Changeset 31145 in webkit for trunk/JavaScriptCore/kjs/object.cpp

Timestamp:

Mar 18, 2008, 6:50:11 PM (17 years ago)

Author:

[email protected]

Message:

Fix ​http://bugs.webkit.org/show_bug.cgi?id=17925 and ​http://bugs.webkit.org/show_bug.cgi?id=17927.

• Bug 17925: Crash in KJS::JSObject::put after setting this.proto
• Bug 17927: Hang after attempting to create circular proto

• kjs/object.cpp:

(KJS::JSObject::put): Silently ignore attempts to set proto to a non-object, non-null value.
Return after setting the exception when an attempt to set a cyclic proto is detected so that
the cyclic value is not set.

File:

• trunk/JavaScriptCore/kjs/object.cpp (modified) (1 diff)

trunk/JavaScriptCore/kjs/object.cpp

@@ -211 +211 @@
   if (propertyName == exec->propertyNames().underscoreProto) {
     JSObject* proto = value->getObject();
+
+    // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla
+    if (!proto && value != jsNull())
+      return;
+
     while (proto) {
-      if (proto == this)
+      if (proto == this) {
         throwError(exec, GeneralError, "cyclic __proto__ value");
+        return;
+      }
       proto = proto->prototype() ? proto->prototype()->getObject() : 0;
     }