Bug 32017

Summary: [V8] Don't crash in DOMWindow event getter in OOM situations
Product: WebKit Reporter: Mads Ager <ager>
Component: WebCore JavaScriptAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: abarth, commit-queue, dglazkov, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Attachments:
Description Flags
Add missing null checks. none

Mads Ager
Reported 2009-12-01 04:36:51 PST
There are missing null checks in the DOMWindow event property getter and setter. V8Proxy::context(frame) can return a null handle in OOM situations either if failing to initialize a context or if an OOM is handled gracefully and javascript is disabled.
Attachments
Add missing null checks. (1.96 KB, patch)
2009-12-01 04:45 PST, Mads Ager 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Mads Ager
Comment 1 2009-12-01 04:45:14 PST
Created attachment 44068 [details] Add missing null checks.
WebKit Review Bot
Comment 2 2009-12-01 04:48:35 PST
style-queue ran check-webkit-style on attachment 44068 [details] without any errors.
Eric Seidel (no email)
Comment 3 2009-12-01 07:22:58 PST
Comment on attachment 44068 [details] Add missing null checks. This makes me wonder about all the other calls to "V8Proxy::context(frame)". It would be nice if there was some way to restrict the heap size for v8 artificially so as to fake OOM bugs, but I can see how this would be difficult to test.
WebKit Commit Bot
Comment 4 2009-12-01 07:45:31 PST
Comment on attachment 44068 [details] Add missing null checks. Clearing flags on attachment: 44068 Committed r51536: <http://trac.webkit.org/changeset/51536>
WebKit Commit Bot
Comment 5 2009-12-01 07:45:36 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.