Changeset 90402 in webkit

Timestamp:

Jul 5, 2011 12:02:44 PM (13 years ago)

Author:

barraclough@apple.com

Message:

​https://bugs.webkit.org/show_bug.cgi?id=63947
ASSERT running Object.preventExtensions(Math.sin)

Reviewed by Oliver Hunt.

This is due to calling scope() on a hostFunction as a part of
calling createPrototypeProperty to reify the prototype property.
But host functions don't have a prototype property anyway!

Source/JavaScriptCore:

Prevent callling createPrototypeProperty on a host function.

• runtime/JSFunction.cpp:

(JSC::JSFunction::createPrototypeProperty):
(JSC::JSFunction::preventExtensions):

LayoutTests:

Add test case for calling preventExtensions on a host function.

• fast/js/preventExtensions-expected.txt:
• fast/js/script-tests/preventExtensions.js:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/preventExtensions-expected.txt (modified) (1 diff)
• LayoutTests/fast/js/script-tests/preventExtensions.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/runtime/JSFunction.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-07-05  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=63947
+        ASSERT running Object.preventExtensions(Math.sin)
+
+        Reviewed by Oliver Hunt.
+
+        This is due to calling scope() on a hostFunction as a part of
+        calling createPrototypeProperty to reify the prototype property.
+        But host functions don't have a prototype property anyway!
+
+        Add test case for calling preventExtensions on a host function.
+
+        * fast/js/preventExtensions-expected.txt:
+        * fast/js/script-tests/preventExtensions.js:
+
 2011-07-04  Gavin Barraclough  <barraclough@apple.com>
 

trunk/LayoutTests/fast/js/preventExtensions-expected.txt

@@ -11 +11 @@
 PASS test(seal(obj())) is "(a:1)(b:4)S"
 PASS test(freeze(obj())) is "(a:1)(b:2)SF"
+PASS Object.preventExtensions(Math.sin) is Math.sin
 PASS successfullyParsed is true
 

trunk/LayoutTests/fast/js/script-tests/preventExtensions.js

@@ -66 +66 @@
 shouldBe('test(freeze(obj()))', '"(a:1)(b:2)SF"'); // sealed and frozen, CANNOT delete a, CANNOT modify b, and CANNOT add c
 
+// check that we can preventExtensions on a host function.
+shouldBe('Object.preventExtensions(Math.sin)', 'Math.sin');
+
 successfullyParsed = true;

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-07-05  Gavin Barraclough  <barraclough@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=63947
+        ASSERT running Object.preventExtensions(Math.sin)
+
+        Reviewed by Oliver Hunt.
+
+        This is due to calling scope() on a hostFunction as a part of
+        calling createPrototypeProperty to reify the prototype property.
+        But host functions don't have a prototype property anyway!
+
+        Prevent callling createPrototypeProperty on a host function.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::createPrototypeProperty):
+        (JSC::JSFunction::preventExtensions):
+
 2011-07-04  Gavin Barraclough  <barraclough@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSFunction.cpp

@@ -180 +180 @@
 static inline WriteBarrierBase<Unknown>* createPrototypeProperty(JSGlobalData& globalData, JSGlobalObject* globalObject, JSFunction* function)
 {
+    ASSERT(!isHostFunction());
+
     ExecState* exec = globalObject->globalExec();
     if (WriteBarrierBase<Unknown>* location = function->getDirectLocation(globalData, exec->propertyNames().prototype))
@@ -191 +193 @@
 void JSFunction::preventExtensions(JSGlobalData& globalData)
 {
-    createPrototypeProperty(globalData, scope()->globalObject.get(), this);
+    if (!isHostFunction())
+        createPrototypeProperty(globalData, scope()->globalObject.get(), this);
     JSObject::preventExtensions(globalData);
 }