DescriptionMerge 77597 - 2011-02-03 Anton Muhin <antonm@chromium.org>
Reviewed by Adam Barth.
[v8] Bail out if to string conversion returned empty handle
https://bugs.webkit.org/show_bug.cgi?id=53687
This a temporary measure: actually one probably should never get empty handle
if there was no exception. The root cause is under investigation.
The bailout though allows Chromium not to crash---attempt to convert an empty
v8 hande into WebCore string crashes with invalid memory access.
See http://code.google.com/p/chromium/issues/detail?id=71544
There is no known reduction expressible as a layout test so far. The crash found with automated testing tools.
* bindings/v8/V8Binding.cpp:
(WebCore::v8NonStringValueToWebCoreString): Bail out on empty handle
* bindings/v8/V8Binding.h:
(WebCore::V8ParameterBase::prepareBase): Ditto
TBR=antonm@chromium.org
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=77827
Patch Set 1 #
Messages
Total messages: 1 (0 generated)
|