[JSC] Web Inspector: CRASH running $0, $1, etc before they are set

https://bugs.webkit.org/show_bug.cgi?id=81082

Source/WebCore:

Don't return an invalid JSValue. Check if the ScriptValue
has no value and return undefined in that case.

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2012-03-14
Reviewed by Pavel Feldman.

Updated test: inspector/console/command-line-api.html

* bindings/js/JSInjectedScriptHostCustom.cpp:
(WebCore::JSInjectedScriptHost::inspectedObject):

LayoutTests:

Test for an undefined inspectedObject.

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2012-03-14
Reviewed by Pavel Feldman.

* inspector/console/command-line-api-expected.txt:
* inspector/console/command-line-api.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@110760 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 930f5c7f078c9bbd9e983ccbb5042b4847f28082..33274897189c89e1d2a217cde33962bba422aa95 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2012-03-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [JSC] Web Inspector: CRASH running $0, $1, etc before they are set
+        https://bugs.webkit.org/show_bug.cgi?id=81082
+
+        Test for an undefined inspectedObject.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/console/command-line-api-expected.txt:
+        * inspector/console/command-line-api.html:
+
 2012-03-14  Adrienne Walker  <enne@google.com>
 
         [chromium] Unreviewed, mark two compositing tests as passing.

diff --git a/LayoutTests/inspector/console/command-line-api-expected.txt b/LayoutTests/inspector/console/command-line-api-expected.txt
index 5de641c2243764856d496b35ebe943f90738bd5b..a8b2863ceb591ec43376eb76b209b68f72214e79 100644 (file)
--- a/LayoutTests/inspector/console/command-line-api-expected.txt
+++ b/LayoutTests/inspector/console/command-line-api-expected.txt
@@ -1,6 +1,7 @@
 Tests that command line api works.
 
 $0.toString() = "[object HTMLParagraphElement]"
+$3 = undefined
 keys([3,4]).toString() = "0,1"
 values([3,4]).toString() = "3,4"
 $('foo').toString() = "[object HTMLParagraphElement]"

diff --git a/LayoutTests/inspector/console/command-line-api.html b/LayoutTests/inspector/console/command-line-api.html
index 9304ec042dda7a3f4f4a8500fa2dc96f1e60b82c..12219a0f91fddb6708760570421a9626132d7d21 100644 (file)
--- a/LayoutTests/inspector/console/command-line-api.html
+++ b/LayoutTests/inspector/console/command-line-api.html
@@ -8,6 +8,7 @@ var test = function()
 {
     var expressions = [
         "$0.toString()",
+        "$3",
         "keys([3,4]).toString()",
         "values([3,4]).toString()",
         "$('foo').toString()",

diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index 59271331879394d9b639c7d975eed33c28277110..0af39a4708f82b322294009244765ac243488aaf 100644 (file)
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18 @@
+2012-03-14  Joseph Pecoraro  <pecoraro@apple.com>
+
+        [JSC] Web Inspector: CRASH running $0, $1, etc before they are set
+        https://bugs.webkit.org/show_bug.cgi?id=81082
+
+        Don't return an invalid JSValue. Check if the ScriptValue
+        has no value and return undefined in that case.
+
+        Reviewed by Pavel Feldman.
+
+        Updated test: inspector/console/command-line-api.html
+
+        * bindings/js/JSInjectedScriptHostCustom.cpp:
+        (WebCore::JSInjectedScriptHost::inspectedObject):
+
 2012-03-14  James Robinson  <jamesr@chromium.org>
 
         [chromium] Remove canRecoverFromContextLoss attribute, it's unused

diff --git a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
index 5972a6171d536e1918c5e3f63754e97960bc3763..3585bceee1ac5a46988f434df079eab999604a1e 100644 (file)
--- a/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
+++ b/Source/WebCore/bindings/js/JSInjectedScriptHostCustom.cpp
@@ -91,7 +91,11 @@ JSValue JSInjectedScriptHost::inspectedObject(ExecState* exec)
         return jsUndefined();
 
     JSLock lock(SilenceAssertionsOnly);
-    return object->get(exec).jsValue();
+    ScriptValue scriptValue = object->get(exec);
+    if (scriptValue.hasNoValue())
+        return jsUndefined();
+
+    return scriptValue.jsValue();
 }
 
 JSValue JSInjectedScriptHost::internalConstructorName(ExecState* exec)