwICsxLDMgQEAKK0NhbGxpbmcgV2ViS2l0Q1NTTWF0cml4IGNvbnN0cnVjdG9yIGFzIGZ1bmN0 aW9uIHNob3VsZCB0aHJvdyBhbiBleGNlcHRpb24gYW5kIG5vdCBjYXVzZSBhIGNyYXNoLgorCitQ QVNTCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2Nzcy9tYXRyaXgtYXMtZnVuY3Rpb24t Y3Jhc2guaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvY3NzL21hdHJpeC1hcy1mdW5jdGlvbi1jcmFz aC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjllMmE5NzQKLS0tIC9k ZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2Nzcy9tYXRyaXgtYXMtZnVuY3Rpb24tY3Jh c2guaHRtbApAQCAtMCwwICsxLDI3IEBACis8aHRtbD4KKzxoZWFkPgorICAgIDx0aXRsZT5DYWxs aW5nIFdlYktpdENTU01hdHJpeCBjb25zdHJ1Y3RvciBhcyBmdW5jdGlvbiBzaG91bGQgbm90IGNh dXNlIGEgY3Jhc2g8L3RpdGxlPgorICAgIDxzY3JpcHQ+CisgICAgICAgIGlmICh3aW5kb3cubGF5 b3V0VGVzdENvbnRyb2xsZXIpCisgICAgICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1w QXNUZXh0KCk7CisKKyAgICAgICAgZnVuY3Rpb24gcnVuVGVzdCgpCisgICAgICAgIHsKKyAgICAg ICAgICAgIHZhciByZXN1bHQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgicmVzdWx0Iik7Cisg ICAgICAgICAgICB0cnkgeworICAgICAgICAgICAgICAgIFdlYktpdENTU01hdHJpeCgpOworICAg ICAgICAgICAgICAgIAorICAgICAgICAgICAgfQorICAgICAgICAgICAgY2F0Y2ggKGUpIHsKKyAg ICAgICAgICAgICAgICByZXN1bHQuaW5uZXJIVE1MID0gIlBBU1MiOworICAgICAgICAgICAgICAg IHJldHVybjsKKyAgICAgICAgICAgIH0KKyAgICAgICAgICAgIHJlc3VsdC5pbm5lckhUTUwgPSAi RkFJTCI7CisgICAgICAgIH0KKworICAgIDwvc2NyaXB0PgorPC9oZWFkPgorPGJvZHkgb25sb2Fk PSJydW5UZXN0KCkiPgorICAgIDxwPkNhbGxpbmcgPGNvZGU+V2ViS2l0Q1NTTWF0cml4PC9jb2Rl PiBjb25zdHJ1Y3RvciBhcyBmdW5jdGlvbiBzaG91bGQgdGhyb3cgYW4gZXhjZXB0aW9uIGFuZCBu b3QgY2F1c2UgYSBjcmFzaC48L3A+CisgICAgPGRpdiBpZD0icmVzdWx0Ij48L2Rpdj4KKzwvaHRt bD4KXCBObyBuZXdsaW5lIGF0IGVuZCBvZiBmaWxlCmRpZmYgLS1naXQgYS9XZWJDb3JlL0NoYW5n ZUxvZyBiL1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4IDRkODkwNmIuLmQ2ZjM0YmMgMTAwNjQ0Ci0t LSBhL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEs MTQgQEAKKzIwMDktMDctMTMgIERpbWl0cmkgR2xhemtvdiAgPGRnbGF6a292QGNocm9taXVtLm9y Zz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBbVjhd IEFkZCBhIG1pc3NpbmcgY2hlY2sgZm9yIGNvbnN0cnVjdG9yIGNhbGwgaW4gV2ViS2l0Q1NTTWF0 cml4Q29uc3RydWN0b3IuCisKKyAgICAgICAgVGVzdDogZmFzdC9jc3MvbWF0cml4LWFzLWZ1bmN0 aW9uLWNyYXNoLmh0bWwKKworICAgICAgICAqIGJpbmRpbmdzL3Y4L2N1c3RvbS9WOFdlYktpdENT U01hdHJpeENvbnN0cnVjdG9yLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkNBTExCQUNLX0ZVTkNf REVDTCk6IEFkZGVkIGEgY2hlY2sgZm9yIGNvbnN0cnVjdG9yIGNhbGwuCisKIDIwMDktMDctMTAg IFN0ZXZlIEZhbGtlbmJ1cmcgIDxzZmFsa2VuQGFwcGxlLmNvbT4KIAogICAgICAgICA8cmRhcjov L3Byb2JsZW0vNzA0ODc0MT4gUkVHUkVTU0lPTjogRXJyb3IgYWJvdXQgbWlzc2luZyBTd01lbnVY LmRsbCBvcGVuaW5nIHBhZ2VzIHdpdGggU2hvY2t3YXZlCmRpZmYgLS1naXQgYS9XZWJDb3JlL2Jp bmRpbmdzL3Y4L2N1c3RvbS9WOFdlYktpdENTU01hdHJpeENvbnN0cnVjdG9yLmNwcCBiL1dlYkNv cmUvYmluZGluZ3MvdjgvY3VzdG9tL1Y4V2ViS2l0Q1NTTWF0cml4Q29uc3RydWN0b3IuY3BwCmlu ZGV4IGM5OGU2YmMuLjQ4MTkwNjQgMTAwNjQ0Ci0tLSBhL1dlYkNvcmUvYmluZGluZ3MvdjgvY3Vz dG9tL1Y4V2ViS2l0Q1NTTWF0cml4Q29uc3RydWN0b3IuY3BwCisrKyBiL1dlYkNvcmUvYmluZGlu Z3MvdjgvY3VzdG9tL1Y4V2ViS2l0Q1NTTWF0cml4Q29uc3RydWN0b3IuY3BwCkBAIC00Nyw2ICs0 NywxMCBAQCBuYW1lc3BhY2UgV2ViQ29yZSB7CiBDQUxMQkFDS19GVU5DX0RFQ0woV2ViS2l0Q1NT TWF0cml4Q29uc3RydWN0b3IpCiB7CiAgICAgSU5DX1NUQVRTKCJET00uV2ViS2l0Q1NTTWF0cml4 LkNvbnN0cnVjdG9yIik7CisKKyAgICBpZiAoIWFyZ3MuSXNDb25zdHJ1Y3RDYWxsKCkpCisgICAg ICAgIHJldHVybiB0aHJvd0Vycm9yKCJET00gb2JqZWN0IGNvbnN0cnVjdG9yIGNhbm5vdCBiZSBj YWxsZWQgYXMgYSBmdW5jdGlvbi4iKTsKKwogICAgIC8vIEZJWE1FOiBUaGUgbG9naWMgaGVyZSBp cyBhbG1vc3QgZXhhY3QgZHVwbGljYXRlIG9mIFY4Ojpjb25zdHJ1Y3RET01PYmplY3QuCiAgICAg Ly8gQ29uc2lkZXIgcmVmYWN0b3JpbmcgdG8gcmVkdWNlIGR1cGxpY2F0aW9uLgogICAgIFN0cmlu ZyBjc3NWYWx1ZTsK