Changeset 34160 in webkit for trunk/JavaScriptCore/kjs/object.h

Timestamp:

May 27, 2008, 5:44:40 PM (17 years ago)

Author:

[email protected]

Message:

JavaScriptCore:

2008-05-27 Anders Carlsson <​[email protected]>

Reviewed by Geoff and Maciej.

<rdar://problem/5806428>
​https://bugs.webkit.org/show_bug.cgi?id=17925
Crash in KJS::JSObject::put after setting this.proto

Set slotIsWriteable to false for proto, we want setting proto to go through JSObject::put instead.

• kjs/object.h: (KJS::JSObject::getOwnPropertySlotForWrite):

LayoutTests:

2008-05-27 Anders Carlsson <​[email protected]>

Reviewed by Geoff and Maciej.

<rdar://problem/5806428>
​https://bugs.webkit.org/show_bug.cgi?id=17925
Crash in KJS::JSObject::put after setting this.proto

• fast/js/resources/this-non-object-proto.js: Added.
• fast/js/this-non-object-proto-expected.txt: Added.
• fast/js/this-non-object-proto.html: Added.

File:

• trunk/JavaScriptCore/kjs/object.h (modified) (1 diff)

trunk/JavaScriptCore/kjs/object.h

@@ -597 +597 @@
     if (propertyName == exec->propertyNames().underscoreProto) {
         slot.setValueSlot(this, &_proto);
-        slotIsWriteable = true;
+        slotIsWriteable = false;
         return true;
     }