Bug 98433 – Crash in Safari at com.apple.JavaScriptCore: WTF::StringImpl::is8Bit const + 12

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

Crash running safari extension tests.

Looks like is8Bit() is called on a String without a StringImpl.

<rdar://problem/12433701>

[Michael Saboff]

Created attachment 167152 [details]
Patch

[Jessie Berlin]

Comment on attachment 167152 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=167152&action=review

> Source/JavaScriptCore/ChangeLog:11
> +        (JSValueMakeFromJSONString):

You should also mention that characters16() does the is8Bit() check, which is why you changed it to characters().

[Michael Saboff]

Committed r130424: <http://trac.webkit.org/changeset/130424>

[Michael Saboff]

This is actually fixing the symptom of a problem in <http://trac.webkit.org/changeset/130344> and the follow-on <http://trac.webkit.org/changeset/130413>.  It appears that we are turning a null string into an empty string in OpaqueJSString.cpp.  See https://bugs.webkit.org/show_bug.cgi?id=98417.

[Michael Saboff]

Reopened because https://bugs.webkit.org/show_bug.cgi?id=98417 "After r130344, OpaqueJSString() creates an empty string which should be a null string" was the source of this particular crash.  However the change in this patch (r130424) is actually needed.

Consider the case:

    JSStringRef nullJSON = JSStringCreateWithUTF8CString(0);
    JSValueRef nullJSONObject = JSValueMakeFromJSONString(context, nullJSON);

nullJSON will have a null string which would cause the code before this patch to crash.

The case above has been added to testapi.c in r130832: <http://trac.webkit.org/changeset/130832>.