JavaScriptCore:
2008-12-15 Darin Adler <Darin Adler>
Reviewed by Sam Weinig.
- fix <rdar://problem/6427048> crash due to infinite recursion after setting window.proto = window
Replaced toGlobalObject with the more generally useful unwrappedObject and used it to
fix the cycle detection code in put(proto).
- runtime/JSGlobalObject.cpp: Removed toGlobalObject. We now use unwrappedObject instead.
- runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::isGlobalObject): Ditto.
- runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncEval): Use unwrappedObject and isGlobalObject here rather than toGlobalObject.
- runtime/JSObject.cpp:
(JSC::JSObject::put): Rewrote prototype cycle checking loop. Use unwrappedObject in the loop now.
(JSC::JSObject::unwrappedObject): Replaced toGlobalObject with this new function.
- runtime/JSObject.h: More of the same.
WebCore:
2008-12-15 Darin Adler <Darin Adler>
Reviewed by Sam Weinig.
- fix <rdar://problem/6427048> crash due to infinite recursion after setting window.proto = window
Test: fast/dom/Window/window-custom-prototype.html
Replaced toGlobalObject with the more generally useful unwrappedObject.
- bindings/js/JSDOMWindowShell.cpp:
(WebCore::JSDOMWindowShell::unwrappedObject): Added.
- bindings/js/JSDOMWindowShell.h: Declared unwrappedObject.
- bindings/js/JSQuarantinedObjectWrapper.h:
(WebCore::JSQuarantinedObjectWrapper::unwrappedObject): Ditto.
LayoutTests:
2008-12-15 Darin Adler <Darin Adler>
Reviewed by Sam Weinig.
- test for <rdar://problem/6427048> crash due to infinite recursion after setting window.proto = window
- fast/canvas/canvas-gradient-without-path.html: Let make-js-test-wrappers update this one.
- fast/dom/Window/resources/TEMPLATE.html: Copied from LayoutTests/fast/js/resources/TEMPLATE.html.
- fast/dom/Window/resources/window-custom-prototype.js: Added.
- fast/dom/Window/window-custom-prototype-expected.txt: Added.
- fast/dom/Window/window-custom-prototype.html: Added.
