Changeset 117025 in webkit

Timestamp:

May 14, 2012, 8:43:54 PM (14 years ago)

Author:

barraclough@apple.com

Message:

Cannot login to iCloud
​https://bugs.webkit.org/show_bug.cgi?id=86321

Reviewed by Filip Pizlo.

This is a bug introduced by bug#85853, we shouldn't allow assignment to
the prototype property of functions to be cached, since we need to clear
the cached inheritorID.

• runtime/JSFunction.cpp:

(JSC::JSFunction::put):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSFunction.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2012-05-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Cannot login to iCloud
+        https://bugs.webkit.org/show_bug.cgi?id=86321
+
+        Reviewed by Filip Pizlo.
+
+        This is a bug introduced by bug#85853, we shouldn't allow assignment to
+        the prototype property of functions to be cached, since we need to clear
+        the cached inheritorID.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::put):
+
 2012-05-14  Michael Saboff  <msaboff@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSFunction.cpp

@@ -344 +344 @@
         thisObject->methodTable()->getOwnPropertySlot(thisObject, exec, propertyName, slot);
         thisObject->m_cachedInheritorID.clear();
+        // Don't allow this to be cached, since a [[Put]] must clear m_cachedInheritorID.
+        PutPropertySlot dontCache;
+        Base::put(thisObject, exec, propertyName, value, dontCache);
+        return;
     }
     if (thisObject->jsExecutable()->isStrictMode() && (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().caller)) {