Changeset 171691 in webkit for trunk/Source/JavaScriptCore/API/JSObjectRef.cpp

Timestamp:

Jul 28, 2014, 1:43:57 PM (11 years ago)

Author:

[email protected]

Message:

REGRESSION: JSObjectSetPrototype() does not work on result of JSGetGlobalObject()
​https://bugs.webkit.org/show_bug.cgi?id=135322

Reviewed by Oliver Hunt.

The prototype chain of the JSProxy object should match that of the JSGlobalObject.

This is a separate but related issue with JSObjectSetPrototype which doesn't correctly
account for JSProxies. I also audited the rest of the C API to check that we correctly
handle JSProxies in all other situations where we expect a JSCallbackObject of some sort
and found some SPI calls (JSObject*PrivateProperty) that didn't behave correctly when
passed a JSProxy.

I also added some new tests for these cases.

• API/JSObjectRef.cpp:

(JSObjectSetPrototype):
(JSObjectGetPrivateProperty):
(JSObjectSetPrivateProperty):
(JSObjectDeletePrivateProperty):

• API/JSWeakObjectMapRefPrivate.cpp:
• API/tests/CustomGlobalObjectClassTest.c:

(globalObjectSetPrototypeTest):
(globalObjectPrivatePropertyTest):

• API/tests/CustomGlobalObjectClassTest.h:
• API/tests/testapi.c:

(main):

File:

• trunk/Source/JavaScriptCore/API/JSObjectRef.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/API/JSObjectRef.cpp

@@ -303 +303 @@
     JSValue jsValue = toJS(exec, value);
 
+    if (JSProxy* proxy = jsDynamicCast<JSProxy*>(jsObject)) {
+        if (JSGlobalObject* globalObject = jsDynamicCast<JSGlobalObject*>(proxy->target())) {
+            globalObject->resetPrototype(exec->vm(), jsValue.isObject() ? jsValue : jsNull());
+            return;
+        }
+        // Someday we might use proxies for something other than JSGlobalObjects, but today is not that day.
+        RELEASE_ASSERT_NOT_REACHED();
+    }
     jsObject->setPrototypeWithCycleCheck(exec, jsValue.isObject() ? jsValue : jsNull());
 }
@@ -502 +510 @@
     JSValue result;
     Identifier name(propertyName->identifier(&exec->vm()));
+
+    // Get wrapped object if proxied
+    if (jsObject->inherits(JSProxy::info()))
+        jsObject = jsCast<JSProxy*>(jsObject)->target();
+
     if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info()))
         result = jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivateProperty(name);
@@ -520 +533 @@
     JSValue jsValue = value ? toJS(exec, value) : JSValue();
     Identifier name(propertyName->identifier(&exec->vm()));
+
+    // Get wrapped object if proxied
+    if (jsObject->inherits(JSProxy::info()))
+        jsObject = jsCast<JSProxy*>(jsObject)->target();
+
     if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info())) {
         jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivateProperty(exec->vm(), name, jsValue);
@@ -543 +561 @@
     JSObject* jsObject = toJS(object);
     Identifier name(propertyName->identifier(&exec->vm()));
+
+    // Get wrapped object if proxied
+    if (jsObject->inherits(JSProxy::info()))
+        jsObject = jsCast<JSProxy*>(jsObject)->target();
+
     if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info())) {
         jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->deletePrivateProperty(name);