Crash in blink::getTypeExtension

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 32dd75ac6a48326702bd93bdbbb379f886b46b25..ad17990a8b7ed8de3b0817167e36c7081cbe859f 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -702,7 +702,20 @@ String getTypeExtension(Document* document,
     if (impl.hasIs())

[sof, 2016/11/26 07:36:30]

Is |exceptionState| intentionally ignored here?

[Anton Obzhirov, 2016/11/27 19:49:53]

Previously getTypeExtension was called in createElement/createElementNS with
unmodified state. Now it is not the case and it is better to do anyway so I will
add the check, thanks for spotting. 

       return impl.is();
 
-    return toCoreString(dict.v8Value()->ToString());
+    v8::Local<v8::String> stringObject;

[sof, 2016/11/26 07:36:30]

The spec says "Let 'is' be the value of |is| member of 'options', or null if no
such member exists", so the need for stringification of the dict is backward
compat motivated, presumably..? Is that a common use of createElement(), why
isn't it being use-counted?

A comment explaining why this is done, would be helpful for someone looking at
the code.

(V8StringResource<> is useful for doing toString() conversions, but I don't yet
fully understand the motivation for this case.)

[Anton Obzhirov, 2016/11/27 19:49:53]

Yes, stringification of the dictionary is for backward compatibility only.
Before introduction of the dictionary the second argument was converted to
string for all cases automatically. I think I missed use-counting here because
technically it wasn't a string argument but you are right, it has to be done
here as well.

For the code to be aligned with the spec the string argument should be
deprecated first but plz correct me if I am wrong.

+    if (dict.v8Value()->IsString()) {
+      stringObject = dict.v8Value().As<v8::String>();
+    } else {
+      v8::TryCatch block(dict.isolate());
+      if (!v8Call(dict.v8Value()->ToString(dict.isolate()->GetCurrentContext()),
+                  stringObject, block)) {
+        exceptionState.rethrowV8Exception(block.Exception());
+        return emptyString();
+      }
+    }
+
+    if (!stringObject.IsEmpty())
+      return toCoreString(stringObject);
   }
 
   return emptyString();