Changeset 83213 in webkit
- Timestamp:
- Apr 7, 2011 2:51:23 PM (13 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 5 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r83210 r83213 1 2011-04-06 Vitaly Repeshko <vitalyr@chromium.org> 2 3 Reviewed by Nate Chapin. 4 5 [V8] Remove custom DOMImplementation getter on Document. 6 https://bugs.webkit.org/show_bug.cgi?id=57991 7 8 * fast/dom/DOMImplementation/implementation-identity-expected.txt: Added. 9 * fast/dom/DOMImplementation/implementation-identity.html: Added. 10 1 11 2011-04-07 Steve Lacey <sjl@chromium.org> 2 12 -
trunk/Source/WebCore/ChangeLog
r83209 r83213 1 2011-04-06 Vitaly Repeshko <vitalyr@chromium.org> 2 3 Reviewed by Nate Chapin. 4 5 [V8] Remove custom DOMImplementation getter on Document. 6 https://bugs.webkit.org/show_bug.cgi?id=57991 7 8 The custom getter is no longer required because DOMImplementation 9 objects are now created per document. 10 11 Test: fast/dom/DOMImplementation/implementation-identity.html 12 13 * bindings/scripts/CodeGeneratorV8.pm: 14 * bindings/v8/custom/V8DocumentCustom.cpp: 15 * dom/Document.idl: 16 1 17 2011-04-07 Sergey Glazunov <serg.glazunov@gmail.com> 2 18 -
trunk/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
r82802 r83213 449 449 } 450 450 451 if (IsSubType($dataNode, "Document")) { 452 push(@customInternalFields, "implementationIndex"); 453 } elsif ($name eq "DOMWindow") { 451 if ($name eq "DOMWindow") { 454 452 push(@customInternalFields, "enteredIsolatedWorldIndex"); 455 453 } -
trunk/Source/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
r76600 r83213 119 119 } 120 120 121 122 // DOMImplementation is a singleton in WebCore. If we use our normal123 // mapping from DOM objects to V8 wrappers, the same wrapper will be124 // shared for all frames in the same process. This is a major125 // security problem. Therefore, we generate a DOMImplementation126 // wrapper per document and store it in an internal field of the127 // document. Since the DOMImplementation object is a singleton, we do128 // not have to do anything to keep the DOMImplementation object alive129 // for the lifetime of the wrapper.130 v8::Handle<v8::Value> V8Document::implementationAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)131 {132 ASSERT(info.Holder()->InternalFieldCount() >= internalFieldCount);133 134 // Check if the internal field already contains a wrapper.135 v8::Local<v8::Value> implementation = info.Holder()->GetInternalField(V8Document::implementationIndex);136 if (!implementation->IsUndefined())137 return implementation;138 139 // Generate a wrapper.140 Document* document = V8Document::toNative(info.Holder());141 v8::Handle<v8::Value> wrapper = toV8(document->implementation());142 143 // Store the wrapper in the internal field.144 info.Holder()->SetInternalField(implementationIndex, wrapper);145 146 return wrapper;147 }148 149 121 v8::Handle<v8::Value> toV8(Document* impl, bool forceNewObject) 150 122 { -
trunk/Source/WebCore/dom/Document.idl
r82925 r83213 30 30 // DOM Level 1 Core 31 31 readonly attribute DocumentType doctype; 32 readonly attribute [V8Custom]DOMImplementation implementation;32 readonly attribute DOMImplementation implementation; 33 33 readonly attribute Element documentElement; 34 34
Note: See TracChangeset
for help on using the changeset viewer.