DOM bindings should not be using a reference type to point to a temporary object

https://bugs.webkit.org/show_bug.cgi?id=144474

Reviewed by Beth Dakin.

The DOM bindings will currently try and use a local reference to point
to a temporary object. This currently works as a by product of the compiler's
stack layout. This patch removes the dependency on undefined behaviour
by ensuring that we use a value rather than reference type.

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateParametersCheck):
(GetNativeTypeForCallbacks):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@183648 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index a1854aa..6325a28 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,19 @@
+2015-04-30  Oliver Hunt  <oliver@apple.com>
+
+        DOM bindings should not be using a reference type to point to a temporary object
+        https://bugs.webkit.org/show_bug.cgi?id=144474
+
+        Reviewed by Beth Dakin.
+
+        The DOM bindings will currently try and use a local reference to point
+        to a temporary object. This currently works as a by product of the compiler's
+        stack layout. This patch removes the dependency on undefined behaviour
+        by ensuring that we use a value rather than reference type.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateParametersCheck):
+        (GetNativeTypeForCallbacks):
+
 2015-04-30  Brady Eidson  <beidson@apple.com>
 
         Javascript using WebSQL can create their own WebKit info table.

diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 16af889..3bd84d1 100644 (file)
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -3303,7 +3303,7 @@ sub GenerateParametersCheck
                 push(@$outputArray, "    AtomicStringImpl* existing_$name = exec->argument($argsIndex).isEmpty() ? nullptr : exec->argument($argsIndex).toString(exec)->toExistingAtomicString(exec);\n");
                 push(@$outputArray, "    if (!existing_$name)\n");
                 push(@$outputArray, "        return JSValue::encode(jsNull());\n");
-                push(@$outputArray, "    const AtomicString& $name(existing_$name);\n");
+                push(@$outputArray, "    const AtomicString $name(existing_$name);\n");
             } else {
                 push(@$outputArray, "    " . GetNativeTypeFromSignature($parameter) . " $name(" . JSValueToNative($parameter, $optional && $defaultAttribute && $defaultAttribute eq "NullString" ? "argumentOrNull(exec, $argsIndex)" : "exec->argument($argsIndex)", $function->signature->extendedAttributes->{"Conditional"}) . ");\n");
             }
@@ -3644,7 +3644,7 @@ sub GetNativeTypeFromSignature
 
 my %nativeType = (
     "CompareHow" => "Range::CompareHow",
-    "DOMString" => "const String&",
+    "DOMString" => "const String",
     "NodeFilter" => "RefPtr<NodeFilter>",
     "SerializedScriptValue" => "RefPtr<SerializedScriptValue>",
     "Date" => "double",
@@ -3704,6 +3704,7 @@ sub GetNativeTypeForCallbacks
     my $type = shift;
     return "PassRefPtr<SerializedScriptValue>" if $type eq "SerializedScriptValue";
     return "PassRefPtr<DOMStringList>" if $type eq "DOMStringList";
+    return "const String&" if $type eq "DOMString";
 
     return GetNativeType($type);
 }