Changeset 148106 in webkit

Timestamp:

Apr 10, 2013 10:47:44 AM (11 years ago)

Author:

oliver@apple.com

Message:

REGRESSION (r148073): WebKit Nightly r148082 crashes on launch in JSObjectSetPrivate
​https://bugs.webkit.org/show_bug.cgi?id=114341

Reviewed by Alexey Proskuryakov.

Make JSObjectSetPrivate use uncheckedToJS as some clients
clear their private data during finalization for some reason.

• API/JSObjectRef.cpp:

(JSObjectSetPrivate):

Location:

trunk/Source/JavaScriptCore

Files:

• API/JSObjectRef.cpp (modified) (1 diff)
• ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/API/JSObjectRef.cpp

@@ -357 +357 @@
 bool JSObjectSetPrivate(JSObjectRef object, void* data)
 {
-    JSObject* jsObject = toJS(object);
+    JSObject* jsObject = uncheckedToJS(object);
     
     if (jsObject->inherits(&JSCallbackObject<JSGlobalObject>::s_info)) {

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2013-04-10  Oliver Hunt  <oliver@apple.com>
+
+        REGRESSION (r148073): WebKit Nightly r148082 crashes on launch in JSObjectSetPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=114341
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make JSObjectSetPrivate use uncheckedToJS as some clients
+        clear their private data during finalization for some reason.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrivate):
+
 2013-04-09  Oliver Hunt  <oliver@apple.com>