Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(162)

Issue 6368135: Merge 77597 - 2011-02-03 Anton Muhin <antonm@chromium.org>... (Closed)

Created:
9 years, 10 months ago by antonm
Modified:
9 years, 4 months ago
Reviewers:
antonm
CC:
chromium-reviews
Base URL:
http://svn.webkit.org/repository/webkit/branches/chromium/648/
Visibility:
Public.

Description

Merge 77597 - 2011-02-03 Anton Muhin <antonm@chromium.org>; Reviewed by Adam Barth. [v8] Bail out if to string conversion returned empty handle https://bugs.webkit.org/show_bug.cgi?id=53687 This a temporary measure: actually one probably should never get empty handle if there was no exception. The root cause is under investigation. The bailout though allows Chromium not to crash---attempt to convert an empty v8 hande into WebCore string crashes with invalid memory access. See http://code.google.com/p/chromium/issues/detail?id=71544 There is no known reduction expressible as a layout test so far. The crash found with automated testing tools. * bindings/v8/V8Binding.cpp: (WebCore::v8NonStringValueToWebCoreString): Bail out on empty handle * bindings/v8/V8Binding.h: (WebCore::V8ParameterBase::prepareBase): Ditto TBR=antonm@chromium.org Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=77827

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+27 lines, -860 lines) Patch
M Source/WebCore/ChangeLog View 1 chunk +12 lines, -860 lines 0 comments Download
M Source/WebCore/bindings/v8/V8Binding.h View 1 chunk +8 lines, -0 lines 0 comments Download
M Source/WebCore/bindings/v8/V8Binding.cpp View 1 chunk +7 lines, -0 lines 0 comments Download

Messages

Total messages: 1 (0 generated)
antonm
9 years, 10 months ago (2011-02-07 18:30:41 UTC) #1

          

Powered by Google App Engine
This is Rietveld 408576698