Changeset 31350 in webkit for trunk/JavaScriptCore/API/JSCallbackObjectFunctions.h

Timestamp:

Mar 26, 2008, 8:35:40 PM (17 years ago)

Author:

Adam Roben

Message:

Fix Bug 18060: Assertion failure (JSLock not held) beneath JSCallbackObject<Base>::toString

<​http://bugs.webkit.org/show_bug.cgi?id=18060>

Reviewed by Geoff Garen.

Bug fix:

• API/JSCallbackObjectFunctions.h: (KJS::JSCallbackObject<Base>::toString): Make the DropAllLocks instance only be in scope while calling convertToType.

Test:

• API/testapi.c: (MyObject_convertToType): Implement type conversion to string.
• API/testapi.js: Add a test for type conversion to string.

File:

• trunk/JavaScriptCore/API/JSCallbackObjectFunctions.h (modified) (1 diff)

trunk/JavaScriptCore/API/JSCallbackObjectFunctions.h

@@ -389 +389 @@
     for (JSClassRef jsClass = m_class; jsClass; jsClass = jsClass->parentClass)
         if (JSObjectConvertToTypeCallback convertToType = jsClass->convertToType) {
-            JSLock::DropAllLocks dropAllLocks;
-            if (JSValueRef value = convertToType(ctx, thisRef, kJSTypeString, toRef(exec->exceptionSlot())))
+            JSValueRef value;
+            {
+                JSLock::DropAllLocks dropAllLocks;
+                value = convertToType(ctx, thisRef, kJSTypeString, toRef(exec->exceptionSlot()));
+            }
+            if (value)
                 return toJS(value)->getString();
         }