Changeset 116578 in webkit for trunk/Source/JavaScriptCore/API/JSClassRef.cpp

Timestamp:

May 9, 2012, 5:04:25 PM (13 years ago)

Author:

[email protected]

Message:

GC race condition in OpaqueJSClass::prototype
​https://bugs.webkit.org/show_bug.cgi?id=86034

Build fix.

• API/JSClassRef.cpp:

(OpaqueJSClass::prototype):

• Eeeep, landed bad version of patch!

File:

• trunk/Source/JavaScriptCore/API/JSClassRef.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/API/JSClassRef.cpp

@@ -214 +214 @@
 
     // Recursive, but should be good enough for our purposes
-    prototype = JSCallbackObject<JSNonFinalObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData); // set jsClassData as the object's private data, so it can clear our reference on destruction
+    JSObject* prototype = JSCallbackObject<JSNonFinalObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData); // set jsClassData as the object's private data, so it can clear our reference on destruction
     if (parentClass) {
         if (JSObject* parentPrototype = parentClass->prototype(exec))