Changeset 25534 in webkit for trunk/JavaScriptCore/kjs/Context.cpp

Timestamp:

Sep 13, 2007, 6:54:12 AM (18 years ago)

Author:

antti

Message:

JavaScriptCore:

Reviewed by Geoff, Maciej.

Fix <rdar://problem/5445058>
REGRESSION: Unable to upload picture to eBay auction due to domain security check

eBay uses window.eval() between windows. In Firefox window.eval() switches execution
and security context to the target window, something WebKit did not do. With WebKit
security tightening in r24781, this broke picture uploads.

Fix by making WebKit switch context in window.eval().

• kjs/Context.cpp: (KJS::Context::Context): (KJS::Context::~Context):
• kjs/context.h: Save and restore interpreter context independently from calling context.

• kjs/function.cpp: (KJS::GlobalFuncImp::callAsFunction): If eval is called for global object different than current one, switch execution context to that object and push it to scope.

LayoutTests:

Reviewed by Geoff, Maciej.

Test for <rdar://problem/5445058>
REGRESSION: Unable to upload picture to eBay auction due to domain security check

• fast/js/window-eval-context-expected.txt: Added.
• fast/js/window-eval-context.html: Added.

File:

• trunk/JavaScriptCore/kjs/Context.cpp (modified) (2 diffs)

trunk/JavaScriptCore/kjs/Context.cpp

@@ -32 +32 @@
                  FunctionImp* func, const List* args)
     : m_interpreter(interpreter)
+    , m_savedContext(interpreter->context())
     , m_currentBody(currentBody)
     , m_function(func)
@@ -84 +85 @@
 Context::~Context()
 {
-    m_interpreter->setContext(m_callingContext);
+    m_interpreter->setContext(m_savedContext);
 
     // The arguments list is only needed to potentially create the  arguments object,