Changeset 39320 in webkit for trunk/JavaScriptCore/runtime/JSObject.cpp

Timestamp:

Dec 15, 2008, 4:22:14 PM (16 years ago)

Author:

Darin Adler

Message:

JavaScriptCore:

2008-12-15 Darin Adler <Darin Adler>

Reviewed by Sam Weinig.

• fix <rdar://problem/6427048> crash due to infinite recursion after setting window.proto = window

Replaced toGlobalObject with the more generally useful unwrappedObject and used it to
fix the cycle detection code in put(proto).

• JavaScriptCore.exp: Updated.

• runtime/JSGlobalObject.cpp: Removed toGlobalObject. We now use unwrappedObject instead.
• runtime/JSGlobalObject.h: (JSC::JSGlobalObject::isGlobalObject): Ditto.

• runtime/JSGlobalObjectFunctions.cpp: (JSC::globalFuncEval): Use unwrappedObject and isGlobalObject here rather than toGlobalObject.

• runtime/JSObject.cpp: (JSC::JSObject::put): Rewrote prototype cycle checking loop. Use unwrappedObject in the loop now. (JSC::JSObject::unwrappedObject): Replaced toGlobalObject with this new function.
• runtime/JSObject.h: More of the same.

WebCore:

2008-12-15 Darin Adler <Darin Adler>

Reviewed by Sam Weinig.

• fix <rdar://problem/6427048> crash due to infinite recursion after setting window.proto = window

Test: fast/dom/Window/window-custom-prototype.html

Replaced toGlobalObject with the more generally useful unwrappedObject.

• bindings/js/JSDOMWindowShell.cpp: (WebCore::JSDOMWindowShell::unwrappedObject): Added.
• bindings/js/JSDOMWindowShell.h: Declared unwrappedObject.
• bindings/js/JSQuarantinedObjectWrapper.h: (WebCore::JSQuarantinedObjectWrapper::unwrappedObject): Ditto.

LayoutTests:

2008-12-15 Darin Adler <Darin Adler>

Reviewed by Sam Weinig.

• test for <rdar://problem/6427048> crash due to infinite recursion after setting window.proto = window

• fast/canvas/canvas-gradient-without-path.html: Let make-js-test-wrappers update this one.

• fast/dom/Window/resources/TEMPLATE.html: Copied from LayoutTests/fast/js/resources/TEMPLATE.html.
• fast/dom/Window/resources/window-custom-prototype.js: Added.
• fast/dom/Window/window-custom-prototype-expected.txt: Added.
• fast/dom/Window/window-custom-prototype.html: Added.

File:

• trunk/JavaScriptCore/runtime/JSObject.cpp (modified) (2 diffs)

trunk/JavaScriptCore/runtime/JSObject.cpp

@@ -105 +105 @@
 
     if (propertyName == exec->propertyNames().underscoreProto) {
-        JSObject* proto = value->getObject();
-
         // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla.
-        if (!proto && !value->isNull())
+        if (!value->isObject() && !value->isNull())
             return;
-        
-        while (proto) {
-            if (proto == this) {
+
+        JSValue* nextPrototypeValue = value;
+        while (nextPrototypeValue && nextPrototypeValue->isObject()) {
+            JSObject* nextPrototype = asObject(nextPrototypeValue)->unwrappedObject();
+            if (nextPrototype == this) {
                 throwError(exec, GeneralError, "cyclic __proto__ value");
                 return;
             }
-            proto = proto->prototype() ? proto->prototype()->getObject() : 0;
-        }
-        
+            nextPrototypeValue = nextPrototype->prototype();
+        }
+
         setPrototype(value);
         return;
     }
-    
+
     // Check if there are any setters or getters in the prototype chain
     JSValue* prototype;
@@ -459 +459 @@
 }
 
-JSGlobalObject* JSObject::toGlobalObject(ExecState*) const
-{
-    return 0;
+JSObject* JSObject::unwrappedObject()
+{
+    return this;
 }