Changeset 34160 in webkit for trunk/JavaScriptCore

Timestamp:

May 27, 2008, 5:44:40 PM (17 years ago)

Author:

[email protected]

Message:

JavaScriptCore:

2008-05-27 Anders Carlsson <​[email protected]>

Reviewed by Geoff and Maciej.

<rdar://problem/5806428>
​https://bugs.webkit.org/show_bug.cgi?id=17925
Crash in KJS::JSObject::put after setting this.proto

Set slotIsWriteable to false for proto, we want setting proto to go through JSObject::put instead.

• kjs/object.h: (KJS::JSObject::getOwnPropertySlotForWrite):

LayoutTests:

2008-05-27 Anders Carlsson <​[email protected]>

Reviewed by Geoff and Maciej.

<rdar://problem/5806428>
​https://bugs.webkit.org/show_bug.cgi?id=17925
Crash in KJS::JSObject::put after setting this.proto

• fast/js/resources/this-non-object-proto.js: Added.
• fast/js/this-non-object-proto-expected.txt: Added.
• fast/js/this-non-object-proto.html: Added.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• kjs/object.h (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-05-27  Anders Carlsson  <[email protected]>
+
+        Reviewed by Geoff and Maciej.
+
+        <rdar://problem/5806428> 
+        https://bugs.webkit.org/show_bug.cgi?id=17925
+        Crash in KJS::JSObject::put after setting this.__proto__
+
+        Set slotIsWriteable to false for __proto__, we want setting __proto__ to go through JSObject::put instead.
+        
+        * kjs/object.h:
+        (KJS::JSObject::getOwnPropertySlotForWrite):
+
 2008-05-27  Kevin Ollivier  <[email protected]>
 

trunk/JavaScriptCore/kjs/object.h

@@ -597 +597 @@
     if (propertyName == exec->propertyNames().underscoreProto) {
         slot.setValueSlot(this, &_proto);
-        slotIsWriteable = true;
+        slotIsWriteable = false;
         return true;
     }