Changeset 196676 in webkit

Timestamp:

Feb 16, 2016 5:37:56 PM (8 years ago)

Author:

barraclough@apple.com

Message:

JSDOMWindow::getOwnPropertySlot should not search photo chain
​https://bugs.webkit.org/show_bug.cgi?id=154102

Reviewed by Chris Dumez.

Should only return *own* properties.

Source/JavaScriptCore:

• runtime/JSObject.cpp:

(JSC::JSObject::getOwnPropertyDescriptor):

• remove hack/special-case for DOMWindow; we no longer need this.

Source/WebCore:

• bindings/js/JSDOMWindowCustom.cpp:

(WebCore::jsDOMWindowGetOwnPropertySlotNamedItemGetter):

LayoutTests:

• fast/dom/Window/es52-globals-expected.txt:
• http/tests/security/window-named-valueOf-expected.txt:
• imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:
  • update test results.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/Window/es52-globals-expected.txt (modified) (1 diff)
• LayoutTests/http/tests/security/window-named-valueOf-expected.txt (modified) (1 diff)
• LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSObject.cpp (modified) (1 diff)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2016-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        JSDOMWindow::getOwnPropertySlot should not search photo chain
+        https://bugs.webkit.org/show_bug.cgi?id=154102
+
+        Reviewed by Chris Dumez.
+
+        Should only return *own* properties.
+
+        * fast/dom/Window/es52-globals-expected.txt:
+        * http/tests/security/window-named-valueOf-expected.txt:
+        * imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:
+            - update test results.
+
 2016-02-16  Keith Miller  <keith_miller@apple.com>
 

trunk/LayoutTests/fast/dom/Window/es52-globals-expected.txt

@@ -1 +1 @@
 PASS window.hasOwnProperty("Element") is true
 PASS window.hasOwnProperty("x") is true
-FAIL window.hasOwnProperty("y") should be false. Was true.
+PASS window.hasOwnProperty("y") is false
 PASS window.hasOwnProperty("f") is true
 PASS window.hasOwnProperty("div") is true

trunk/LayoutTests/http/tests/security/window-named-valueOf-expected.txt

@@ +1 @@
+CONSOLE MESSAGE: line 1: Blocked a frame with origin "null" from accessing a frame with origin "http://localhost:8080".  The frame requesting access has a protocol of "data", the frame being accessed has a protocol of "http". Protocols must match.
+
 CONSOLE MESSAGE: line 1: Blocked a frame with origin "null" from accessing a frame with origin "http://localhost:8080".  The frame requesting access has a protocol of "data", the frame being accessed has a protocol of "http". Protocols must match.
 

trunk/LayoutTests/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt

@@ -4085 +4085 @@
 PASS Window interface: window must inherit property "sessionStorage" with the proper type (123) 
 PASS Window interface: window must inherit property "localStorage" with the proper type (124) 
-FAIL EventTarget interface: window must inherit property "addEventListener" with the proper type (0) assert_inherits: property "addEventListener" found on object expected in prototype chain
-FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on window with too few arguments must throw TypeError assert_inherits: property "addEventListener" found on object expected in prototype chain
-FAIL EventTarget interface: window must inherit property "removeEventListener" with the proper type (1) assert_inherits: property "removeEventListener" found on object expected in prototype chain
-FAIL EventTarget interface: calling removeEventListener(DOMString,EventListener,boolean) on window with too few arguments must throw TypeError assert_inherits: property "removeEventListener" found on object expected in prototype chain
-FAIL EventTarget interface: window must inherit property "dispatchEvent" with the proper type (2) assert_inherits: property "dispatchEvent" found on object expected in prototype chain
-FAIL EventTarget interface: calling dispatchEvent(Event) on window with too few arguments must throw TypeError assert_inherits: property "dispatchEvent" found on object expected in prototype chain
+PASS EventTarget interface: window must inherit property "addEventListener" with the proper type (0) 
+FAIL EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on window with too few arguments must throw TypeError assert_throws: Called with 0 arguments function "function () {
+    [native code]
+}" did not throw
+PASS EventTarget interface: window must inherit property "removeEventListener" with the proper type (1) 
+FAIL EventTarget interface: calling removeEventListener(DOMString,EventListener,boolean) on window with too few arguments must throw TypeError assert_throws: Called with 0 arguments function "function () {
+    [native code]
+}" did not throw
+PASS EventTarget interface: window must inherit property "dispatchEvent" with the proper type (2) 
+PASS EventTarget interface: calling dispatchEvent(Event) on window with too few arguments must throw TypeError 
 PASS BarProp interface: existence and properties of interface object 
 PASS BarProp interface object length 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        JSDOMWindow::getOwnPropertySlot should not search photo chain
+        https://bugs.webkit.org/show_bug.cgi?id=154102
+
+        Reviewed by Chris Dumez.
+
+        Should only return *own* properties.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnPropertyDescriptor):
+            - remove hack/special-case for DOMWindow; we no longer need this.
+
 2016-02-16  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSObject.cpp

@@ -2553 +2553 @@
         return false;
 
-    // JSDOMWindow::getOwnPropertySlot() may return attributes from the prototype chain but getOwnPropertyDescriptor()
-    // should only work for 'own' properties so we exit early if we detect that the property is not an own property.
-    if (slot.slotBase() != this && slot.slotBase()) {
-        auto* proxy = jsDynamicCast<JSProxy*>(this);
-        // In the case of DOMWindow, |this| may be a JSDOMWindowShell so we also need to check the shell's target Window.
-        if (!proxy || proxy->target() != slot.slotBase())
-            return false;
-    }
-
     if (slot.isAccessor())
         descriptor.setAccessorDescriptor(slot.getterSetter(), slot.attributes());

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2016-02-16  Gavin Barraclough  <barraclough@apple.com>
+
+        JSDOMWindow::getOwnPropertySlot should not search photo chain
+        https://bugs.webkit.org/show_bug.cgi?id=154102
+
+        Reviewed by Chris Dumez.
+
+        Should only return *own* properties.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::jsDOMWindowGetOwnPropertySlotNamedItemGetter):
+
 2016-02-16  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp

@@ -193 +193 @@
 static bool jsDOMWindowGetOwnPropertySlotNamedItemGetter(JSDOMWindow* thisObject, Frame& frame, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
 {
-    // FIXME: If the property is present on the prototype we should 'return false;', not
-    // return the property. This is supposed to be an 'own' access.
     JSValue proto = thisObject->prototype();
-    if (proto.isObject() && asObject(proto)->getPropertySlot(exec, propertyName, slot))
-        return true;
+    if (proto.isObject() && asObject(proto)->hasProperty(exec, propertyName))
+        return false;
 
     // Check for child frames by name before built-in properties to match Mozilla. This does