Changeset 101539 in webkit for trunk/Source/JavaScriptCore/API

Timestamp:

Nov 30, 2011, 11:36:43 AM (14 years ago)

Author:

[email protected]

Message:

toStringCallback and valueOfCallback do not check the entire prototype chain for convertToType callback
​https://bugs.webkit.org/show_bug.cgi?id=73368

Reviewed by Darin Adler.

We need to search the entire prototype chain for the convertToType callback, rather than just calling whatever
happens to be in the first class of the chain, which potentially could be null.

<rdar://problem/10493218>

• API/JSCallbackFunction.cpp:

(JSC::JSCallbackFunction::toStringCallback):
(JSC::JSCallbackFunction::valueOfCallback):

File:

• trunk/Source/JavaScriptCore/API/JSCallbackFunction.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/API/JSCallbackFunction.cpp

@@ -88 +88 @@
 {
     JSObject* object = toJS(thisObject);
-    if (object->inherits(&JSCallbackObject<JSNonFinalObject>::s_info))
-        return jsCast<JSCallbackObject<JSNonFinalObject>*>(object)->classRef()->convertToType(ctx, thisObject, kJSTypeString, exception);
-    if (object->inherits(&JSCallbackObject<JSGlobalObject>::s_info))
-        return jsCast<JSCallbackObject<JSGlobalObject>*>(object)->classRef()->convertToType(ctx, thisObject, kJSTypeString, exception);
+    if (object->inherits(&JSCallbackObject<JSNonFinalObject>::s_info)) {
+        for (JSClassRef jsClass = jsCast<JSCallbackObject<JSNonFinalObject>*>(object)->classRef(); jsClass; jsClass = jsClass->parentClass)
+            if (jsClass->convertToType)
+                return jsClass->convertToType(ctx, thisObject, kJSTypeString, exception);
+    } else if (object->inherits(&JSCallbackObject<JSGlobalObject>::s_info)) {
+        for (JSClassRef jsClass = jsCast<JSCallbackObject<JSGlobalObject>*>(object)->classRef(); jsClass; jsClass = jsClass->parentClass)
+            if (jsClass->convertToType)
+                return jsClass->convertToType(ctx, thisObject, kJSTypeString, exception);
+    }
     return 0;
 }
@@ -98 +103 @@
 {
     JSObject* object = toJS(thisObject);
-    if (object->inherits(&JSCallbackObject<JSNonFinalObject>::s_info))
-        return jsCast<JSCallbackObject<JSNonFinalObject>*>(object)->classRef()->convertToType(ctx, thisObject, kJSTypeNumber, exception);
-    if (object->inherits(&JSCallbackObject<JSGlobalObject>::s_info))
-        return jsCast<JSCallbackObject<JSGlobalObject>*>(object)->classRef()->convertToType(ctx, thisObject, kJSTypeNumber, exception);
+    if (object->inherits(&JSCallbackObject<JSNonFinalObject>::s_info)) {
+        for (JSClassRef jsClass = jsCast<JSCallbackObject<JSNonFinalObject>*>(object)->classRef(); jsClass; jsClass = jsClass->parentClass)
+            if (jsClass->convertToType)
+                return jsClass->convertToType(ctx, thisObject, kJSTypeNumber, exception);
+    } else if (object->inherits(&JSCallbackObject<JSGlobalObject>::s_info)) {
+        for (JSClassRef jsClass = jsCast<JSCallbackObject<JSGlobalObject>*>(object)->classRef(); jsClass; jsClass = jsClass->parentClass)
+            if (jsClass->convertToType)
+                return jsClass->convertToType(ctx, thisObject, kJSTypeNumber, exception);
+    }
     return 0;
 }