Changeset 107544 in webkit


Ignore:
Timestamp:
Feb 13, 2012 1:28:44 AM (12 years ago)
Author:
barraclough@apple.com
Message:

​https://bugs.webkit.org/show_bug.cgi?id=78434
Unreviewed - temporarily reverting r107498 will I fix a couple of testcases.

Source/JavaScriptCore:

  • parser/Parser.cpp:

(JSC::::parseFunctionInfo):

  • runtime/ClassInfo.h:

(MethodTable):
(JSC):

  • runtime/JSCell.cpp:

(JSC):

  • runtime/JSCell.h:

(JSCell):

  • runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::reset):

  • runtime/JSGlobalObjectFunctions.cpp:

(JSC):

  • runtime/JSGlobalObjectFunctions.h:

(JSC):

  • runtime/JSObject.cpp:

(JSC::JSObject::put):
(JSC):
(JSC::JSObject::putDirectAccessor):
(JSC::JSObject::defineOwnProperty):

  • runtime/JSObject.h:

(JSC::JSObject::inlineGetOwnPropertySlot):
(JSC::JSValue::get):

  • runtime/JSString.cpp:

(JSC::JSString::getOwnPropertySlot):

  • runtime/JSValue.h:

(JSValue):

  • runtime/ObjectConstructor.cpp:

(JSC::objectConstructorGetPrototypeOf):

  • runtime/Structure.cpp:

(JSC::Structure::Structure):

  • runtime/Structure.h:

(JSC::Structure::setHasGetterSetterProperties):
(Structure):

Source/WebCore:

  • bindings/js/JSDOMWindowBase.cpp:

(WebCore):

  • bindings/js/JSDOMWindowBase.h:

(JSDOMWindowBase):

LayoutTests:

  • fast/js/Object-getOwnPropertyNames-expected.txt:
  • fast/js/cyclic-prototypes-expected.txt:
  • fast/js/parser-syntax-check-expected.txt:
  • fast/js/preventExtensions-expected.txt:
  • fast/js/prototypes-expected.txt:
  • fast/js/script-tests/Object-getOwnPropertyNames.js:
  • fast/js/script-tests/cyclic-prototypes.js:
  • fast/js/script-tests/parser-syntax-check.js:
  • fast/js/script-tests/preventExtensions.js:
  • fast/js/script-tests/prototypes.js:
Location:
trunk
Files:
29 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r107543 r107544  
     12012-02-13  Gavin Barraclough  <barraclough@apple.com>
     2
     3        https://bugs.webkit.org/show_bug.cgi?id=78434
     4        Unreviewed - temporarily reverting r107498 will I fix a couple of testcases.
     5
     6        * fast/js/Object-getOwnPropertyNames-expected.txt:
     7        * fast/js/cyclic-prototypes-expected.txt:
     8        * fast/js/parser-syntax-check-expected.txt:
     9        * fast/js/preventExtensions-expected.txt:
     10        * fast/js/prototypes-expected.txt:
     11        * fast/js/script-tests/Object-getOwnPropertyNames.js:
     12        * fast/js/script-tests/cyclic-prototypes.js:
     13        * fast/js/script-tests/parser-syntax-check.js:
     14        * fast/js/script-tests/preventExtensions.js:
     15        * fast/js/script-tests/prototypes.js:
     16
    1172012-02-13  Pavel Podivilov  <podivilov@chromium.org>
    218

  • trunk/LayoutTests/fast/js/Object-getOwnPropertyNames-expected.txt

    r107498 r107544  
    4242PASS getSortedOwnPropertyNames(encodeURIComponent) is ['length', 'name']
    4343PASS getSortedOwnPropertyNames(Object) is ['create', 'defineProperties', 'defineProperty', 'freeze', 'getOwnPropertyDescriptor', 'getOwnPropertyNames', 'getPrototypeOf', 'isExtensible', 'isFrozen', 'isSealed', 'keys', 'length', 'name', 'preventExtensions', 'prototype', 'seal']
    44 PASS getSortedOwnPropertyNames(Object.prototype) is ['__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__', '__proto__', 'constructor', 'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable', 'toLocaleString', 'toString', 'valueOf']
     44PASS getSortedOwnPropertyNames(Object.prototype) is ['__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__', 'constructor', 'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable', 'toLocaleString', 'toString', 'valueOf']
    4545PASS getSortedOwnPropertyNames(Function) is ['length', 'name', 'prototype']
    4646PASS getSortedOwnPropertyNames(Function.prototype) is ['apply', 'bind', 'call', 'constructor', 'length', 'name', 'toString']

  • trunk/LayoutTests/fast/js/cyclic-prototypes-expected.txt

    r107498 r107544  
    44
    55
    6 PASS o1.__proto__ = o3; threw exception Error: cyclic __proto__ value.
    7 PASS ({}).hasOwnProperty.call(o1, '__proto__') is false
    8 PASS ({}).hasOwnProperty.call(o1, '__proto__') is true
    9 PASS Object.getPrototypeOf(o1) is null
     6PASS o1.__proto__ = o3 threw exception Error: cyclic __proto__ value.
    107PASS successfullyParsed is true
    118

  • trunk/LayoutTests/fast/js/parser-syntax-check-expected.txt

    r107498 r107544  
    542542PASS Invalid: "for(var a,b '"
    543543PASS Invalid: "function f() { for(var a,b ' }"
    544 PASS Valid:  "function __proto__(){}"
    545 PASS Valid:  "function f() { function __proto__(){} }"
    546 PASS Valid:  "(function __proto__(){})"
    547 PASS Valid:  "function f() { (function __proto__(){}) }"
    548 PASS Valid:  "'use strict'; function __proto__(){}"
    549 PASS Valid:  "function f() { 'use strict'; function __proto__(){} }"
    550 PASS Valid:  "'use strict'; (function __proto__(){})"
    551 PASS Valid:  "function f() { 'use strict'; (function __proto__(){}) }"
     544PASS Invalid: "function __proto__(){}"
     545PASS Invalid: "function f() { function __proto__(){} }"
     546PASS Invalid: "(function __proto__(){})"
     547PASS Invalid: "function f() { (function __proto__(){}) }"
     548PASS Invalid: "'use strict'; function __proto__(){}"
     549PASS Invalid: "function f() { 'use strict'; function __proto__(){} }"
     550PASS Invalid: "'use strict'; (function __proto__(){})"
     551PASS Invalid: "function f() { 'use strict'; (function __proto__(){}) }"
    552552PASS Valid:   "if (0) $foo; "
    553553PASS Valid:   "function f() { if (0) $foo;  }"

  • trunk/LayoutTests/fast/js/preventExtensions-expected.txt

    r107498 r107544  
    1313PASS Object.preventExtensions(Math.sin) is Math.sin
    1414PASS var o = {}; Object.preventExtensions(o); o.__proto__ = { newProp: "Should not see this" }; o.newProp; is undefined.
    15 PASS "use strict"; var o = {}; Object.preventExtensions(o); o.__proto__ = { newProp: "Should not see this" }; o.newProp; is undefined.
     15PASS "use strict"; var o = {}; Object.preventExtensions(o); o.__proto__ = { newProp: "Should not see this" }; threw exception TypeError: Attempted to assign to readonly property..
    1616PASS Object.preventExtensions(Math); Math.sqrt(4) is 2
    1717PASS successfullyParsed is true

  • trunk/LayoutTests/fast/js/prototypes-expected.txt

    r107498 r107544  
    5454PASS Object.__proto__.isPrototypeOf(Number) is true
    5555PASS Object.__proto__.isPrototypeOf(String) is true
    56 PASS var wasSet = false; var o = { }; o.__defineGetter__("__proto__", function() { wasSet = true }); o.__proto__; wasSet; is true
    57 PASS var wasSet = false; var o = { }; o.__defineSetter__("__proto__", function() { wasSet = true }); o.__proto__ = {}; wasSet; is true
    58 PASS var wasSet = false; var o = { }; Object.defineProperty(o, "__proto__", { "get": function() { wasSet = true } }); o.__proto__; wasSet; is true
     56PASS var wasSet = false; var o = { }; o.__defineGetter__("__proto__", function() { wasSet = true }); o.__proto__; wasSet; is false
     57PASS var wasSet = false; var o = { }; o.__defineSetter__("__proto__", function() { wasSet = true }); o.__proto__ = {}; wasSet; is false
     58PASS var wasSet = false; var o = { }; Object.defineProperty(o, "__proto__", { "get": function() { wasSet = true } }); o.__proto__; wasSet; is false
    5959PASS var wasSet = false; var o = { }; Object.defineProperty(o, "__proto__", { "__proto__": function(x) { wasSet = true } }); o.__proto__ = {}; wasSet; is false
    60 PASS var o = {}; o.__proto__ = { x:true }; o.x is true
    61 PASS var o = {}; o.__proto__ = { x:true }; o.hasOwnProperty('__proto__') is false
    62 PASS var o = {}; o.__proto__ = { x:true }; o.x is undefined.
    63 PASS var o = {}; o.__proto__ = { x:true }; o.hasOwnProperty('__proto__') is true
    6460PASS successfullyParsed is true
    6561

  • trunk/LayoutTests/fast/js/script-tests/Object-getOwnPropertyNames.js

    r107498 r107544  
    5050// Built-in ECMA objects
    5151    "Object": "['create', 'defineProperties', 'defineProperty', 'freeze', 'getOwnPropertyDescriptor', 'getOwnPropertyNames', 'getPrototypeOf', 'isExtensible', 'isFrozen', 'isSealed', 'keys', 'length', 'name', 'preventExtensions', 'prototype', 'seal']",
    52     "Object.prototype": "['__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__', '__proto__', 'constructor', 'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable', 'toLocaleString', 'toString', 'valueOf']",
     52    "Object.prototype": "['__defineGetter__', '__defineSetter__', '__lookupGetter__', '__lookupSetter__', 'constructor', 'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable', 'toLocaleString', 'toString', 'valueOf']",
    5353    "Function": "['length', 'name', 'prototype']",
    5454    "Function.prototype": "['apply', 'bind', 'call', 'constructor', 'length', 'name', 'toString']",

  • trunk/LayoutTests/fast/js/script-tests/cyclic-prototypes.js

    r107498 r107544  
    77o3.__proto__ = o2;
    88
    9 // Try to create a cyclical prototype chain.
    10 shouldThrow("o1.__proto__ = o3;");
     9o1.__proto__ = null;  // just for sanity's sake
    1110
    12 // This changes behaviour, since __proto__ is an accessor on Object.prototype.
    13 o1.__proto__ = null;
    14 
    15 shouldBeFalse("({}).hasOwnProperty.call(o1, '__proto__')");
    16 o1.__proto__ = o3;
    17 shouldBeTrue("({}).hasOwnProperty.call(o1, '__proto__')");
    18 shouldBe("Object.getPrototypeOf(o1)", "null");
     11shouldThrow("o1.__proto__ = o3");

  • trunk/LayoutTests/fast/js/script-tests/parser-syntax-check.js

    r107498 r107544  
    348348invalid("for(var a,b '");
    349349
    350 valid("function __proto__(){}")
    351 valid("(function __proto__(){})")
    352 valid("'use strict'; function __proto__(){}")
    353 valid("'use strict'; (function __proto__(){})")
     350invalid("function __proto__(){}")
     351invalid("(function __proto__(){})")
     352invalid("'use strict'; function __proto__(){}")
     353invalid("'use strict'; (function __proto__(){})")
    354354
    355355valid("if (0) $foo; ")

  • trunk/LayoutTests/fast/js/script-tests/preventExtensions.js

    r107498 r107544  
    7070
    7171shouldBeUndefined('var o = {}; Object.preventExtensions(o); o.__proto__ = { newProp: "Should not see this" }; o.newProp;');
    72 shouldBeUndefined('"use strict"; var o = {}; Object.preventExtensions(o); o.__proto__ = { newProp: "Should not see this" }; o.newProp;');
     72shouldThrow('"use strict"; var o = {}; Object.preventExtensions(o); o.__proto__ = { newProp: "Should not see this" };');
    7373
    7474// check that we can still access static properties on an object after calling preventExtensions.

  • trunk/LayoutTests/fast/js/script-tests/prototypes.js

    r107498 r107544  
    5656shouldBeTrue("Object.__proto__.isPrototypeOf(String)");
    5757
    58 shouldBeTrue("var wasSet = false; var o = { }; o.__defineGetter__(\"__proto__\", function() { wasSet = true }); o.__proto__; wasSet;");
    59 shouldBeTrue("var wasSet = false; var o = { }; o.__defineSetter__(\"__proto__\", function() { wasSet = true }); o.__proto__ = {}; wasSet;");
    60 shouldBeTrue("var wasSet = false; var o = { }; Object.defineProperty(o, \"__proto__\", { \"get\": function() { wasSet = true } }); o.__proto__; wasSet;");
     58shouldBeFalse("var wasSet = false; var o = { }; o.__defineGetter__(\"__proto__\", function() { wasSet = true }); o.__proto__; wasSet;");
     59shouldBeFalse("var wasSet = false; var o = { }; o.__defineSetter__(\"__proto__\", function() { wasSet = true }); o.__proto__ = {}; wasSet;");
     60shouldBeFalse("var wasSet = false; var o = { }; Object.defineProperty(o, \"__proto__\", { \"get\": function() { wasSet = true } }); o.__proto__; wasSet;");
    6161shouldBeFalse("var wasSet = false; var o = { }; Object.defineProperty(o, \"__proto__\", { \"__proto__\": function(x) { wasSet = true } }); o.__proto__ = {}; wasSet;");
    62 
    63 // Deleting Object.prototype.__proto__ removes the ability to set the object's prototype.
    64 shouldBeTrue("var o = {}; o.__proto__ = { x:true }; o.x");
    65 shouldBeFalse("var o = {}; o.__proto__ = { x:true }; o.hasOwnProperty('__proto__')");
    66 delete Object.prototype.__proto__;
    67 shouldBeUndefined("var o = {}; o.__proto__ = { x:true }; o.x");
    68 shouldBeTrue("var o = {}; o.__proto__ = { x:true }; o.hasOwnProperty('__proto__')");

  • trunk/Source/JavaScriptCore/ChangeLog

    r107527 r107544  
     12012-02-13  Gavin Barraclough  <barraclough@apple.com>
     2
     3        https://bugs.webkit.org/show_bug.cgi?id=78434
     4        Unreviewed - temporarily reverting r107498 will I fix a couple of testcases.
     5
     6        * parser/Parser.cpp:
     7        (JSC::::parseFunctionInfo):
     8        * runtime/ClassInfo.h:
     9        (MethodTable):
     10        (JSC):
     11        * runtime/JSCell.cpp:
     12        (JSC):
     13        * runtime/JSCell.h:
     14        (JSCell):
     15        * runtime/JSGlobalObject.cpp:
     16        (JSC::JSGlobalObject::reset):
     17        * runtime/JSGlobalObjectFunctions.cpp:
     18        (JSC):
     19        * runtime/JSGlobalObjectFunctions.h:
     20        (JSC):
     21        * runtime/JSObject.cpp:
     22        (JSC::JSObject::put):
     23        (JSC):
     24        (JSC::JSObject::putDirectAccessor):
     25        (JSC::JSObject::defineOwnProperty):
     26        * runtime/JSObject.h:
     27        (JSC::JSObject::inlineGetOwnPropertySlot):
     28        (JSC::JSValue::get):
     29        * runtime/JSString.cpp:
     30        (JSC::JSString::getOwnPropertySlot):
     31        * runtime/JSValue.h:
     32        (JSValue):
     33        * runtime/ObjectConstructor.cpp:
     34        (JSC::objectConstructorGetPrototypeOf):
     35        * runtime/Structure.cpp:
     36        (JSC::Structure::Structure):
     37        * runtime/Structure.h:
     38        (JSC::Structure::setHasGetterSetterProperties):
     39        (Structure):
     40
    1412012-02-12  Ashod Nakashian  <ashodnakashian@yahoo.com>
    242

  • trunk/Source/JavaScriptCore/parser/Parser.cpp

    r107498 r107544  
    775775    if (match(IDENT)) {
    776776        name = m_token.m_data.ident;
     777        failIfTrueWithMessage(*name == m_globalData->propertyNames->underscoreProto, "Cannot name a function __proto__");
    777778        next();
    778779        if (!nameIsInContainingScope)

  • trunk/Source/JavaScriptCore/runtime/ClassInfo.h

    r107498 r107544  
    9090        typedef bool (*GetOwnPropertyDescriptorFunctionPtr)(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
    9191        GetOwnPropertyDescriptorFunctionPtr getOwnPropertyDescriptor;
    92 
    93         typedef bool (*AllowsAccessFromFunctionPtr)(JSObject*, ExecState*);
    94         AllowsAccessFromFunctionPtr allowsAccessFrom;
    9592    };
    9693
    … …  
    134131        &ClassName::defineOwnProperty, \
    135132        &ClassName::getOwnPropertyDescriptor, \
    136         &ClassName::allowsAccessFrom, \
    137133    }, \
    138134    sizeof(ClassName), \

  • trunk/Source/JavaScriptCore/runtime/JSCell.cpp

    r107498 r107544  
    192192}
    193193
    194 bool JSCell::allowsAccessFrom(JSObject*, ExecState*)
     194bool JSCell::defineOwnProperty(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&, bool)
    195195{
    196196    ASSERT_NOT_REACHED();
    … …  
    198198}
    199199
    200 bool JSCell::defineOwnProperty(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&, bool)
     200bool JSCell::getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&)
    201201{
    202202    ASSERT_NOT_REACHED();
    … …  
    204204}
    205205
    206 bool JSCell::getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&)
    207 {
    208     ASSERT_NOT_REACHED();
    209     return false;
    210 }
    211 
    212206} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/JSCell.h

    r107498 r107544  
    162162        static bool defineOwnProperty(JSObject*, ExecState*, const Identifier& propertyName, PropertyDescriptor&, bool shouldThrow);
    163163        static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
    164         static bool allowsAccessFrom(JSObject*, ExecState*);
    165164
    166165    private:

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

    r107498 r107544  
    206206    m_applyFunction.set(exec->globalData(), this, applyFunction);
    207207    m_objectPrototype.set(exec->globalData(), this, ObjectPrototype::create(exec, this, ObjectPrototype::createStructure(exec->globalData(), this, jsNull())));
    208     GetterSetter* protoAccessor = GetterSetter::create(exec);
    209     protoAccessor->setGetter(exec->globalData(), JSFunction::create(exec, this, 0, Identifier(), globalFuncProtoGetter));
    210     protoAccessor->setSetter(exec->globalData(), JSFunction::create(exec, this, 0, Identifier(), globalFuncProtoSetter));
    211     m_objectPrototype->putDirectAccessor(exec->globalData(), exec->propertyNames().underscoreProto, protoAccessor, Accessor | DontEnum);
    212208    m_functionPrototype->structure()->setPrototypeWithoutTransition(exec->globalData(), m_objectPrototype.get());
    213209

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp

    r107498 r107544  
    715715}
    716716
    717 EncodedJSValue JSC_HOST_CALL globalFuncProtoGetter(ExecState* exec)
    718 {
    719     if (!exec->thisValue().isObject())
    720         return JSValue::encode(exec->thisValue().synthesizePrototype(exec));
    721 
    722     JSObject* thisObject = asObject(exec->thisValue());
    723     if (!thisObject->methodTable()->allowsAccessFrom(thisObject, exec))
    724         return JSValue::encode(jsUndefined());
    725 
    726     return JSValue::encode(thisObject->prototype());
    727 }
    728 
    729 EncodedJSValue JSC_HOST_CALL globalFuncProtoSetter(ExecState* exec)
    730 {
    731     JSValue value = exec->argument(0);
    732 
    733     // Setting __proto__ of a primitive should have no effect.
    734     if (!exec->thisValue().isObject())
    735         return JSValue::encode(jsUndefined());
    736 
    737     JSObject* thisObject = asObject(exec->thisValue());
    738     if (!thisObject->methodTable()->allowsAccessFrom(thisObject, exec))
    739         return JSValue::encode(jsUndefined());
    740 
    741     // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla.
    742     if (!value.isObject() && !value.isNull())
    743         return JSValue::encode(jsUndefined());
    744 
    745     if (!thisObject->isExtensible())
    746         return JSValue::encode(jsUndefined());
    747 
    748     if (!thisObject->setPrototypeWithCycleCheck(exec->globalData(), value))
    749         throwError(exec, createError(exec, "cyclic __proto__ value"));
    750 
    751     return JSValue::encode(jsUndefined());
    752 }
    753 
    754717} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h

    r107498 r107544  
    4949    EncodedJSValue JSC_HOST_CALL globalFuncUnescape(ExecState*);
    5050    EncodedJSValue JSC_HOST_CALL globalFuncThrowTypeError(ExecState*);
    51     EncodedJSValue JSC_HOST_CALL globalFuncProtoGetter(ExecState*);
    52     EncodedJSValue JSC_HOST_CALL globalFuncProtoSetter(ExecState*);
    5351
    5452    static const double mantissaOverflowLowerBound = 9007199254740992.0;

  • trunk/Source/JavaScriptCore/runtime/JSObject.cpp

    r107498 r107544  
    133133    JSGlobalData& globalData = exec->globalData();
    134134
     135    if (propertyName == exec->propertyNames().underscoreProto) {
     136        // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla.
     137        if (!value.isObject() && !value.isNull())
     138            return;
     139
     140        if (!thisObject->isExtensible()) {
     141            if (slot.isStrictMode())
     142                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
     143            return;
     144        }
     145           
     146        if (!thisObject->setPrototypeWithCycleCheck(globalData, value))
     147            throwError(exec, createError(exec, "cyclic __proto__ value"));
     148        return;
     149    }
     150
    135151    // Check if there are any setters or getters in the prototype chain
    136152    JSValue prototype;
    137     if (propertyName != exec->propertyNames().underscoreProto) {
    138         for (JSObject* obj = thisObject; !obj->structure()->hasGetterSetterPropertiesExcludingProto(); obj = asObject(prototype)) {
    139             prototype = obj->prototype();
    140             if (prototype.isNull()) {
    141                 if (!thisObject->putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getJSFunction(value)) && slot.isStrictMode())
    142                     throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
    143                 return;
    144             }
    145         }
    146     }
    147 
     153    for (JSObject* obj = thisObject; !obj->structure()->hasGetterSetterProperties(); obj = asObject(prototype)) {
     154        prototype = obj->prototype();
     155        if (prototype.isNull()) {
     156            if (!thisObject->putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getJSFunction(value)) && slot.isStrictMode())
     157                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
     158            return;
     159        }
     160    }
     161   
    148162    unsigned attributes;
    149163    JSCell* specificValue;
    … …  
    202216}
    203217
    204 bool JSObject::allowsAccessFrom(JSObject*, ExecState*)
    205 {
    206     return true;
    207 }
    208 
    209218void JSObject::putDirectAccessor(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
    210219{
    211220    ASSERT(value.isGetterSetter() && (attributes & Accessor));
     221    ASSERT(propertyName != globalData.propertyNames->underscoreProto);
    212222
    213223    PutPropertySlot slot;
    … …  
    220230        setStructure(globalData, Structure::attributeChangeTransition(globalData, structure(), propertyName, attributes));
    221231
    222     structure()->setHasGetterSetterProperties(propertyName == globalData.propertyNames->underscoreProto);
     232    structure()->setHasGetterSetterProperties(true);
    223233}
    224234
    … …  
    620630bool JSObject::defineOwnProperty(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool throwException)
    621631{
     632    // __proto__ is magic; we don't currently support setting it as a regular property.
     633    // Silent filter out calls to set __proto__ at an early stage; pretend all is okay.
     634    if (propertyName == exec->propertyNames().underscoreProto)
     635        return true;
     636
    622637    // If we have a new property we can just put it on normally
    623638    PropertyDescriptor current;

  • trunk/Source/JavaScriptCore/runtime/JSObject.h

    r107498 r107544  
    105105        JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned propertyName, PropertySlot&);
    106106        JS_EXPORT_PRIVATE static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
    107         JS_EXPORT_PRIVATE static bool allowsAccessFrom(JSObject*, ExecState*);
    108107
    109108        JS_EXPORT_PRIVATE static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
    … …  
    549548        else
    550549            slot.setValue(this, location->get(), offsetForLocation(location));
     550        return true;
     551    }
     552
     553    // non-standard Netscape extension
     554    if (propertyName == exec->propertyNames().underscoreProto) {
     555        slot.setValue(prototype());
    551556        return true;
    552557    }
    … …  
    799804    if (UNLIKELY(!isCell())) {
    800805        JSObject* prototype = synthesizePrototype(exec);
     806        if (propertyName == exec->propertyNames().underscoreProto)
     807            return prototype;
    801808        if (!prototype->getPropertySlot(exec, propertyName, slot))
    802809            return jsUndefined();

  • trunk/Source/JavaScriptCore/runtime/JSString.cpp

    r107498 r107544  
    254254    if (thisObject->getStringPropertySlot(exec, propertyName, slot))
    255255        return true;
     256    if (propertyName == exec->propertyNames().underscoreProto) {
     257        slot.setValue(exec->lexicalGlobalObject()->stringPrototype());
     258        return true;
     259    }
    256260    slot.setBase(thisObject);
    257261    JSObject* object;

  • trunk/Source/JavaScriptCore/runtime/JSValue.h

    r107498 r107544  
    235235        char* description();
    236236
    237         JS_EXPORT_PRIVATE JSObject* synthesizePrototype(ExecState*) const;
    238 
    239237    private:
    240238        template <class T> JSValue(WriteBarrierBase<T>);
    … …  
    249247        JS_EXPORT_PRIVATE JSObject* toThisObjectSlowCase(ExecState*) const;
    250248
     249        JS_EXPORT_PRIVATE JSObject* synthesizePrototype(ExecState*) const;
    251250        JSObject* synthesizeObject(ExecState*) const;
    252251

  • trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp

    r107498 r107544  
    139139    if (!exec->argument(0).isObject())
    140140        return throwVMError(exec, createTypeError(exec, "Requested prototype of a value that is not an object."));
    141     JSObject* object = asObject(exec->argument(0));
    142 
    143     if (!object->methodTable()->allowsAccessFrom(object, exec))
    144         return JSValue::encode(jsUndefined());
    145 
    146     return JSValue::encode(object->prototype());
     141       
     142    // This uses JSValue::get() instead of directly accessing the prototype from the object
     143    // (using JSObject::prototype()) in order to allow objects to override the behavior, such
     144    // as returning jsUndefined() for cross-origin access.
     145    return JSValue::encode(exec->argument(0).get(exec, exec->propertyNames().underscoreProto));
    147146}
    148147

  • trunk/Source/JavaScriptCore/runtime/Structure.cpp

    r107499 r107544  
    168168    , m_isPinnedPropertyTable(false)
    169169    , m_hasGetterSetterProperties(false)
    170     , m_hasGetterSetterPropertiesExcludingProto(false)
    171170    , m_hasNonEnumerableProperties(false)
    172171    , m_attributesInPrevious(0)
    … …  
    190189    , m_isPinnedPropertyTable(false)
    191190    , m_hasGetterSetterProperties(false)
    192     , m_hasGetterSetterPropertiesExcludingProto(false)
    193191    , m_hasNonEnumerableProperties(false)
    194192    , m_attributesInPrevious(0)
    … …  
    210208    , m_isPinnedPropertyTable(false)
    211209    , m_hasGetterSetterProperties(previous->m_hasGetterSetterProperties)
    212     , m_hasGetterSetterPropertiesExcludingProto(previous->m_hasGetterSetterPropertiesExcludingProto)
    213210    , m_hasNonEnumerableProperties(previous->m_hasNonEnumerableProperties)
    214211    , m_attributesInPrevious(0)

  • trunk/Source/JavaScriptCore/runtime/Structure.h

    r107498 r107544  
    146146
    147147        bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
    148         bool hasGetterSetterPropertiesExcludingProto() const { return m_hasGetterSetterPropertiesExcludingProto; }
    149         void setHasGetterSetterProperties(bool isProto)
    150         {
    151             m_hasGetterSetterProperties = true;
    152             if (!isProto)
    153                 m_hasGetterSetterPropertiesExcludingProto = true;
    154         }
     148        void setHasGetterSetterProperties(bool hasGetterSetterProperties) { m_hasGetterSetterProperties = hasGetterSetterProperties; }
    155149
    156150        bool hasNonEnumerableProperties() const { return m_hasNonEnumerableProperties; }
    … …  
    289283        bool m_isPinnedPropertyTable : 1;
    290284        bool m_hasGetterSetterProperties : 1;
    291         bool m_hasGetterSetterPropertiesExcludingProto : 1;
    292285        bool m_hasNonEnumerableProperties : 1;
    293286        unsigned m_attributesInPrevious : 7;

  • trunk/Source/WebCore/ChangeLog

    r107542 r107544  
     12012-02-13  Gavin Barraclough  <barraclough@apple.com>
     2
     3        https://bugs.webkit.org/show_bug.cgi?id=78434
     4        Unreviewed - temporarily reverting r107498 will I fix a couple of testcases.
     5
     6        * bindings/js/JSDOMWindowBase.cpp:
     7        (WebCore):
     8        * bindings/js/JSDOMWindowBase.h:
     9        (JSDOMWindowBase):
     10
    1112012-02-13  Ilya Tikhonovsky  <loislo@chromium.org>
    212

  • trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp

    r107498 r107544  
    9393}
    9494
    95 bool JSDOMWindowBase::allowsAccessFrom(JSObject* thisObject, ExecState* exec)
    96 {
    97     return static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec);
    98 }
    99 
    10095bool JSDOMWindowBase::supportsProfiling(const JSGlobalObject* object)
    10196{

  • trunk/Source/WebCore/bindings/js/JSDOMWindowBase.h

    r107498 r107544  
    6464        static bool supportsRichSourceInfo(const JSC::JSGlobalObject*);
    6565        static bool shouldInterruptScript(const JSC::JSGlobalObject*);
    66         static bool allowsAccessFrom(JSC::JSObject*, JSC::ExecState*);
    67        
     66
    6867        bool allowsAccessFrom(JSC::ExecState*) const;
    6968        bool allowsAccessFromNoErrorMessage(JSC::ExecState*) const;
Note: See TracChangeset for help on using the changeset viewer.