[v8] ScriptValue has dangerous copy semantics
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Feb 2013 09:58:37 +0000 (09:58 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Feb 2013 09:58:37 +0000 (09:58 +0000)
commitc55fbc12bc88b983523294fda27a48f562a35e23
treeb64ba34d279f609646e1958fe5dac64b11ccbc3a
parent6f6c22af61a528d0423faf60ef7309432560070c
[v8] ScriptValue has dangerous copy semantics
https://bugs.webkit.org/show_bug.cgi?id=110206

Patch by Dan Carney <dcarney@google.com> on 2013-02-20
Reviewed by Kentaro Hara.

Update ScriptValue to used a SharedPersistent,
making it impossible to return dead references.

No new tests. No change in functionality.

* bindings/v8/ScriptValue.cpp:
(WebCore::ScriptValue::serialize):
(WebCore::ScriptValue::getString):
(WebCore::ScriptValue::toString):
(WebCore::ScriptValue::toInspectorValue):
* bindings/v8/ScriptValue.h:
(WebCore::ScriptValue::ScriptValue):
(WebCore::ScriptValue::operator=):
(WebCore::ScriptValue::operator==):
(WebCore::ScriptValue::isEqual):
(WebCore::ScriptValue::isFunction):
(WebCore::ScriptValue::isNull):
(WebCore::ScriptValue::isUndefined):
(WebCore::ScriptValue::isObject):
(WebCore::ScriptValue::hasNoValue):
(WebCore::ScriptValue::clear):
(ScriptValue):
(WebCore::ScriptValue::v8Value):
(WebCore::ScriptValue::v8ValueRaw):
* bindings/v8/SharedPersistent.h:
* bindings/v8/custom/V8InjectedScriptHostCustom.cpp:
(WebCore::InjectedScriptHost::scriptValueAsNode):
* bindings/v8/custom/V8MessageEventCustom.cpp:
(WebCore::V8MessageEvent::dataAttrGetterCustom):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@143441 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/WebCore/ChangeLog
Source/WebCore/bindings/v8/ScriptValue.cpp
Source/WebCore/bindings/v8/ScriptValue.h
Source/WebCore/bindings/v8/SharedPersistent.h
Source/WebCore/bindings/v8/custom/V8InjectedScriptHostCustom.cpp
Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp