Changeset 38148 in webkit for trunk/JavaScriptCore/runtime

Timestamp:

Nov 5, 2008, 7:26:30 PM (17 years ago)

Author:

[email protected]

Message:

JavaScriptCore:

2008-11-05 Gavin Barraclough <​[email protected]>

Reviewed by Maciej Stachowiak.

​https://bugs.webkit.org/show_bug.cgi?id=22094

Fix for bug where the callee incorrectly recieves the caller's lexical
global object as this, rather than its own. Implementation closely
follows the spec, passing jsNull, checking in the callee and replacing
with the global object where necessary.

• VM/CTI.cpp: (JSC::CTI::compileOpCall):
• VM/Machine.cpp: (JSC::Machine::cti_op_call_NotJSFunction): (JSC::Machine::cti_op_call_eval):
• runtime/JSCell.h: (JSC::JSValue::toThisObject):
• runtime/JSImmediate.cpp: (JSC::JSImmediate::toThisObject):
• runtime/JSImmediate.h:

LayoutTests:

2008-11-05 Gavin Barraclough <​[email protected]>

Reviewed by Maciej Stachowiak.

Previosly the test 'cross-site-this' checked that the second level deep method called
across frames recieved the correct this pointer, when no base object is provided.

Test updated so that it check that the code in the child frame, and both the first
and second functions called in the parent frame recieve the correct this values.

• fast/frames/cross-site-this.html:
• fast/frames/resources/cross-site-this-helper.html:

Location:

trunk/JavaScriptCore/runtime

Files:

• JSCell.h (modified) (1 diff)
• JSImmediate.cpp (modified) (1 diff)
• JSImmediate.h (modified) (1 diff)

trunk/JavaScriptCore/runtime/JSCell.h

@@ -285 +285 @@
     {
         if (UNLIKELY(JSImmediate::isImmediate(asValue())))
-            return JSImmediate::toObject(asValue(), exec);
+            return JSImmediate::toThisObject(asValue(), exec);
         return asCell()->toThisObject(exec);
     }

trunk/JavaScriptCore/runtime/JSImmediate.cpp

@@ -32 +32 @@
 
 namespace JSC {
+
+JSObject* JSImmediate::toThisObject(JSValue* v, ExecState* exec)
+{
+    ASSERT(isImmediate(v));
+    if (isNumber(v))
+        return constructNumberFromImmediateNumber(exec, v);
+    if (isBoolean(v))
+        return constructBooleanFromImmediateBoolean(exec, v);
+    if (v == jsNull())
+        return exec->globalThisValue();
+    
+    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v->isNull());
+    exec->setException(exception);
+    return new (exec) JSNotAnObject(exec, exception);
+}
 
 JSObject* JSImmediate::toObject(JSValue* v, ExecState* exec)

trunk/JavaScriptCore/runtime/JSImmediate.h

@@ -234 +234 @@
         static bool toBoolean(JSValue*);
         static JSObject* toObject(JSValue*, ExecState*);
+        static JSObject* toThisObject(JSValue*, ExecState*);
         static UString toString(JSValue*);