Changeset 38148 in webkit for trunk/JavaScriptCore/VM

Timestamp:

Nov 5, 2008, 7:26:30 PM (17 years ago)

Author:

[email protected]

Message:

JavaScriptCore:

2008-11-05 Gavin Barraclough <​[email protected]>

Reviewed by Maciej Stachowiak.

​https://bugs.webkit.org/show_bug.cgi?id=22094

Fix for bug where the callee incorrectly recieves the caller's lexical
global object as this, rather than its own. Implementation closely
follows the spec, passing jsNull, checking in the callee and replacing
with the global object where necessary.

• VM/CTI.cpp: (JSC::CTI::compileOpCall):
• VM/Machine.cpp: (JSC::Machine::cti_op_call_NotJSFunction): (JSC::Machine::cti_op_call_eval):
• runtime/JSCell.h: (JSC::JSValue::toThisObject):
• runtime/JSImmediate.cpp: (JSC::JSImmediate::toThisObject):
• runtime/JSImmediate.h:

LayoutTests:

2008-11-05 Gavin Barraclough <​[email protected]>

Reviewed by Maciej Stachowiak.

Previosly the test 'cross-site-this' checked that the second level deep method called
across frames recieved the correct this pointer, when no base object is provided.

Test updated so that it check that the code in the child frame, and both the first
and second functions called in the parent frame recieve the correct this values.

• fast/frames/cross-site-this.html:
• fast/frames/resources/cross-site-this-helper.html:

Location:

trunk/JavaScriptCore/VM

Files:

• CTI.cpp (modified) (1 diff)
• Machine.cpp (modified) (2 diffs)

trunk/JavaScriptCore/VM/CTI.cpp

@@ -629 +629 @@
     if (opcodeID != op_construct) {
         int thisVal = instruction[3].u.operand;
-        if (thisVal == missingThisObjectMarker()) {
-            // FIXME: should this be loaded dynamically off m_callFrame?
-            m_jit.movl_i32m(asInteger(m_callFrame->globalThisValue()), firstArg * sizeof(Register), X86::edi);
-        } else {
+        if (thisVal == missingThisObjectMarker())
+            m_jit.movl_i32m(asInteger(jsNull()), firstArg * sizeof(Register), X86::edi);
+        else {
             emitGetArg(thisVal, X86::eax);
             emitPutResult(firstArg);

trunk/JavaScriptCore/VM/Machine.cpp

@@ -4819 +4819 @@
         {
             SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
-            returnValue = callData.native.function(callFrame, asObject(funcVal), argv[0].jsValue(callFrame), argList);
+
+            // All host methods should be calling toThisObject, but this is not presently the case.
+            JSValue* thisValue = argv[0].jsValue(callFrame);
+            if (thisValue == jsNull())
+                thisValue = callFrame->globalThisValue();
+
+            returnValue = callData.native.function(callFrame, asObject(funcVal), thisValue, argList);
         }
         ARG_setCallFrame(previousCallFrame);
@@ -5645 +5651 @@
 
     if (baseVal == scopeChain->globalObject() && funcVal == scopeChain->globalObject()->evalFunction()) {
-        JSObject* thisObject = asObject(callFrame[codeBlock->thisRegister].jsValue(callFrame));
+        JSObject* thisObject = callFrame[codeBlock->thisRegister].jsValue(callFrame)->toThisObject(callFrame);
         JSValue* exceptionValue = noValue();
         JSValue* result = machine->callEval(callFrame, thisObject, scopeChain, registerFile, registerOffset - RegisterFile::CallFrameHeaderSize - argCount, argCount, exceptionValue);