Fix crash in Qt JavaScript bindings when the arguments used on the Qt side are not

registered with QMetaType.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@21751 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 7ef53e55268005ea05a965d7116342ae89c45601..ff767b2c445cb82792281e2101c29086b1f30099 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,14 @@
+2007-05-25  Simon Hausmann  <hausmann@kde.org>
+
+        Reviewed by Zack.
+
+        Fix crash in Qt JavaScript bindings when the arguments used on the Qt side are not
+        registered with QMetaType.
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::invokeMethod):
+        * bindings/qt/qt_runtime.cpp:
+
 2007-05-24  Luciano Montanaro  <mikelima@cirulla.net>
 
         Reviewed by Darin

diff --git a/JavaScriptCore/bindings/qt/qt_instance.cpp b/JavaScriptCore/bindings/qt/qt_instance.cpp
index 02c57013839bca1731a5deeae1194f861228fe18..7e9bc7e94fab5357312c012ea0a6e34e8fe360ff 100644 (file)
--- a/JavaScriptCore/bindings/qt/qt_instance.cpp
+++ b/JavaScriptCore/bindings/qt/qt_instance.cpp
@@ -105,14 +105,23 @@ JSValue* QtInstance::invokeMethod(ExecState* exec, const MethodList& methodList,
 
     QVariant vargs[11];
     void *qargs[11];
-    
-    vargs[0] = QVariant(QMetaType::type(metaMethod.typeName()));
+
+    int returnType = QMetaType::type(metaMethod.typeName());
+    if (!returnType && qstrlen(metaMethod.typeName())) {
+        qCritical("QtInstance::invokeMethod: Return type %s of method %s is not registered with QMetaType!", metaMethod.typeName(), metaMethod.signature());
+        return jsUndefined();
+    }
+    vargs[0] = QVariant(returnType);
     qargs[0] = vargs[0].data();
 
     for (int i = 0; i < args.size(); ++i) {
         vargs[i+1] = convertValueToQVariant(exec, args[i]);
         QVariant::Type type = (QVariant::Type) QMetaType::type(argTypes.at(i));
-        if (!vargs[i+1].convert(type)) 
+        if (!type) {
+            qCritical("QtInstance::invokeMethod: Method %s has argument %s which is not registered with QMetaType!", metaMethod.signature(), argTypes.at(i).constData());
+            return jsUndefined();
+        }
+        if (!vargs[i+1].convert(type))
             return jsUndefined();
 
         qargs[i+1] = vargs[i+1].data();

diff --git a/JavaScriptCore/bindings/qt/qt_runtime.cpp b/JavaScriptCore/bindings/qt/qt_runtime.cpp
index 10c4e6501b04713bf6bbfb023b127463ca5e6050..b295f6c3b81cad452681053c789e11ebaaf5c2f5 100644 (file)
--- a/JavaScriptCore/bindings/qt/qt_runtime.cpp
+++ b/JavaScriptCore/bindings/qt/qt_runtime.cpp
@@ -31,6 +31,10 @@ namespace Bindings {
 // Variant value must be released with NPReleaseVariantValue()
 QVariant convertValueToQVariant(ExecState* exec, JSValue* value)
 {
+    // check magic pointer values before dereferencing value
+    if (value == jsNull() || value == jsNaN() || value == jsUndefined())
+        return QVariant();
+
     JSType type = value->type();
 
     if (type == StringType) {