Bug 238048 – Fix crash in Bleacher Report due to bad JSObjectRef passed to API

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Keith Miller]

Fix crash in Bleecher Report due to bad JSObjectRef passed to API

[Keith Miller]

Created attachment 455029 [details]
Patch

[Keith Miller]

<rdar://problem/88766464>

[Keith Miller]

Created attachment 455030 [details]
Patch

[Yusuke Suzuki]

Comment on attachment 455030 [details]
Patch

r=me

[Yusuke Suzuki]

Can you file a bug removing this and putting FIXME comment on this?

[Mark Lam]

Comment on attachment 455030 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=455030&action=review

> Source/JavaScriptCore/ChangeLog:11
> +        short curcuiting to the non-typed array return value, 0. While technically valid

/curcuiting/circuiting/

[Saam Barati]

Comment on attachment 455030 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=455030&action=review

> Source/JavaScriptCore/ChangeLog:3
> +        Fix crash in Bleecher Report due to bad JSObjectRef passed to API

in various places, "Bleecher" => "Bleacher"

[Saam Barati]

Comment on attachment 455030 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=455030&action=review

> Source/JavaScriptCore/API/JSTypedArray.cpp:375
> +inline static bool isBleecherReport()
> +{
> +    auto bundleID = CFBundleGetIdentifier(CFBundleGetMainBundle());
> +    return bundleID
> +        && CFEqual(bundleID, CFSTR("com.bleacherreport.TeamStream"))
> +        && !linkedOnOrAfter(SDKVersion::FirstWithoutBleecherReportQuirk);
> +}

Can we cache this result using std::once?

[Keith Miller]

Comment on attachment 455030 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=455030&action=review

>> Source/JavaScriptCore/API/JSTypedArray.cpp:375
>> +}
> 
> Can we cache this result using std::once?

I'm fairly sure that the fact that `shouldntCrash` is static should handle that?

[Keith Miller]

Created attachment 455033 [details]
Patch for landing

[EWS]

Committed r291448 (248571@main): <https://commits.webkit.org/248571@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 455033 [details].

[Alexey Proskuryakov]

Comment on attachment 455033 [details]
Patch for landing

View in context: https://bugs.webkit.org/attachment.cgi?id=455033&action=review

> Source/JavaScriptCore/API/JSTypedArray.cpp:369
> +inline static bool isBleecherReport()

Typo: Bleacher, not Bleecher.

> Source/WTF/wtf/cocoa/RuntimeApplicationChecksCocoa.h:89
> +    FirstWithoutBleecherReportQuirk = DYLD_IOS_VERSION_16_0,

Ditto.