JavaScriptCore:
authordarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 11 May 2009 18:54:49 +0000 (18:54 +0000)
committerdarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 11 May 2009 18:54:49 +0000 (18:54 +0000)
commit3b02f8f21e584c745f21a132f3a27967bc7305dd
treeaa8da397cd6ba47ddac97ac48b5b773c873591ff
parent5abcff2d10d3b35f211c6f2535d660295f4eac81
JavaScriptCore:

2009-05-11  Darin Adler  <darin@apple.com>

        Reviewed by Oliver Hunt.

        Bug 25560: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
        https://bugs.webkit.org/show_bug.cgi?id=25560
        rdar://problem/6861069

        I missed this case back a year ago when I sped up handling
        of JavaScript wrappers. Easy to fix.

        * runtime/JSObject.h:
        (JSC::JSValue::get): Return the prototype itself if the property name
        is __proto__.
        * runtime/JSString.cpp:
        (JSC::JSString::getOwnPropertySlot): Ditto.

LayoutTests:

2009-05-11  Darin Adler  <darin@apple.com>

        Reviewed by Oliver Hunt.

        Bug 25560: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
        https://bugs.webkit.org/show_bug.cgi?id=25560
        rdar://problem/6861069

        * fast/js/prototypes-expected.txt: Added.
        * fast/js/prototypes.html: Added.
        * fast/js/resources/prototypes.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@43506 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JavaScriptCore/ChangeLog
JavaScriptCore/runtime/JSObject.h
JavaScriptCore/runtime/JSString.cpp
LayoutTests/ChangeLog
LayoutTests/fast/js/prototypes-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/prototypes.html [new file with mode: 0644]
LayoutTests/fast/js/resources/prototypes.js [new file with mode: 0644]