Title: [230965] trunk/Source/WebCore
- Revision
- 230965
- Author
- mark....@apple.com
- Date
- 2018-04-24 12:19:47 -0700 (Tue, 24 Apr 2018)
Log Message
Need to acquire the VM lock before calling toNumber on a JSValue.
https://bugs.webkit.org/show_bug.cgi?id=184924
<rdar://problem/39690679>
Reviewed by Saam Barati.
* bridge/objc/objc_utility.mm:
(JSC::Bindings::convertValueToObjcValue):
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (230964 => 230965)
--- trunk/Source/WebCore/ChangeLog 2018-04-24 18:54:47 UTC (rev 230964)
+++ trunk/Source/WebCore/ChangeLog 2018-04-24 19:19:47 UTC (rev 230965)
@@ -1,3 +1,14 @@
+2018-04-24 Mark Lam <mark....@apple.com>
+
+ Need to acquire the VM lock before calling toNumber on a JSValue.
+ https://bugs.webkit.org/show_bug.cgi?id=184924
+ <rdar://problem/39690679>
+
+ Reviewed by Saam Barati.
+
+ * bridge/objc/objc_utility.mm:
+ (JSC::Bindings::convertValueToObjcValue):
+
2018-04-24 Tadeu Zagallo <tzaga...@apple.com>
REGRESSION(r221839): Fix requests with FormData containing empty files
Modified: trunk/Source/WebCore/bridge/objc/objc_utility.mm (230964 => 230965)
--- trunk/Source/WebCore/bridge/objc/objc_utility.mm 2018-04-24 18:54:47 UTC (rev 230964)
+++ trunk/Source/WebCore/bridge/objc/objc_utility.mm 2018-04-24 19:19:47 UTC (rev 230965)
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004, 2013, 2016 Apple Inc. All rights reserved.
+ * Copyright (C) 2004-2018 Apple Inc. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
@@ -81,8 +81,10 @@
ObjcValue result;
double d = 0;
- if (value.isNumber() || value.isString() || value.isBoolean())
+ if (value.isNumber() || value.isString() || value.isBoolean()) {
+ JSLockHolder lock(exec);
d = value.toNumber(exec);
+ }
switch (type) {
case ObjcObjectType: {
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
