From 3a005f22703b9303a306bf34cbd17c3729f763aa Mon Sep 17 00:00:00 2001 From: tsepez Date: Fri, 27 May 2016 17:45:00 -0700 Subject: Workaround dubious casting between CXFA_Object and void* in FXJSE This is just a crock to get things working until we fix the underlying issue. When there's single-inheritance, it may often work in practice to C-style (reinterpret) cast a Derived* ptr to void* and then back to a Base* ptr. One place where this blows up is if Derived has virtual functions but Base does not, in which case the world will be offset by the size of a vtable ptr. Because of the use of void* types in FXJSE, the above was happening when setting a CXFA_ThisProxy (Derived, virtual) to be a global object (void*). This would then be cast back to a CFXA_Object (Base, non-virtual) and chaos is ensured. Not sure how far back this goes. Along the way, pick up some tidying which was necessary for simplicity while tracking this down. BUG=613607 Review-Url: https://codereview.chromium.org/2015143005 --- xfa/fxjse/class.cpp | 1 - xfa/fxjse/context.cpp | 41 ++++++++++++++++++++++++++++++++++++- xfa/fxjse/context.h | 9 +++++++++ xfa/fxjse/include/fxjse.h | 4 ++-- xfa/fxjse/util_inline.h | 51 ----------------------------------------------- xfa/fxjse/value.cpp | 2 +- 6 files changed, 52 insertions(+), 56 deletions(-) delete mode 100644 xfa/fxjse/util_inline.h (limited to 'xfa/fxjse') diff --git a/xfa/fxjse/class.cpp b/xfa/fxjse/class.cpp index dcc370306a..d49bafb986 100644 --- a/xfa/fxjse/class.cpp +++ b/xfa/fxjse/class.cpp @@ -9,7 +9,6 @@ #include "xfa/fxjse/cfxjse_arguments.h" #include "xfa/fxjse/context.h" #include "xfa/fxjse/scope_inline.h" -#include "xfa/fxjse/util_inline.h" #include "xfa/fxjse/value.h" static void FXJSE_V8ConstructorCallback_Wrapper( diff --git a/xfa/fxjse/context.cpp b/xfa/fxjse/context.cpp index 333b2abe57..49d0b44338 100644 --- a/xfa/fxjse/context.cpp +++ b/xfa/fxjse/context.cpp @@ -8,9 +8,48 @@ #include "xfa/fxjse/class.h" #include "xfa/fxjse/scope_inline.h" -#include "xfa/fxjse/util_inline.h" #include "xfa/fxjse/value.h" +v8::Local FXJSE_GetGlobalObjectFromContext( + const v8::Local& hContext) { + return hContext->Global()->GetPrototype().As(); +} + +void FXJSE_UpdateObjectBinding(v8::Local& hObject, + void* lpNewBinding) { + ASSERT(!hObject.IsEmpty()); + ASSERT(hObject->InternalFieldCount() > 0); + hObject->SetAlignedPointerInInternalField(0, lpNewBinding); +} + +void* FXJSE_RetrieveObjectBinding(const v8::Local& hJSObject, + CFXJSE_Class* lpClass) { + ASSERT(!hJSObject.IsEmpty()); + if (!hJSObject->IsObject()) { + return NULL; + } + v8::Local hObject = hJSObject; + if (hObject->InternalFieldCount() == 0) { + v8::Local hProtoObject = hObject->GetPrototype(); + if (hProtoObject.IsEmpty() || !hProtoObject->IsObject()) { + return NULL; + } + hObject = hProtoObject.As(); + if (hObject->InternalFieldCount() == 0) { + return NULL; + } + } + if (lpClass) { + v8::Local hClass = + v8::Local::New( + lpClass->GetContext()->GetRuntime(), lpClass->GetTemplate()); + if (!hClass->HasInstance(hObject)) { + return NULL; + } + } + return hObject->GetAlignedPointerFromInternalField(0); +} + CFXJSE_Context* FXJSE_Context_Create( v8::Isolate* pIsolate, const FXJSE_CLASS_DESCRIPTOR* lpGlobalClass, diff --git a/xfa/fxjse/context.h b/xfa/fxjse/context.h index 96b93faffd..79e5e0a740 100644 --- a/xfa/fxjse/context.h +++ b/xfa/fxjse/context.h @@ -50,4 +50,13 @@ class CFXJSE_Context { v8::Local FXJSE_CreateReturnValue(v8::Isolate* pIsolate, v8::TryCatch& trycatch); +v8::Local FXJSE_GetGlobalObjectFromContext( + const v8::Local& hContext); + +void FXJSE_UpdateObjectBinding(v8::Local& hObject, + void* lpNewBinding = nullptr); + +void* FXJSE_RetrieveObjectBinding(const v8::Local& hJSObject, + CFXJSE_Class* lpClass = nullptr); + #endif // XFA_FXJSE_CONTEXT_H_ diff --git a/xfa/fxjse/include/fxjse.h b/xfa/fxjse/include/fxjse.h index d2d0bd9014..e278935657 100644 --- a/xfa/fxjse/include/fxjse.h +++ b/xfa/fxjse/include/fxjse.h @@ -72,8 +72,8 @@ void FXJSE_Runtime_Release(v8::Isolate* pIsolate, bool bOwnedRuntime); CFXJSE_Context* FXJSE_Context_Create( v8::Isolate* pIsolate, - const FXJSE_CLASS_DESCRIPTOR* lpGlobalClass = nullptr, - void* lpGlobalObject = nullptr); + const FXJSE_CLASS_DESCRIPTOR* lpGlobalClass, + void* lpGlobalObject); void FXJSE_Context_Release(CFXJSE_Context* pContext); CFXJSE_Value* FXJSE_Context_GetGlobalObject(CFXJSE_Context* pContext); diff --git a/xfa/fxjse/util_inline.h b/xfa/fxjse/util_inline.h deleted file mode 100644 index e61dc6aa80..0000000000 --- a/xfa/fxjse/util_inline.h +++ /dev/null @@ -1,51 +0,0 @@ -// Copyright 2014 PDFium Authors. All rights reserved. -// Use of this source code is governed by a BSD-style license that can be -// found in the LICENSE file. - -// Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com - -#ifndef XFA_FXJSE_UTIL_INLINE_H_ -#define XFA_FXJSE_UTIL_INLINE_H_ - -#include "xfa/fxjse/context.h" - -static V8_INLINE v8::Local FXJSE_GetGlobalObjectFromContext( - const v8::Local& hContext) { - return hContext->Global()->GetPrototype().As(); -} -static V8_INLINE void FXJSE_UpdateObjectBinding(v8::Local& hObject, - void* lpNewBinding) { - ASSERT(!hObject.IsEmpty()); - ASSERT(hObject->InternalFieldCount() > 0); - hObject->SetAlignedPointerInInternalField(0, lpNewBinding); -} -static V8_INLINE void* FXJSE_RetrieveObjectBinding( - const v8::Local& hJSObject, - CFXJSE_Class* lpClass = NULL) { - ASSERT(!hJSObject.IsEmpty()); - if (!hJSObject->IsObject()) { - return NULL; - } - v8::Local hObject = hJSObject; - if (hObject->InternalFieldCount() == 0) { - v8::Local hProtoObject = hObject->GetPrototype(); - if (hProtoObject.IsEmpty() || !hProtoObject->IsObject()) { - return NULL; - } - hObject = hProtoObject.As(); - if (hObject->InternalFieldCount() == 0) { - return NULL; - } - } - if (lpClass) { - v8::Local hClass = - v8::Local::New( - lpClass->GetContext()->GetRuntime(), lpClass->GetTemplate()); - if (!hClass->HasInstance(hObject)) { - return NULL; - } - } - return hObject->GetAlignedPointerFromInternalField(0); -} - -#endif // XFA_FXJSE_UTIL_INLINE_H_ diff --git a/xfa/fxjse/value.cpp b/xfa/fxjse/value.cpp index e7a3463f28..ecd88b078d 100644 --- a/xfa/fxjse/value.cpp +++ b/xfa/fxjse/value.cpp @@ -9,7 +9,7 @@ #include #include "xfa/fxjse/class.h" -#include "xfa/fxjse/util_inline.h" +#include "xfa/fxjse/context.h" FX_BOOL FXJSE_Value_IsUndefined(CFXJSE_Value* pValue) { return pValue && pValue->IsUndefined(); -- cgit v1.2.3