JavaScriptCore-7600.1.4.13.1.tar.gz

diff --git a/ChangeLog b/ChangeLog
index 35c65f46bb6d3f2a4e627dfe63d5ae929b461a5c..bbda15d843f9a35db88edd902b9dfa890870bc70 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,22 @@
+2014-12-10  Babak Shafiei  <bshafiei@apple.com>
+
+        Merge r176803.
+
+    2014-12-04  Oliver Hunt  <oliver@apple.com>
+
+            Serialization of MapData object provides unsafe access to internal types
+            https://bugs.webkit.org/show_bug.cgi?id=138653
+
+            Reviewed by Geoffrey Garen.
+
+            Converting these ASSERTs into RELEASE_ASSERTs, as it is now obvious
+            that despite trying hard to be safe in all cases it's simply to easy
+            to use an iterator in an unsafe state.
+
+            * runtime/MapData.h:
+            (JSC::MapData::const_iterator::key):
+            (JSC::MapData::const_iterator::value):
+
 2014-09-15  Babak Shafiei  <bshafiei@apple.com>
 
         <rdar://problem/18327341> Disable Web Timing on this branch.

diff --git a/Configurations/Version.xcconfig b/Configurations/Version.xcconfig
index 963f195bd000af3a3a0d4fab4b06ba66b6b9c9f3..84fb2bf34a486c8f5892b2c1b3269e0aec953d28 100644 (file)
--- a/Configurations/Version.xcconfig
+++ b/Configurations/Version.xcconfig
@@ -24,8 +24,8 @@
 MAJOR_VERSION = 600;
 MINOR_VERSION = 1;
 TINY_VERSION = 4;
-MICRO_VERSION = 11;
-NANO_VERSION = 8;
+MICRO_VERSION = 13;
+NANO_VERSION = 1;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION).$(TINY_VERSION).$(MICRO_VERSION).$(NANO_VERSION);
 
 // The bundle version and short version string are set based on the current build configuration, see below.

diff --git a/runtime/MapData.h b/runtime/MapData.h
index 75b4c6dab01474700905a631447ef9f3e01deccf..9d117db698daa9b1abf4843edfbc6d995909f56e 100644 (file)
--- a/runtime/MapData.h
+++ b/runtime/MapData.h
@@ -42,8 +42,8 @@ public:
         const_iterator(const MapData*);
         ~const_iterator();
         const WTF::KeyValuePair<JSValue, JSValue> operator*() const;
-        JSValue key() const { ASSERT(!atEnd()); return m_mapData->m_entries[m_index].key.get(); }
-        JSValue value() const { ASSERT(!atEnd()); return m_mapData->m_entries[m_index].value.get(); }
+        JSValue key() const { RELEASE_ASSERT(!atEnd()); return m_mapData->m_entries[m_index].key.get(); }
+        JSValue value() const { RELEASE_ASSERT(!atEnd()); return m_mapData->m_entries[m_index].value.get(); }
         void operator++() { ASSERT(!atEnd()); internalIncrement(); }
         static const_iterator end(const MapData*);
         bool operator!=(const const_iterator& other);