Title: [148303] trunk/Source/WebCore
Revision
148303
Author
oli...@apple.com
Date
2013-04-12 14:39:09 -0700 (Fri, 12 Apr 2013)

Log Message

make the codegenerator actually emit polymorphism check in the "no vtable" path
https://bugs.webkit.org/show_bug.cgi?id=114533

Reviewed by David Kilzer.

Make the "no vtable" check correct so that we actually plant a polymorphism
check.  Update a few interfaces to have the correct validation attributes.

* Modules/webdatabase/SQLTransaction.idl:
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::toJS):
* bindings/scripts/test/TestInterface.idl:
* html/track/TextTrackCue.idl:
* svg/SVGAnimatedAngle.idl:
* svg/SVGAnimatedBoolean.idl:
* svg/SVGAnimatedEnumeration.idl:
* svg/SVGAnimatedInteger.idl:
* svg/SVGAnimatedLength.idl:
* svg/SVGAnimatedLengthList.idl:
* svg/SVGAnimatedNumber.idl:
* svg/SVGAnimatedNumberList.idl:
* svg/SVGAnimatedPreserveAspectRatio.idl:
* svg/SVGAnimatedRect.idl:
* svg/SVGAnimatedString.idl:
* svg/SVGAnimatedTransformList.idl:

Modified Paths

Diff

Modified: trunk/Source/WebCore/ChangeLog (148302 => 148303)


--- trunk/Source/WebCore/ChangeLog	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/ChangeLog	2013-04-12 21:39:09 UTC (rev 148303)
@@ -1,5 +1,35 @@
 2013-04-12  Oliver Hunt  <oli...@apple.com>
 
+        make the codegenerator actually emit polymorphism check in the "no vtable" path
+        https://bugs.webkit.org/show_bug.cgi?id=114533
+
+        Reviewed by David Kilzer.
+
+        Make the "no vtable" check correct so that we actually plant a polymorphism
+        check.  Update a few interfaces to have the correct validation attributes.        
+
+        * Modules/webdatabase/SQLTransaction.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::toJS):
+        * bindings/scripts/test/TestInterface.idl:
+        * html/track/TextTrackCue.idl:
+        * svg/SVGAnimatedAngle.idl:
+        * svg/SVGAnimatedBoolean.idl:
+        * svg/SVGAnimatedEnumeration.idl:
+        * svg/SVGAnimatedInteger.idl:
+        * svg/SVGAnimatedLength.idl:
+        * svg/SVGAnimatedLengthList.idl:
+        * svg/SVGAnimatedNumber.idl:
+        * svg/SVGAnimatedNumberList.idl:
+        * svg/SVGAnimatedPreserveAspectRatio.idl:
+        * svg/SVGAnimatedRect.idl:
+        * svg/SVGAnimatedString.idl:
+        * svg/SVGAnimatedTransformList.idl:
+
+2013-04-12  Oliver Hunt  <oli...@apple.com>
+
         Make CodeGeneratorJS plant comments to explain failures in the binding validation
         https://bugs.webkit.org/show_bug.cgi?id=114528
 

Modified: trunk/Source/WebCore/Modules/webdatabase/SQLTransaction.idl (148302 => 148303)


--- trunk/Source/WebCore/Modules/webdatabase/SQLTransaction.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/Modules/webdatabase/SQLTransaction.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -30,7 +30,7 @@
     Conditional=SQL_DATABASE,
     OmitConstructor,
     JSNoStaticTables,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SQLTransaction {
     [Custom] void executeSql(in DOMString sqlStatement,
                              in ObjectArray arguments,

Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (148302 => 148303)


--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm	2013-04-12 21:39:09 UTC (rev 148303)
@@ -2747,7 +2747,7 @@
     RELEASE_ASSERT(actualVTablePointer == expectedVTablePointer);
 #endif
 END
-        push(@implContent, <<END) if $interface->extendedAttributes->{"ImplementationLacksVTable"} && $vtableNameGnu;
+        push(@implContent, <<END) if $interface->extendedAttributes->{"ImplementationLacksVTable"};
 #if COMPILER(CLANG)
     // If you hit this failure the interface definition has the ImplementationLacksVTable
     // attribute. You should remove that attribute. If the class has subclasses

Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp (148302 => 148303)


--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp	2013-04-12 21:39:09 UTC (rev 148303)
@@ -499,38 +499,18 @@
     jsTestInterface->releaseImpl();
 }
 
-#if ENABLE(BINDING_INTEGRITY)
-#if PLATFORM(WIN)
-#pragma warning(disable: 4483)
-extern "C" { extern void (*const __identifier("??_7TestInterface@WebCore@@6B@")[])(); }
-#else
-extern "C" { extern void* _ZTVN7WebCore13TestInterfaceE[]; }
-#endif
-#endif
 JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, TestInterface* impl)
 {
     if (!impl)
         return jsNull();
     if (JSValue result = getExistingWrapper<JSTestInterface>(exec, impl)) return result;
-
-#if ENABLE(BINDING_INTEGRITY)
-    void* actualVTablePointer = *(reinterpret_cast<void**>(impl));
-#if PLATFORM(WIN)
-    void* expectedVTablePointer = reinterpret_cast<void*>(__identifier("??_7TestInterface@WebCore@@6B@"));
-#else
-    void* expectedVTablePointer = &_ZTVN7WebCore13TestInterfaceE[2];
 #if COMPILER(CLANG)
-    // If this fails TestInterface does not have a vtable, so you need to add the
-    // ImplementationLacksVTable attribute to the interface definition
-    COMPILE_ASSERT(__is_polymorphic(TestInterface), TestInterface_is_not_polymorphic);
+    // If you hit this failure the interface definition has the ImplementationLacksVTable
+    // attribute. You should remove that attribute. If the class has subclasses
+    // that may be passed through this toJS() function you should use the SkipVTableValidation
+    // attribute to TestInterface.
+    COMPILE_ASSERT(!__is_polymorphic(TestInterface), TestInterface_is_polymorphic_but_idl_claims_not_to_be);
 #endif
-#endif
-    // If you hit this assertion you either have a use after free bug, or
-    // TestInterface has subclasses. If TestInterface has subclasses that get passed
-    // to toJS() we currently require TestInterface you to opt out of binding hardening
-    // by adding the SkipVTableValidation attribute to the interface IDL definition
-    RELEASE_ASSERT(actualVTablePointer == expectedVTablePointer);
-#endif
     return createNewWrapper<JSTestInterface>(exec, globalObject, impl);
 }
 

Modified: trunk/Source/WebCore/bindings/scripts/test/TestInterface.idl (148302 => 148303)


--- trunk/Source/WebCore/bindings/scripts/test/TestInterface.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/bindings/scripts/test/TestInterface.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -35,6 +35,7 @@
     CallWith=ScriptExecutionContext,
     Constructor(in DOMString str1, in [Optional=DefaultIsUndefined] DOMString str2),
     ConstructorRaisesException,
-    ConstructorConditional=TEST_INTERFACE
+    ConstructorConditional=TEST_INTERFACE,
+    ImplementationLacksVTable
 ] interface TestInterface {
 };

Modified: trunk/Source/WebCore/html/track/TextTrackCue.idl (148302 => 148303)


--- trunk/Source/WebCore/html/track/TextTrackCue.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/html/track/TextTrackCue.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -32,7 +32,7 @@
     EventTarget,
     JSCustomMarkFunction,
     JSCustomIsReachable,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface TextTrackCue {
     readonly attribute TextTrack track;
 

Modified: trunk/Source/WebCore/svg/SVGAnimatedAngle.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedAngle.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedAngle.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedAngle {
     readonly attribute SVGAngle baseVal;
     readonly attribute SVGAngle animVal;

Modified: trunk/Source/WebCore/svg/SVGAnimatedBoolean.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedBoolean.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedBoolean.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedBoolean {
     [StrictTypeChecking] attribute boolean baseVal
         setter raises(DOMException);

Modified: trunk/Source/WebCore/svg/SVGAnimatedEnumeration.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedEnumeration.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedEnumeration.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedEnumeration {
     [StrictTypeChecking] attribute unsigned short baseVal
         setter raises(DOMException);

Modified: trunk/Source/WebCore/svg/SVGAnimatedInteger.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedInteger.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedInteger.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedInteger {
     [StrictTypeChecking] attribute long baseVal
         setter raises(DOMException);

Modified: trunk/Source/WebCore/svg/SVGAnimatedLength.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedLength.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedLength.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedLength {
     readonly attribute SVGLength baseVal;
     readonly attribute SVGLength animVal;

Modified: trunk/Source/WebCore/svg/SVGAnimatedLengthList.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedLengthList.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedLengthList.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedLengthList {
     readonly attribute SVGLengthList baseVal;
     readonly attribute SVGLengthList animVal;

Modified: trunk/Source/WebCore/svg/SVGAnimatedNumber.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedNumber.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedNumber.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -26,7 +26,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedNumber {
     [StrictTypeChecking] attribute float baseVal
         setter raises(DOMException);

Modified: trunk/Source/WebCore/svg/SVGAnimatedNumberList.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedNumberList.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedNumberList.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedNumberList {
     readonly attribute SVGNumberList baseVal;
     readonly attribute SVGNumberList animVal;

Modified: trunk/Source/WebCore/svg/SVGAnimatedPreserveAspectRatio.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedPreserveAspectRatio.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedPreserveAspectRatio.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedPreserveAspectRatio {
     readonly attribute SVGPreserveAspectRatio baseVal;
     readonly attribute SVGPreserveAspectRatio animVal;

Modified: trunk/Source/WebCore/svg/SVGAnimatedRect.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedRect.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedRect.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedRect {
     readonly attribute SVGRect baseVal;
     readonly attribute SVGRect animVal;

Modified: trunk/Source/WebCore/svg/SVGAnimatedString.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedString.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedString.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedString {
     attribute DOMString baseVal
         setter raises(DOMException);

Modified: trunk/Source/WebCore/svg/SVGAnimatedTransformList.idl (148302 => 148303)


--- trunk/Source/WebCore/svg/SVGAnimatedTransformList.idl	2013-04-12 20:44:38 UTC (rev 148302)
+++ trunk/Source/WebCore/svg/SVGAnimatedTransformList.idl	2013-04-12 21:39:09 UTC (rev 148303)
@@ -25,7 +25,7 @@
 
 [
     Conditional=SVG,
-    ImplementationLacksVTable
+    SkipVTableValidation
 ] interface SVGAnimatedTransformList {
     readonly attribute SVGTransformList baseVal;
     readonly attribute SVGTransformList animVal;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to