60672 2011-05-11 15:52:44 -0700 Protect JSC from WebCore executing JS during JS wrapper finalization 2011-05-11 18:31:31 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 oliver oliver oldest_to_newest 402372 0 oliver 2011-05-11 15:52:44 -0700 Protect JSC from WebCore executing JS during JS wrapper finalization 402506 1 93228 oliver 2011-05-11 18:06:29 -0700 Created attachment 93228 Patch 402510 2 93228 darin 2011-05-11 18:12:36 -0700 Comment on attachment 93228 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=93228&action=review It’s clean to forbid this at the JavaScriptCore level, but we’d also like to change WebCore so it doesn’t have the kind of dangerous destructors that could lead to this kind of reentrancy. > Source/JavaScriptCore/heap/Heap.h:83 > - bool isBusy(); // true if an allocation or collection is in progress > + // true if an allocation or collection is in progress > + bool isBusy() > + { > + return m_operationInProgress != NoOperation; > + } You could have put this inline at the end of the file. I often prefer that because I like the class definition to be as clean as possible. 402534 3 oliver 2011-05-11 18:31:31 -0700 Committed r86300: <http://trac.webkit.org/changeset/86300> 93228 2011-05-11 18:06:29 -0700 2011-05-11 18:12:36 -0700 Patch bug-60672-20110511180628.patch text/plain 7099 oliver U3VidmVyc2lvbiBSZXZpc2lvbjogODYyOTQKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0 Q29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCmluZGV4IGYx NTBiNjliZTNiY2ZlMDk5MTJjMDcxYmFkMzI4ODRhMzZmMGJiMmIuLjBhOGNmZjI0OWE4YWY4NzQ1 ZjY1OGM4YmI0YzhkMzZiYjY5ZWE0N2IgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29y ZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwpAQCAtMSw1 ICsxLDI4IEBACiAyMDExLTA1LTExICBPbGl2ZXIgSHVudCAgPG9saXZlckBhcHBsZS5jb20+CiAK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgUHJvdGVjdCBK U0MgZnJvbSBXZWJDb3JlIGV4ZWN1dGluZyBKUyBkdXJpbmcgSlMgd3JhcHBlciBmaW5hbGl6YXRp b24KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTYwNjcy CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS85MzUwOTk3PgorCisgICAgICAgIERldGVjdCB3aGVu IHdlJ3JlIHRyeWluZyB0byBleGVjdXRlIEpTIGR1cmluZyBHQyBhbmQgcHJldmVudCB0aGUKKyAg ICAgICAgZXhlY3V0aW9uIGZyb20gaGFwcGVuaW5nLiAgV2UgYWxzbyBhc3NlcnQgdGhhdCB0aGlz IGlzbid0IGhhcHBlbmluZworICAgICAgICBhcyBpdCBpbXBsaWVzIGluY29ycmVjdCBiZWhhdmlv dXIgb2YgYW4gb2JqZWN0J3MgZGVzdHJ1Y3Rvci4KKworICAgICAgICAqIEphdmFTY3JpcHRDb3Jl LmV4cDoKKyAgICAgICAgKiBoZWFwL0hlYXAuY3BwOgorICAgICAgICAqIGhlYXAvSGVhcC5oOgor ICAgICAgICAoSlNDOjpIZWFwOjppc0J1c3kpOgorICAgICAgICAqIGludGVycHJldGVyL0ludGVy cHJldGVyLmNwcDoKKyAgICAgICAgKEpTQzo6SW50ZXJwcmV0ZXI6OmV4ZWN1dGUpOgorICAgICAg ICAoSlNDOjpJbnRlcnByZXRlcjo6ZXhlY3V0ZUNhbGwpOgorICAgICAgICAoSlNDOjpJbnRlcnBy ZXRlcjo6ZXhlY3V0ZUNvbnN0cnVjdCk6CisgICAgICAgICogcnVudGltZS9KU0dsb2JhbERhdGEu aDoKKyAgICAgICAgKEpTQzo6SlNHbG9iYWxEYXRhOjppc0NvbGxlY3RvckJ1c3kpOgorCisyMDEx LTA1LTExICBPbGl2ZXIgSHVudCAgPG9saXZlckBhcHBsZS5jb20+CisKICAgICAgICAgUmV2aWV3 ZWQgYnkgR2F2aW4gQmFycmFjbG91Z2guCiAKICAgICAgICAgRW5hYmxlIGdjIG1hcmsgdmFsaWRh dGlvbiBpbiB0ZW1wb3JhcmlseSBpbiByZWxlYXNlIGJ1aWxkcwpkaWZmIC0tZ2l0IGEvU291cmNl L0phdmFTY3JpcHRDb3JlL0phdmFTY3JpcHRDb3JlLmV4cCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29y ZS9KYXZhU2NyaXB0Q29yZS5leHAKaW5kZXggZTE3MjFhOTJmOTk4NTE4MGIzZTIzZjQ1MmFjN2Zm NDFhZDE3ZmRmNC4uOWFjZWI5NDBhZTVkNzEyYTczZjg2ZjllOWIzMjUzM2Q1MWVlNjI1YyAxMDA2 NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL0phdmFTY3JpcHRDb3JlLmV4cAorKysgYi9T b3VyY2UvSmF2YVNjcmlwdENvcmUvSmF2YVNjcmlwdENvcmUuZXhwCkBAIC0yMjYsNyArMjI2LDYg QEAgX19aTjNKU0M0SGVhcDIwcHJvdGVjdGVkT2JqZWN0Q291bnRFdgogX19aTjNKU0M0SGVhcDI1 cHJvdGVjdGVkT2JqZWN0VHlwZUNvdW50c0V2CiBfX1pOM0pTQzRIZWFwMjZwcm90ZWN0ZWRHbG9i YWxPYmplY3RDb3VudEV2CiBfX1pOM0pTQzRIZWFwMjlyZXBvcnRFeHRyYU1lbW9yeUNvc3RTbG93 Q2FzZUVtCi1fX1pOM0pTQzRIZWFwNmlzQnVzeUV2CiBfX1pOM0pTQzRIZWFwN2Rlc3Ryb3lFdgog X19aTjNKU0M0SGVhcDdwcm90ZWN0RU5TXzdKU1ZhbHVlRQogX19aTjNKU0M0SGVhcDl1bnByb3Rl Y3RFTlNfN0pTVmFsdWVFCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaGVhcC9I ZWFwLmNwcCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9oZWFwL0hlYXAuY3BwCmluZGV4IDZmMWQ4 MmY2NzQ4MGZhMmVmNWU3YmM0YzlkNGZhOWYxNzBhMzlkYjAuLjM5NGFlOTcwYThiNWVhNzgzYTJi NTQxMGQwMTY5NWJmYWU4NjUzMGYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9o ZWFwL0hlYXAuY3BwCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9oZWFwL0hlYXAuY3BwCkBA IC0zNzYsMTEgKzM3Niw2IEBAIFBhc3NPd25QdHI8VHlwZUNvdW50U2V0PiBIZWFwOjpvYmplY3RU eXBlQ291bnRzKCkKICAgICByZXR1cm4gdHlwZUNvdW50ZXIudGFrZSgpOwogfQogCi1ib29sIEhl YXA6OmlzQnVzeSgpCi17Ci0gICAgcmV0dXJuIG1fb3BlcmF0aW9uSW5Qcm9ncmVzcyAhPSBOb09w ZXJhdGlvbjsKLX0KLQogdm9pZCBIZWFwOjpjb2xsZWN0QWxsR2FyYmFnZSgpCiB7CiAgICAgcmVz ZXQoRG9Td2VlcCk7CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaGVhcC9IZWFw LmggYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaGVhcC9IZWFwLmgKaW5kZXggMjRmMmQzYWY3YmE1 N2YzYWU1YWVjZWEwMjI2ZWQ5M2ZjOGM3ZTRmNi4uODZiYmQ2OTlmMmM4YTllY2E5MjViNTgxODQ3 OTg2ZTYzYzEzOTc5ZiAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2hlYXAvSGVh cC5oCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9oZWFwL0hlYXAuaApAQCAtNzYsNyArNzYs MTIgQEAgbmFtZXNwYWNlIEpTQyB7CiAgICAgICAgIEdDQWN0aXZpdHlDYWxsYmFjayogYWN0aXZp dHlDYWxsYmFjaygpOwogICAgICAgICB2b2lkIHNldEFjdGl2aXR5Q2FsbGJhY2soUGFzc093blB0 cjxHQ0FjdGl2aXR5Q2FsbGJhY2s+KTsKIAotICAgICAgICBib29sIGlzQnVzeSgpOyAvLyB0cnVl IGlmIGFuIGFsbG9jYXRpb24gb3IgY29sbGVjdGlvbiBpcyBpbiBwcm9ncmVzcworICAgICAgICAv LyB0cnVlIGlmIGFuIGFsbG9jYXRpb24gb3IgY29sbGVjdGlvbiBpcyBpbiBwcm9ncmVzcworICAg ICAgICBib29sIGlzQnVzeSgpCisgICAgICAgIHsKKyAgICAgICAgICAgIHJldHVybiBtX29wZXJh dGlvbkluUHJvZ3Jlc3MgIT0gTm9PcGVyYXRpb247CisgICAgICAgIH0KKwogICAgICAgICB2b2lk KiBhbGxvY2F0ZShzaXplX3QpOwogICAgICAgICB2b2lkIGNvbGxlY3RBbGxHYXJiYWdlKCk7CiAK ZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9pbnRlcnByZXRlci9JbnRlcnByZXRl ci5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3Bw CmluZGV4IDRhNmZmYjY3Nzc5YWFiMjE3NzUwNzdkZDdhNGUzNmZmMTA0YTk2OGIuLjQ0NWY5ZmY4 ZDc1YjY1ZjMyN2EyZGQyZThjNWI3ODEyMjc1NjZmNTMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZh U2NyaXB0Q29yZS9pbnRlcnByZXRlci9JbnRlcnByZXRlci5jcHAKKysrIGIvU291cmNlL0phdmFT Y3JpcHRDb3JlL2ludGVycHJldGVyL0ludGVycHJldGVyLmNwcApAQCAtNzI4LDYgKzcyOCw5IEBA IHN0YXRpYyBpbmxpbmUgSlNPYmplY3QqIGNoZWNrZWRSZXR1cm4oSlNPYmplY3QqIHJldHVyblZh bHVlKQogSlNWYWx1ZSBJbnRlcnByZXRlcjo6ZXhlY3V0ZShQcm9ncmFtRXhlY3V0YWJsZSogcHJv Z3JhbSwgQ2FsbEZyYW1lKiBjYWxsRnJhbWUsIFNjb3BlQ2hhaW5Ob2RlKiBzY29wZUNoYWluLCBK U09iamVjdCogdGhpc09iaikKIHsKICAgICBBU1NFUlQoIXNjb3BlQ2hhaW4tPmdsb2JhbERhdGEt PmV4Y2VwdGlvbik7CisgICAgQVNTRVJUKCFjYWxsRnJhbWUtPmdsb2JhbERhdGEoKS5pc0NvbGxl Y3RvckJ1c3koKSk7CisgICAgaWYgKGNhbGxGcmFtZS0+Z2xvYmFsRGF0YSgpLmlzQ29sbGVjdG9y QnVzeSgpKQorICAgICAgICByZXR1cm4ganNOdWxsKCk7CiAKICAgICBpZiAobV9yZWVudHJ5RGVw dGggPj0gTWF4U21hbGxUaHJlYWRSZWVudHJ5RGVwdGggJiYgbV9yZWVudHJ5RGVwdGggPj0gY2Fs bEZyYW1lLT5nbG9iYWxEYXRhKCkubWF4UmVlbnRyeURlcHRoKQogICAgICAgICByZXR1cm4gY2hl Y2tlZFJldHVybih0aHJvd1N0YWNrT3ZlcmZsb3dFcnJvcihjYWxsRnJhbWUpKTsKQEAgLTc4Niw2 ICs3ODksOSBAQCBKU1ZhbHVlIEludGVycHJldGVyOjpleGVjdXRlKFByb2dyYW1FeGVjdXRhYmxl KiBwcm9ncmFtLCBDYWxsRnJhbWUqIGNhbGxGcmFtZSwgUwogSlNWYWx1ZSBJbnRlcnByZXRlcjo6 ZXhlY3V0ZUNhbGwoQ2FsbEZyYW1lKiBjYWxsRnJhbWUsIEpTT2JqZWN0KiBmdW5jdGlvbiwgQ2Fs bFR5cGUgY2FsbFR5cGUsIGNvbnN0IENhbGxEYXRhJiBjYWxsRGF0YSwgSlNWYWx1ZSB0aGlzVmFs dWUsIGNvbnN0IEFyZ0xpc3QmIGFyZ3MpCiB7CiAgICAgQVNTRVJUKCFjYWxsRnJhbWUtPmhhZEV4 Y2VwdGlvbigpKTsKKyAgICBBU1NFUlQoIWNhbGxGcmFtZS0+Z2xvYmFsRGF0YSgpLmlzQ29sbGVj dG9yQnVzeSgpKTsKKyAgICBpZiAoY2FsbEZyYW1lLT5nbG9iYWxEYXRhKCkuaXNDb2xsZWN0b3JC dXN5KCkpCisgICAgICAgIHJldHVybiBqc051bGwoKTsKIAogICAgIGlmIChtX3JlZW50cnlEZXB0 aCA+PSBNYXhTbWFsbFRocmVhZFJlZW50cnlEZXB0aCAmJiBtX3JlZW50cnlEZXB0aCA+PSBjYWxs RnJhbWUtPmdsb2JhbERhdGEoKS5tYXhSZWVudHJ5RGVwdGgpCiAgICAgICAgIHJldHVybiBjaGVj a2VkUmV0dXJuKHRocm93U3RhY2tPdmVyZmxvd0Vycm9yKGNhbGxGcmFtZSkpOwpAQCAtODc2LDYg Kzg4MiwxMSBAQCBKU1ZhbHVlIEludGVycHJldGVyOjpleGVjdXRlQ2FsbChDYWxsRnJhbWUqIGNh bGxGcmFtZSwgSlNPYmplY3QqIGZ1bmN0aW9uLCBDYWxsVAogSlNPYmplY3QqIEludGVycHJldGVy OjpleGVjdXRlQ29uc3RydWN0KENhbGxGcmFtZSogY2FsbEZyYW1lLCBKU09iamVjdCogY29uc3Ry dWN0b3IsIENvbnN0cnVjdFR5cGUgY29uc3RydWN0VHlwZSwgY29uc3QgQ29uc3RydWN0RGF0YSYg Y29uc3RydWN0RGF0YSwgY29uc3QgQXJnTGlzdCYgYXJncykKIHsKICAgICBBU1NFUlQoIWNhbGxG cmFtZS0+aGFkRXhjZXB0aW9uKCkpOworICAgIEFTU0VSVCghY2FsbEZyYW1lLT5nbG9iYWxEYXRh KCkuaXNDb2xsZWN0b3JCdXN5KCkpOworICAgIC8vIFdlIHRocm93IGluIHRoaXMgY2FzZSBiZWNh dXNlIHdlIGhhdmUgdG8gcmV0dXJuIHNvbWV0aGluZyAidmFsaWQiIGJ1dCB3ZSdyZQorICAgIC8v IGFscmVhZHkgaW4gYW4gaW52YWxpZCBzdGF0ZS4KKyAgICBpZiAoY2FsbEZyYW1lLT5nbG9iYWxE YXRhKCkuaXNDb2xsZWN0b3JCdXN5KCkpCisgICAgICAgIHJldHVybiBjaGVja2VkUmV0dXJuKHRo cm93U3RhY2tPdmVyZmxvd0Vycm9yKGNhbGxGcmFtZSkpOwogCiAgICAgaWYgKG1fcmVlbnRyeURl cHRoID49IE1heFNtYWxsVGhyZWFkUmVlbnRyeURlcHRoICYmIG1fcmVlbnRyeURlcHRoID49IGNh bGxGcmFtZS0+Z2xvYmFsRGF0YSgpLm1heFJlZW50cnlEZXB0aCkKICAgICAgICAgcmV0dXJuIGNo ZWNrZWRSZXR1cm4odGhyb3dTdGFja092ZXJmbG93RXJyb3IoY2FsbEZyYW1lKSk7CkBAIC0xMDE0 LDYgKzEwMjUsOSBAQCBDYWxsRnJhbWVDbG9zdXJlIEludGVycHJldGVyOjpwcmVwYXJlRm9yUmVw ZWF0Q2FsbChGdW5jdGlvbkV4ZWN1dGFibGUqIEZ1bmN0aW9uRQogCiBKU1ZhbHVlIEludGVycHJl dGVyOjpleGVjdXRlKENhbGxGcmFtZUNsb3N1cmUmIGNsb3N1cmUpIAogeworICAgIEFTU0VSVCgh Y2xvc3VyZS5vbGRDYWxsRnJhbWUtPmdsb2JhbERhdGEoKS5pc0NvbGxlY3RvckJ1c3koKSk7Cisg ICAgaWYgKGNsb3N1cmUub2xkQ2FsbEZyYW1lLT5nbG9iYWxEYXRhKCkuaXNDb2xsZWN0b3JCdXN5 KCkpCisgICAgICAgIHJldHVybiBqc051bGwoKTsKICAgICBjbG9zdXJlLnJlc2V0Q2FsbEZyYW1l KCk7CiAgICAgUHJvZmlsZXIqKiBwcm9maWxlciA9IFByb2ZpbGVyOjplbmFibGVkUHJvZmlsZXJS ZWZlcmVuY2UoKTsKICAgICBpZiAoKnByb2ZpbGVyKQpAQCAtMTA2MCw2ICsxMDc0LDkgQEAgSlNW YWx1ZSBJbnRlcnByZXRlcjo6ZXhlY3V0ZShFdmFsRXhlY3V0YWJsZSogZXZhbCwgQ2FsbEZyYW1l KiBjYWxsRnJhbWUsIEpTT2JqZWMKIEpTVmFsdWUgSW50ZXJwcmV0ZXI6OmV4ZWN1dGUoRXZhbEV4 ZWN1dGFibGUqIGV2YWwsIENhbGxGcmFtZSogY2FsbEZyYW1lLCBKU09iamVjdCogdGhpc09iaiwg aW50IGdsb2JhbFJlZ2lzdGVyT2Zmc2V0LCBTY29wZUNoYWluTm9kZSogc2NvcGVDaGFpbikKIHsK ICAgICBBU1NFUlQoIXNjb3BlQ2hhaW4tPmdsb2JhbERhdGEtPmV4Y2VwdGlvbik7CisgICAgQVNT RVJUKCFjYWxsRnJhbWUtPmdsb2JhbERhdGEoKS5pc0NvbGxlY3RvckJ1c3koKSk7CisgICAgaWYg KGNhbGxGcmFtZS0+Z2xvYmFsRGF0YSgpLmlzQ29sbGVjdG9yQnVzeSgpKQorICAgICAgICByZXR1 cm4ganNOdWxsKCk7CiAKICAgICBEeW5hbWljR2xvYmFsT2JqZWN0U2NvcGUgZ2xvYmFsT2JqZWN0 U2NvcGUoKnNjb3BlQ2hhaW4tPmdsb2JhbERhdGEsIHNjb3BlQ2hhaW4tPmdsb2JhbE9iamVjdC5n ZXQoKSk7CiAKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTR2xv YmFsRGF0YS5oIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNHbG9iYWxEYXRhLmgK aW5kZXggZjEwODVhZjQyYjE5MDgwMWVjZjhlYjU3NWIxMjc0OTE4NTA3ZTk0YS4uNjUyMmEwMWNk YmNmMmEyMTQ1YjFlOTE2NTM2Y2MxZmZmMGRiOWYwNSAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFT Y3JpcHRDb3JlL3J1bnRpbWUvSlNHbG9iYWxEYXRhLmgKKysrIGIvU291cmNlL0phdmFTY3JpcHRD b3JlL3J1bnRpbWUvSlNHbG9iYWxEYXRhLmgKQEAgLTI2OSw2ICsyNjksOCBAQCBuYW1lc3BhY2Ug SlNDIHsKICAgICAgICAgSGFuZGxlU2xvdCBhbGxvY2F0ZUxvY2FsSGFuZGxlKCkgeyByZXR1cm4g aGVhcC5hbGxvY2F0ZUxvY2FsSGFuZGxlKCk7IH0KICAgICAgICAgdm9pZCBjbGVhckJ1aWx0aW5T dHJ1Y3R1cmVzKCk7CiAKKyAgICAgICAgYm9vbCBpc0NvbGxlY3RvckJ1c3koKSB7IHJldHVybiBo ZWFwLmlzQnVzeSgpOyB9CisKICAgICBwcml2YXRlOgogICAgICAgICBKU0dsb2JhbERhdGEoR2xv YmFsRGF0YVR5cGUsIFRocmVhZFN0YWNrVHlwZSk7CiAgICAgICAgIHN0YXRpYyBKU0dsb2JhbERh dGEqJiBzaGFyZWRJbnN0YW5jZUludGVybmFsKCk7Cg==