Changeset 82173 in webkit


Ignore:
Timestamp:
Mar 28, 2011 4:39:16 PM (13 years ago)
Author:
oliver@apple.com
Message:

2011-03-28 Oliver Hunt <​oliver@apple.com>

Reviewed by Geoffrey Garen.

instanceof Array test fails when using iframes
​https://bugs.webkit.org/show_bug.cgi?id=17250

Add test cases for correct behaviour

  • fast/js/js-constructors-use-correct-global-expected.txt: Added.
  • fast/js/js-constructors-use-correct-global.html: Added.
  • fast/js/resources/js-constructors-use-correct-global.js: Added.

2011-03-28 Oliver Hunt <​oliver@apple.com>

Reviewed by Geoffrey Garen.

instanceof Array test fails when using iframes
​https://bugs.webkit.org/show_bug.cgi?id=17250

This is a problem with all built in constructors, the use of
lexicalGlobalObject rather than the constructors own
global object reference means that a builtin will always use
the prototype from the lexical global object rather than that
of the constructors origin.

  • API/JSObjectRef.cpp: (JSObjectMakeFunction): (JSObjectMakeRegExp):
  • JavaScriptCore.exp:
  • runtime/ArrayConstructor.cpp: (JSC::constructArrayWithSizeQuirk):
  • runtime/BooleanConstructor.cpp: (JSC::constructBoolean): (JSC::constructBooleanFromImmediateBoolean):
  • runtime/BooleanConstructor.h:
  • runtime/DateConstructor.cpp: (JSC::constructDate):
  • runtime/DateInstance.cpp:
  • runtime/DateInstance.h:
  • runtime/ErrorConstructor.cpp: (JSC::constructWithErrorConstructor): (JSC::callErrorConstructor):
  • runtime/FunctionConstructor.cpp: (JSC::constructWithFunctionConstructor): (JSC::callFunctionConstructor): (JSC::constructFunction):
  • runtime/FunctionConstructor.h:
  • runtime/JSCell.cpp: (JSC::JSCell::getOwnPropertySlot): (JSC::JSCell::put): (JSC::JSCell::deleteProperty): (JSC::JSCell::toThisObject): (JSC::JSCell::toObject):
  • runtime/JSCell.h: (JSC::JSCell::JSValue::toObject):
  • runtime/JSNotAnObject.cpp: (JSC::JSNotAnObject::toObject):
  • runtime/JSNotAnObject.h:
  • runtime/JSObject.cpp: (JSC::JSObject::toObject):
  • runtime/JSObject.h:
  • runtime/JSString.cpp: (JSC::StringObject::create): (JSC::JSString::toObject): (JSC::JSString::toThisObject):
  • runtime/JSString.h:
  • runtime/JSValue.cpp: (JSC::JSValue::toObjectSlowCase): (JSC::JSValue::toThisObjectSlowCase): (JSC::JSValue::synthesizeObject):
  • runtime/JSValue.h:
  • runtime/NumberConstructor.cpp: (JSC::constructWithNumberConstructor):
  • runtime/NumberObject.cpp: (JSC::constructNumber):
  • runtime/NumberObject.h:
  • runtime/ObjectConstructor.cpp: (JSC::constructObject): (JSC::constructWithObjectConstructor): (JSC::callObjectConstructor):
  • runtime/RegExpConstructor.cpp: (JSC::constructRegExp): (JSC::constructWithRegExpConstructor): (JSC::callRegExpConstructor):
  • runtime/RegExpConstructor.h:
  • runtime/StringConstructor.cpp: (JSC::constructWithStringConstructor):
  • runtime/StringObject.h:

2011-03-25 Oliver Hunt <​oliver@apple.com>

Reviewed by Geoffrey Garen.

instanceof Array test fails when using iframes
​https://bugs.webkit.org/show_bug.cgi?id=17250

Up date for new toObject api

  • UserObjectImp.cpp: (UserObjectImp::toPrimitive): (UserObjectImp::toBoolean): (UserObjectImp::toNumber): (UserObjectImp::toString):

2011-03-28 Oliver Hunt <​oliver@apple.com>

Reviewed by Geoffrey Garen.

instanceof Array test fails when using iframes
​https://bugs.webkit.org/show_bug.cgi?id=17250

Update for new function and date apis

Test: fast/js/js-constructors-use-correct-global.html

  • WebCore.xcodeproj/project.pbxproj:
  • bindings/js/JSDOMBinding.cpp: (WebCore::jsDateOrNull):
  • bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::initializeJSFunction):
Location:
trunk
Files:
3 added
39 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r82169 r82173  
     12011-03-28  Oliver Hunt  <oliver@apple.com>
     2
     3        Reviewed by Geoffrey Garen.
     4
     5        instanceof Array test fails when using iframes
     6        https://bugs.webkit.org/show_bug.cgi?id=17250
     7
     8        Add test cases for correct behaviour
     9
     10        * fast/js/js-constructors-use-correct-global-expected.txt: Added.
     11        * fast/js/js-constructors-use-correct-global.html: Added.
     12        * fast/js/resources/js-constructors-use-correct-global.js: Added.
     13
    1142011-03-28  Vincent Scheib  <scheib@chromium.org>
    215

  • trunk/Source/JavaScriptCore/API/JSObjectRef.cpp

    r79132 r82173  
    125125    args.append(jsString(exec, body->ustring()));
    126126
    127     JSObject* result = constructFunction(exec, args, nameID, sourceURL->ustring(), startingLineNumber);
     127    JSObject* result = constructFunction(exec, exec->lexicalGlobalObject(), args, nameID, sourceURL->ustring(), startingLineNumber);
    128128    if (exec->hadException()) {
    129129        if (exception)
    … …  
    208208        argList.append(toJS(exec, arguments[i]));
    209209
    210     JSObject* result = constructRegExp(exec, argList);
     210    JSObject* result = constructRegExp(exec, exec->lexicalGlobalObject(),  argList);
    211211    if (exec->hadException()) {
    212212        if (exception)

  • trunk/Source/JavaScriptCore/ChangeLog

    r82162 r82173  
     12011-03-28  Oliver Hunt  <oliver@apple.com>
     2
     3        Reviewed by Geoffrey Garen.
     4
     5        instanceof Array test fails when using iframes
     6        https://bugs.webkit.org/show_bug.cgi?id=17250
     7
     8        This is a problem with all built in constructors, the use of
     9        lexicalGlobalObject rather than the constructors own
     10        global object reference means that a builtin will always use
     11        the prototype from the lexical global object rather than that
     12        of the constructors origin.
     13
     14        * API/JSObjectRef.cpp:
     15        (JSObjectMakeFunction):
     16        (JSObjectMakeRegExp):
     17        * JavaScriptCore.exp:
     18        * runtime/ArrayConstructor.cpp:
     19        (JSC::constructArrayWithSizeQuirk):
     20        * runtime/BooleanConstructor.cpp:
     21        (JSC::constructBoolean):
     22        (JSC::constructBooleanFromImmediateBoolean):
     23        * runtime/BooleanConstructor.h:
     24        * runtime/DateConstructor.cpp:
     25        (JSC::constructDate):
     26        * runtime/DateInstance.cpp:
     27        * runtime/DateInstance.h:
     28        * runtime/ErrorConstructor.cpp:
     29        (JSC::constructWithErrorConstructor):
     30        (JSC::callErrorConstructor):
     31        * runtime/FunctionConstructor.cpp:
     32        (JSC::constructWithFunctionConstructor):
     33        (JSC::callFunctionConstructor):
     34        (JSC::constructFunction):
     35        * runtime/FunctionConstructor.h:
     36        * runtime/JSCell.cpp:
     37        (JSC::JSCell::getOwnPropertySlot):
     38        (JSC::JSCell::put):
     39        (JSC::JSCell::deleteProperty):
     40        (JSC::JSCell::toThisObject):
     41        (JSC::JSCell::toObject):
     42        * runtime/JSCell.h:
     43        (JSC::JSCell::JSValue::toObject):
     44        * runtime/JSNotAnObject.cpp:
     45        (JSC::JSNotAnObject::toObject):
     46        * runtime/JSNotAnObject.h:
     47        * runtime/JSObject.cpp:
     48        (JSC::JSObject::toObject):
     49        * runtime/JSObject.h:
     50        * runtime/JSString.cpp:
     51        (JSC::StringObject::create):
     52        (JSC::JSString::toObject):
     53        (JSC::JSString::toThisObject):
     54        * runtime/JSString.h:
     55        * runtime/JSValue.cpp:
     56        (JSC::JSValue::toObjectSlowCase):
     57        (JSC::JSValue::toThisObjectSlowCase):
     58        (JSC::JSValue::synthesizeObject):
     59        * runtime/JSValue.h:
     60        * runtime/NumberConstructor.cpp:
     61        (JSC::constructWithNumberConstructor):
     62        * runtime/NumberObject.cpp:
     63        (JSC::constructNumber):
     64        * runtime/NumberObject.h:
     65        * runtime/ObjectConstructor.cpp:
     66        (JSC::constructObject):
     67        (JSC::constructWithObjectConstructor):
     68        (JSC::callObjectConstructor):
     69        * runtime/RegExpConstructor.cpp:
     70        (JSC::constructRegExp):
     71        (JSC::constructWithRegExpConstructor):
     72        (JSC::callRegExpConstructor):
     73        * runtime/RegExpConstructor.h:
     74        * runtime/StringConstructor.cpp:
     75        (JSC::constructWithStringConstructor):
     76        * runtime/StringObject.h:
     77
    1782011-03-28  Geoffrey Garen  <ggaren@apple.com>
    279

  • trunk/Source/JavaScriptCore/JavaScriptCore.exp

    r81969 r82173  
    123123__ZN3JSC12DateInstance6s_infoE
    124124__ZN3JSC12DateInstanceC1EPNS_9ExecStateEN3WTF17NonNullPassRefPtrINS_9StructureEEEd
    125 __ZN3JSC12DateInstanceC1EPNS_9ExecStateEd
    126125__ZN3JSC12JSGlobalData10ClientDataD2Ev
    127126__ZN3JSC12JSGlobalData11jsArrayVPtrE
    … …  
    183182__ZN3JSC17BytecodeGenerator21setDumpsGeneratedCodeEb
    184183__ZN3JSC17PropertyNameArray3addEPN3WTF10StringImplE
    185 __ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
     184__ZN3JSC17constructFunctionEPNS_9ExecStateEPNS_14JSGlobalObjectERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
    186185__ZN3JSC17createSyntaxErrorEPNS_9ExecStateERKNS_7UStringE
    187186__ZN3JSC18DebuggerActivationC1ERNS_12JSGlobalDataEPNS_8JSObjectE
    … …  
    536535__ZNK3JSC6JSCell14isGetterSetterEv
    537536__ZNK3JSC6JSCell8toNumberEPNS_9ExecStateE
    538 __ZNK3JSC6JSCell8toObjectEPNS_9ExecStateE
     537__ZNK3JSC6JSCell8toObjectEPNS_9ExecStateEPNS_14JSGlobalObjectE
    539538__ZNK3JSC6JSCell8toStringEPNS_9ExecStateE
    540539__ZNK3JSC6JSCell9getStringEPNS_9ExecStateE
    … …  
    544543__ZNK3JSC7ArgList8getSliceEiRS0_
    545544__ZNK3JSC7JSArray12subclassDataEv
    546 __ZNK3JSC7JSValue16toObjectSlowCaseEPNS_9ExecStateE
     545__ZNK3JSC7JSValue16toObjectSlowCaseEPNS_9ExecStateEPNS_14JSGlobalObjectE
    547546__ZNK3JSC7JSValue19synthesizePrototypeEPNS_9ExecStateE
    548547__ZNK3JSC7JSValue20toThisObjectSlowCaseEPNS_9ExecStateE
    … …  
    557556__ZNK3JSC8JSObject18toStrictThisObjectEPNS_9ExecStateE
    558557__ZNK3JSC8JSObject8toNumberEPNS_9ExecStateE
    559 __ZNK3JSC8JSObject8toObjectEPNS_9ExecStateE
     558__ZNK3JSC8JSObject8toObjectEPNS_9ExecStateEPNS_14JSGlobalObjectE
    560559__ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
    561560__ZNK3JSC8JSObject9classNameEv

  • trunk/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def

    r81943 r82173  
    44    ??0CString@WTF@@QAE@PBDI@Z
    55    ??0Collator@WTF@@QAE@PBD@Z
    6     ??0DateInstance@JSC@@QAE@PAVExecState@1@N@Z
    76    ??0DateInstance@JSC@@QAE@PAVExecState@1@V?$NonNullPassRefPtr@VStructure@JSC@@@WTF@@N@Z
    87    ??0DefaultGCActivityCallback@JSC@@QAE@PAVHeap@1@@Z
    … …  
    9594    ?constructEmptyArray@JSC@@YAPAVJSArray@1@PAVExecState@1@@Z
    9695    ?constructEmptyObject@JSC@@YAPAVJSObject@1@PAVExecState@1@@Z
    97     ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
     96    ?constructFunction@JSC@@YAPAVJSObject@1@PAVExecState@1@PAVJSGlobalObject@1@ABVArgList@1@ABVIdentifier@1@ABVUString@1@H@Z
    9897    ?convertUTF16ToUTF8@Unicode@WTF@@YA?AW4ConversionResult@12@PAPB_WPB_WPAPADPAD_N@Z
    9998    ?convertUTF8ToUTF16@Unicode@WTF@@YA?AW4ConversionResult@12@PAPBDPBDPAPA_WPA_W_N@Z
    … …  
    337336    ?toNumber@JSObject@JSC@@UBENPAVExecState@2@@Z
    338337    ?toNumber@JSString@JSC@@EBENPAVExecState@2@@Z
    339     ?toObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@@Z
    340     ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@@Z
    341     ?toObject@JSString@JSC@@EBEPAVJSObject@2@PAVExecState@2@@Z
    342     ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
     338    ?toObject@JSCell@JSC@@UBEPAVJSObject@2@PAVExecState@2@PAVJSGlobalObject@2@@Z
     339    ?toObject@JSObject@JSC@@UBEPAV12@PAVExecState@2@PAVJSGlobalObject@2@@Z
     340    ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@PAVJSGlobalObject@2@@Z
    343341    ?toPrimitive@JSCell@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
    344342    ?toPrimitive@JSString@JSC@@EBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z

  • trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r81411 r82173  
    249249    for (SymbolTable::iterator it = symbolTable->begin(); it != end; ++it)
    250250        registerFor(it->second.getIndex()).setIndex(it->second.getIndex() + m_globalVarStorageOffset);
    251        
     251
    252252    BatchedTransitionOptimizer optimizer(*m_globalData, globalObject);
    253253

  • trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp

    r79177 r82173  
    5353static inline JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
    5454{
     55    JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
     56
    5557    // a single numeric argument denotes the array size (!)
    5658    if (args.size() == 1 && args.at(0).isNumber()) {
    … …  
    5860        if (n != args.at(0).toNumber(exec))
    5961            return throwError(exec, createRangeError(exec, "Array size is not a small enough positive integer."));
    60         return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), n, CreateInitialized);
     62        return new (exec) JSArray(globalObject->arrayStructure(), n, CreateInitialized);
    6163    }
    6264
    6365    // otherwise the array is constructed with the arguments in it
    64     return new (exec) JSArray(exec->globalData(), exec->lexicalGlobalObject()->arrayStructure(), args);
     66    return new (exec) JSArray(exec->globalData(), globalObject->arrayStructure(), args);
    6567}
    6668

  • trunk/Source/JavaScriptCore/runtime/BooleanConstructor.cpp

    r77269 r82173  
    4141JSObject* constructBoolean(ExecState* exec, const ArgList& args)
    4242{
    43     BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), exec->lexicalGlobalObject()->booleanObjectStructure());
     43    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), asInternalFunction(exec->callee())->globalObject()->booleanObjectStructure());
    4444    obj->setInternalValue(exec->globalData(), jsBoolean(args.at(0).toBoolean(exec)));
    4545    return obj;
    … …  
    7070}
    7171
    72 JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSValue immediateBooleanValue)
     72JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSGlobalObject* globalObject, JSValue immediateBooleanValue)
    7373{
    74     BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), exec->lexicalGlobalObject()->booleanObjectStructure());
     74    BooleanObject* obj = new (exec) BooleanObject(exec->globalData(), globalObject->booleanObjectStructure());
    7575    obj->setInternalValue(exec->globalData(), immediateBooleanValue);
    7676    return obj;

  • trunk/Source/JavaScriptCore/runtime/BooleanConstructor.h

    r59941 r82173  
    3737    };
    3838
    39     JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSValue);
     39    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSGlobalObject*, JSValue);
    4040    JSObject* constructBoolean(ExecState*, const ArgList&);
    4141

  • trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp

    r79177 r82173  
    122122    }
    123123
    124     return new (exec) DateInstance(exec, value);
     124    return new (exec) DateInstance(exec, asInternalFunction(exec->callee())->globalObject()->dateStructure(), value);
    125125}
    126126   

  • trunk/Source/JavaScriptCore/runtime/DateInstance.cpp

    r81086 r82173  
    4949}
    5050
    51 DateInstance::DateInstance(ExecState* exec, double time)
    52     : JSWrapperObject(exec->lexicalGlobalObject()->dateStructure())
    53 {
    54     ASSERT(inherits(&s_info));
    55     setInternalValue(exec->globalData(), jsNumber(timeClip(time)));
    56 }
    57 
    5851const GregorianDateTime* DateInstance::calculateGregorianDateTime(ExecState* exec) const
    5952{

  • trunk/Source/JavaScriptCore/runtime/DateInstance.h

    r81272 r82173  
    3232    class DateInstance : public JSWrapperObject {
    3333    public:
    34         DateInstance(ExecState*, double);
    3534        DateInstance(ExecState*, NonNullPassRefPtr<Structure>, double);
    3635        explicit DateInstance(ExecState*, NonNullPassRefPtr<Structure>);

  • trunk/Source/JavaScriptCore/runtime/ErrorConstructor.cpp

    r77151 r82173  
    4343{
    4444    JSValue message = exec->argumentCount() ? exec->argument(0) : jsUndefined();
    45     Structure* errorStructure = exec->lexicalGlobalObject()->errorStructure();
     45    Structure* errorStructure = asInternalFunction(exec->callee())->globalObject()->errorStructure();
    4646    return JSValue::encode(ErrorInstance::create(exec, errorStructure, message));
    4747}
    … …  
    5656{
    5757    JSValue message = exec->argumentCount() ? exec->argument(0) : jsUndefined();
    58     Structure* errorStructure = exec->lexicalGlobalObject()->errorStructure();
     58    Structure* errorStructure = asInternalFunction(exec->callee())->globalObject()->errorStructure();
    5959    return JSValue::encode(ErrorInstance::create(exec, errorStructure, message));
    6060}

  • trunk/Source/JavaScriptCore/runtime/FunctionConstructor.cpp

    r80598 r82173  
    5050{
    5151    ArgList args(exec);
    52     return JSValue::encode(constructFunction(exec, args));
     52    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->callee())->globalObject(), args));
    5353}
    5454
    … …  
    6262{
    6363    ArgList args(exec);
    64     return JSValue::encode(constructFunction(exec, args));
     64    return JSValue::encode(constructFunction(exec, asInternalFunction(exec->callee())->globalObject(), args));
    6565}
    6666
    … …  
    7373
    7474// ECMA 15.3.2 The Function Constructor
    75 JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifier& functionName, const UString& sourceURL, int lineNumber)
     75JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args, const Identifier& functionName, const UString& sourceURL, int lineNumber)
    7676{
    7777    // Functions need to have a space following the opening { due to for web compatibility
    … …  
    9797    }
    9898
    99     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
    10099    JSGlobalData& globalData = globalObject->globalData();
    101100    SourceCode source = makeSource(program, sourceURL, lineNumber);
    … …  
    112111
    113112// ECMA 15.3.2 The Function Constructor
    114 JSObject* constructFunction(ExecState* exec, const ArgList& args)
     113JSObject* constructFunction(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
    115114{
    116     return constructFunction(exec, args, Identifier(exec, "anonymous"), UString(), 1);
     115    return constructFunction(exec, globalObject, args, Identifier(exec, "anonymous"), UString(), 1);
    117116}
    118117

  • trunk/Source/JavaScriptCore/runtime/FunctionConstructor.h

    r59941 r82173  
    3737    };
    3838
    39     JSObject* constructFunction(ExecState*, const ArgList&, const Identifier& functionName, const UString& sourceURL, int lineNumber);
    40     JSObject* constructFunction(ExecState*, const ArgList&);
     39    JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&, const Identifier& functionName, const UString& sourceURL, int lineNumber);
     40    JSObject* constructFunction(ExecState*, JSGlobalObject*, const ArgList&);
    4141
    4242} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/JSCell.cpp

    r79132 r82173  
    120120    // It should only be called by JSValue::get.
    121121    // It calls getPropertySlot, not getOwnPropertySlot.
    122     JSObject* object = toObject(exec);
     122    JSObject* object = toObject(exec, exec->lexicalGlobalObject());
    123123    slot.setBase(object);
    124124    if (!object->getPropertySlot(exec, identifier, slot))
    … …  
    132132    // It should only be called by JSValue::get.
    133133    // It calls getPropertySlot, not getOwnPropertySlot.
    134     JSObject* object = toObject(exec);
     134    JSObject* object = toObject(exec, exec->lexicalGlobalObject());
    135135    slot.setBase(object);
    136136    if (!object->getPropertySlot(exec, identifier, slot))
    … …  
    141141void JSCell::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
    142142{
    143     toObject(exec)->put(exec, identifier, value, slot);
     143    toObject(exec, exec->lexicalGlobalObject())->put(exec, identifier, value, slot);
    144144}
    145145
    146146void JSCell::put(ExecState* exec, unsigned identifier, JSValue value)
    147147{
    148     toObject(exec)->put(exec, identifier, value);
     148    toObject(exec, exec->lexicalGlobalObject())->put(exec, identifier, value);
    149149}
    150150
    151151bool JSCell::deleteProperty(ExecState* exec, const Identifier& identifier)
    152152{
    153     return toObject(exec)->deleteProperty(exec, identifier);
     153    return toObject(exec, exec->lexicalGlobalObject())->deleteProperty(exec, identifier);
    154154}
    155155
    156156bool JSCell::deleteProperty(ExecState* exec, unsigned identifier)
    157157{
    158     return toObject(exec)->deleteProperty(exec, identifier);
     158    return toObject(exec, exec->lexicalGlobalObject())->deleteProperty(exec, identifier);
    159159}
    160160
    161161JSObject* JSCell::toThisObject(ExecState* exec) const
    162162{
    163     return toObject(exec);
     163    return toObject(exec, exec->lexicalGlobalObject());
    164164}
    165165
    … …  
    204204}
    205205
    206 JSObject* JSCell::toObject(ExecState*) const
     206JSObject* JSCell::toObject(ExecState*, JSGlobalObject*) const
    207207{
    208208    ASSERT_NOT_REACHED();

  • trunk/Source/JavaScriptCore/runtime/JSCell.h

    r81272 r82173  
    3636namespace JSC {
    3737
     38    class JSGlobalObject;
     39
    3840#if COMPILER(MSVC)
    3941    // If WTF_MAKE_NONCOPYABLE is applied to JSCell we end up with a bunch of
    … …  
    107109        virtual double toNumber(ExecState*) const;
    108110        virtual UString toString(ExecState*) const;
    109         virtual JSObject* toObject(ExecState*) const;
     111        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
    110112
    111113        // Garbage collection.
    … …  
    337339    inline JSObject* JSValue::toObject(ExecState* exec) const
    338340    {
    339         return isCell() ? asCell()->toObject(exec) : toObjectSlowCase(exec);
     341        return isCell() ? asCell()->toObject(exec, exec->lexicalGlobalObject()) : toObjectSlowCase(exec, exec->lexicalGlobalObject());
     342    }
     343
     344    inline JSObject* JSValue::toObject(ExecState* exec, JSGlobalObject* globalObject) const
     345    {
     346        return isCell() ? asCell()->toObject(exec, globalObject) : toObjectSlowCase(exec, globalObject);
    340347    }
    341348

  • trunk/Source/JavaScriptCore/runtime/JSNotAnObject.cpp

    r72127 r82173  
    6868}
    6969
    70 JSObject* JSNotAnObject::toObject(ExecState* exec) const
     70JSObject* JSNotAnObject::toObject(ExecState* exec, JSGlobalObject*) const
    7171{
    7272    ASSERT_UNUSED(exec, exec->hadException());

  • trunk/Source/JavaScriptCore/runtime/JSNotAnObject.h

    r81272 r82173  
    5959        virtual double toNumber(ExecState*) const;
    6060        virtual UString toString(ExecState*) const;
    61         virtual JSObject* toObject(ExecState*) const;
     61        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
    6262
    6363        // JSObject methods

  • trunk/Source/JavaScriptCore/runtime/JSObject.cpp

    r82003 r82173  
    490490}
    491491
    492 JSObject* JSObject::toObject(ExecState*) const
     492JSObject* JSObject::toObject(ExecState*, JSGlobalObject*) const
    493493{
    494494    return const_cast<JSObject*>(this);

  • trunk/Source/JavaScriptCore/runtime/JSObject.h

    r81272 r82173  
    139139        virtual double toNumber(ExecState*) const;
    140140        virtual UString toString(ExecState*) const;
    141         virtual JSObject* toObject(ExecState*) const;
     141        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
    142142
    143143        virtual JSObject* toThisObject(ExecState*) const;

  • trunk/Source/JavaScriptCore/runtime/JSString.cpp

    r81071 r82173  
    254254}
    255255
    256 inline StringObject* StringObject::create(ExecState* exec, JSString* string)
    257 {
    258     return new (exec) StringObject(exec->globalData(), exec->lexicalGlobalObject()->stringObjectStructure(), string);
    259 }
    260 
    261 JSObject* JSString::toObject(ExecState* exec) const
    262 {
    263     return StringObject::create(exec, const_cast<JSString*>(this));
     256inline StringObject* StringObject::create(ExecState* exec, JSGlobalObject* globalObject, JSString* string)
     257{
     258    return new (exec) StringObject(exec->globalData(), globalObject->stringObjectStructure(), string);
     259}
     260
     261JSObject* JSString::toObject(ExecState* exec, JSGlobalObject* globalObject) const
     262{
     263    return StringObject::create(exec, globalObject, const_cast<JSString*>(this));
    264264}
    265265
    266266JSObject* JSString::toThisObject(ExecState* exec) const
    267267{
    268     return StringObject::create(exec, const_cast<JSString*>(this));
     268    return StringObject::create(exec, exec->lexicalGlobalObject(), const_cast<JSString*>(this));
    269269}
    270270

  • trunk/Source/JavaScriptCore/runtime/JSString.h

    r81272 r82173  
    403403        virtual bool toBoolean(ExecState*) const;
    404404        virtual double toNumber(ExecState*) const;
    405         virtual JSObject* toObject(ExecState*) const;
     405        virtual JSObject* toObject(ExecState*, JSGlobalObject*) const;
    406406        virtual UString toString(ExecState*) const;
    407407

  • trunk/Source/JavaScriptCore/runtime/JSValue.cpp

    r72127 r82173  
    5555}
    5656
    57 JSObject* JSValue::toObjectSlowCase(ExecState* exec) const
     57JSObject* JSValue::toObjectSlowCase(ExecState* exec, JSGlobalObject* globalObject) const
    5858{
    5959    ASSERT(!isCell());
    6060
    6161    if (isInt32() || isDouble())
    62         return constructNumber(exec, asValue());
     62        return constructNumber(exec, globalObject, asValue());
    6363    if (isTrue() || isFalse())
    64         return constructBooleanFromImmediateBoolean(exec, asValue());
     64        return constructBooleanFromImmediateBoolean(exec, globalObject, asValue());
    6565
    6666    ASSERT(isUndefinedOrNull());
    … …  
    7474
    7575    if (isInt32() || isDouble())
    76         return constructNumber(exec, asValue());
     76        return constructNumber(exec, exec->lexicalGlobalObject(), asValue());
    7777    if (isTrue() || isFalse())
    78         return constructBooleanFromImmediateBoolean(exec, asValue());
     78        return constructBooleanFromImmediateBoolean(exec, exec->lexicalGlobalObject(), asValue());
    7979    ASSERT(isUndefinedOrNull());
    8080    return exec->globalThisValue();
    … …  
    8585    ASSERT(!isCell());
    8686    if (isNumber())
    87         return constructNumber(exec, asValue());
     87        return constructNumber(exec, exec->lexicalGlobalObject(), asValue());
    8888    if (isBoolean())
    89         return constructBooleanFromImmediateBoolean(exec, asValue());
     89        return constructBooleanFromImmediateBoolean(exec, exec->lexicalGlobalObject(), asValue());
    9090
    9191    ASSERT(isUndefinedOrNull());

  • trunk/Source/JavaScriptCore/runtime/JSValue.h

    r81040 r82173  
    3838    class JSCell;
    3939    class JSGlobalData;
     40    class JSGlobalObject;
    4041    class JSImmediate;
    4142    class JSObject;
    … …  
    190191        UString toPrimitiveString(ExecState*) const;
    191192        JSObject* toObject(ExecState*) const;
     193        JSObject* toObject(ExecState*, JSGlobalObject*) const;
    192194
    193195        // Integer conversions.
    … …  
    245247
    246248        inline const JSValue asValue() const { return *this; }
    247         JSObject* toObjectSlowCase(ExecState*) const;
     249        JSObject* toObjectSlowCase(ExecState*, JSGlobalObject*) const;
    248250        JSObject* toThisObjectSlowCase(ExecState*) const;
    249251

  • trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp

    r79240 r82173  
    105105static EncodedJSValue JSC_HOST_CALL constructWithNumberConstructor(ExecState* exec)
    106106{
    107     NumberObject* object = new (exec) NumberObject(exec->globalData(), exec->lexicalGlobalObject()->numberObjectStructure());
     107    NumberObject* object = new (exec) NumberObject(exec->globalData(), asInternalFunction(exec->callee())->globalObject()->numberObjectStructure());
    108108    double n = exec->argumentCount() ? exec->argument(0).toNumber(exec) : 0;
    109109    object->setInternalValue(exec->globalData(), jsNumber(n));

  • trunk/Source/JavaScriptCore/runtime/NumberObject.cpp

    r81086 r82173  
    4343}
    4444
    45 NumberObject* constructNumber(ExecState* exec, JSValue number)
     45NumberObject* constructNumber(ExecState* exec, JSGlobalObject* globalObject, JSValue number)
    4646{
    47     NumberObject* object = new (exec) NumberObject(exec->globalData(), exec->lexicalGlobalObject()->numberObjectStructure());
     47    NumberObject* object = new (exec) NumberObject(exec->globalData(), globalObject->numberObjectStructure());
    4848    object->setInternalValue(exec->globalData(), number);
    4949    return object;

  • trunk/Source/JavaScriptCore/runtime/NumberObject.h

    r81272 r82173  
    4141    };
    4242
    43     NumberObject* constructNumber(ExecState*, JSValue);
     43    NumberObject* constructNumber(ExecState*, JSGlobalObject*, JSValue);
    4444
    4545} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp

    r80378 r82173  
    9696
    9797// ECMA 15.2.2
    98 static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, const ArgList& args)
     98static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
    9999{
    100100    JSValue arg = args.at(0);
    101101    if (arg.isUndefinedOrNull())
    102         return constructEmptyObject(exec);
    103     return arg.toObject(exec);
     102        return constructEmptyObject(exec, globalObject);
     103    return arg.toObject(exec, globalObject);
    104104}
    105105
    … …  
    107107{
    108108    ArgList args(exec);
    109     return JSValue::encode(constructObject(exec, args));
     109    return JSValue::encode(constructObject(exec, asInternalFunction(exec->callee())->globalObject(), args));
    110110}
    111111
    … …  
    119119{
    120120    ArgList args(exec);
    121     return JSValue::encode(constructObject(exec, args));
     121    return JSValue::encode(constructObject(exec, asInternalFunction(exec->callee())->globalObject(), args));
    122122}
    123123

  • trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp

    r80667 r82173  
    294294
    295295// ECMA 15.10.4
    296 JSObject* constructRegExp(ExecState* exec, const ArgList& args)
     296JSObject* constructRegExp(ExecState* exec, JSGlobalObject* globalObject, const ArgList& args)
    297297{
    298298    JSValue arg0 = args.at(0);
    … …  
    321321    if (!regExp->isValid())
    322322        return throwError(exec, createSyntaxError(exec, regExp->errorMessage()));
    323     return new (exec) RegExpObject(exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp.release());
     323    return new (exec) RegExpObject(exec->lexicalGlobalObject(), globalObject->regExpStructure(), regExp.release());
    324324}
    325325
    … …  
    327327{
    328328    ArgList args(exec);
    329     return JSValue::encode(constructRegExp(exec, args));
     329    return JSValue::encode(constructRegExp(exec, asInternalFunction(exec->callee())->globalObject(), args));
    330330}
    331331
    … …  
    340340{
    341341    ArgList args(exec);
    342     return JSValue::encode(constructRegExp(exec, args));
     342    return JSValue::encode(constructRegExp(exec, asInternalFunction(exec->callee())->globalObject(), args));
    343343}
    344344

  • trunk/Source/JavaScriptCore/runtime/RegExpConstructor.h

    r81272 r82173  
    9797    RegExpConstructor* asRegExpConstructor(JSValue);
    9898
    99     JSObject* constructRegExp(ExecState*, const ArgList&);
     99    JSObject* constructRegExp(ExecState*, JSGlobalObject*, const ArgList&);
    100100
    101101    inline RegExpConstructor* asRegExpConstructor(JSValue value)

  • trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp

    r79177 r82173  
    6868static EncodedJSValue JSC_HOST_CALL constructWithStringConstructor(ExecState* exec)
    6969{
     70    JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
    7071    if (!exec->argumentCount())
    71         return JSValue::encode(new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure()));
    72     return JSValue::encode(new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure(), exec->argument(0).toString(exec)));
     72        return JSValue::encode(new (exec) StringObject(exec, globalObject->stringObjectStructure()));
     73    return JSValue::encode(new (exec) StringObject(exec, globalObject->stringObjectStructure(), exec->argument(0).toString(exec)));
    7374}
    7475

  • trunk/Source/JavaScriptCore/runtime/StringObject.h

    r81272 r82173  
    3232        StringObject(ExecState*, NonNullPassRefPtr<Structure>, const UString&);
    3333
    34         static StringObject* create(ExecState*, JSString*);
     34        static StringObject* create(ExecState*, JSGlobalObject*, JSString*);
    3535
    3636        virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);

  • trunk/Source/JavaScriptGlue/ChangeLog

    r82037 r82173  
     12011-03-25  Oliver Hunt  <oliver@apple.com>
     2
     3        Reviewed by Geoffrey Garen.
     4
     5        instanceof Array test fails when using iframes
     6        https://bugs.webkit.org/show_bug.cgi?id=17250
     7
     8        Up date for new toObject api
     9
     10        * UserObjectImp.cpp:
     11        (UserObjectImp::toPrimitive):
     12        (UserObjectImp::toBoolean):
     13        (UserObjectImp::toNumber):
     14        (UserObjectImp::toString):
     15
    1162011-03-26  Adam Barth  <abarth@webkit.org>
    217

  • trunk/Source/JavaScriptGlue/UserObjectImp.cpp

    r79132 r82173  
    168168{
    169169    JSValue result = jsUndefined();
    170     JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec), exec);
     170    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec, exec->lexicalGlobalObject()), exec);
    171171    CFTypeRef cfValue = jsObjPtr ? jsObjPtr->CopyCFValue() : 0;
    172172    if (cfValue) {
    … …  
    205205{
    206206    bool result = false;
    207     JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec), exec);
     207    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec, exec->lexicalGlobalObject()), exec);
    208208    CFTypeRef cfValue = jsObjPtr ? jsObjPtr->CopyCFValue() : 0;
    209209    if (cfValue)
    … …  
    285285{
    286286    double result = 0;
    287     JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec), exec);
     287    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec, exec->lexicalGlobalObject()), exec);
    288288    CFTypeRef cfValue = jsObjPtr ? jsObjPtr->CopyCFValue() : 0;
    289289    if (cfValue)
    … …  
    319319{
    320320    UString result;
    321     JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec), exec);
     321    JSUserObject* jsObjPtr = KJSValueToJSObject(toObject(exec, exec->lexicalGlobalObject()), exec);
    322322    CFTypeRef cfValue = jsObjPtr ? jsObjPtr->CopyCFValue() : 0;
    323323    if (cfValue)

  • trunk/Source/WebCore/ChangeLog

    r82171 r82173  
     12011-03-28  Oliver Hunt  <oliver@apple.com>
     2
     3        Reviewed by Geoffrey Garen.
     4
     5        instanceof Array test fails when using iframes
     6        https://bugs.webkit.org/show_bug.cgi?id=17250
     7
     8        Update for new function and date apis
     9
     10        Test: fast/js/js-constructors-use-correct-global.html
     11
     12        * WebCore.xcodeproj/project.pbxproj:
     13        * bindings/js/JSDOMBinding.cpp:
     14        (WebCore::jsDateOrNull):
     15        * bindings/js/JSLazyEventListener.cpp:
     16        (WebCore::JSLazyEventListener::initializeJSFunction):
     17
    1182011-03-28  Beth Dakin  <bdakin@apple.com>
    219

  • trunk/Source/WebCore/bindings/js/JSDOMBinding.cpp

    r79616 r82173  
    484484    if (!isfinite(value))
    485485        return jsNull();
    486     return new (exec) DateInstance(exec, value);
     486    return new (exec) DateInstance(exec, exec->lexicalGlobalObject()->dateStructure(), value);
    487487}
    488488

  • trunk/Source/WebCore/bindings/js/JSLazyEventListener.cpp

    r82147 r82173  
    9898    args.append(jsString(exec, m_code));
    9999
    100     JSObject* jsFunction = constructFunction(exec, args, Identifier(exec, stringToUString(m_functionName)), stringToUString(m_sourceURL), m_lineNumber); // FIXME: is globalExec ok?
     100    JSObject* jsFunction = constructFunction(exec, exec->lexicalGlobalObject(), args, Identifier(exec, stringToUString(m_functionName)), stringToUString(m_sourceURL), m_lineNumber); // FIXME: is globalExec ok?
    101101    if (exec->hadException()) {
    102102        exec->clearException();

  • trunk/Source/WebCore/bridge/qt/qt_runtime.cpp

    r81272 r82173  
    884884        double ms = gregorianDateTimeToMS(exec, dt, time.msec(), /*inputIsUTC*/ false);
    885885
    886         return new (exec) DateInstance(exec, trunc(ms));
     886        return new (exec) DateInstance(exec, exec->lexicalGlobalObject()->dateStructure(), trunc(ms));
    887887    }
    888888
Note: See TracChangeset for help on using the changeset viewer.