Changeset 171691 in webkit for trunk/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp

Timestamp:

Jul 28, 2014, 1:43:57 PM (11 years ago)

Author:

[email protected]

Message:

REGRESSION: JSObjectSetPrototype() does not work on result of JSGetGlobalObject()
​https://bugs.webkit.org/show_bug.cgi?id=135322

Reviewed by Oliver Hunt.

The prototype chain of the JSProxy object should match that of the JSGlobalObject.

This is a separate but related issue with JSObjectSetPrototype which doesn't correctly
account for JSProxies. I also audited the rest of the C API to check that we correctly
handle JSProxies in all other situations where we expect a JSCallbackObject of some sort
and found some SPI calls (JSObject*PrivateProperty) that didn't behave correctly when
passed a JSProxy.

I also added some new tests for these cases.

• API/JSObjectRef.cpp:

(JSObjectSetPrototype):
(JSObjectGetPrivateProperty):
(JSObjectSetPrivateProperty):
(JSObjectDeletePrivateProperty):

• API/JSWeakObjectMapRefPrivate.cpp:
• API/tests/CustomGlobalObjectClassTest.c:

(globalObjectSetPrototypeTest):
(globalObjectPrivatePropertyTest):

• API/tests/CustomGlobalObjectClassTest.h:
• API/tests/testapi.c:

(main):

File:

• trunk/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/API/JSWeakObjectMapRefPrivate.cpp

@@ -63 +63 @@
     if (!obj)
         return;
-    ASSERT(obj->inherits(JSCallbackObject<JSGlobalObject>::info()) || obj->inherits(JSCallbackObject<JSDestructibleObject>::info()));
+    ASSERT(obj->inherits(JSProxy::info())
+        || obj->inherits(JSCallbackObject<JSGlobalObject>::info()) 
+        || obj->inherits(JSCallbackObject<JSDestructibleObject>::info()));
     map->map().set(key, obj);
 }