JavaScriptCore:
authordarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 11 May 2009 18:54:49 +0000 (18:54 +0000)
committerdarin@apple.com <darin@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Mon, 11 May 2009 18:54:49 +0000 (18:54 +0000)
2009-05-11  Darin Adler  <darin@apple.com>

        Reviewed by Oliver Hunt.

        Bug 25560: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
        https://bugs.webkit.org/show_bug.cgi?id=25560
        rdar://problem/6861069

        I missed this case back a year ago when I sped up handling
        of JavaScript wrappers. Easy to fix.

        * runtime/JSObject.h:
        (JSC::JSValue::get): Return the prototype itself if the property name
        is __proto__.
        * runtime/JSString.cpp:
        (JSC::JSString::getOwnPropertySlot): Ditto.

LayoutTests:

2009-05-11  Darin Adler  <darin@apple.com>

        Reviewed by Oliver Hunt.

        Bug 25560: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
        https://bugs.webkit.org/show_bug.cgi?id=25560
        rdar://problem/6861069

        * fast/js/prototypes-expected.txt: Added.
        * fast/js/prototypes.html: Added.
        * fast/js/resources/prototypes.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@43506 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JavaScriptCore/ChangeLog
JavaScriptCore/runtime/JSObject.h
JavaScriptCore/runtime/JSString.cpp
LayoutTests/ChangeLog
LayoutTests/fast/js/prototypes-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/prototypes.html [new file with mode: 0644]
LayoutTests/fast/js/resources/prototypes.js [new file with mode: 0644]

index 0fd0d24..812d21a 100644 (file)
@@ -1,3 +1,20 @@
+2009-05-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 25560: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
+        https://bugs.webkit.org/show_bug.cgi?id=25560
+        rdar://problem/6861069
+
+        I missed this case back a year ago when I sped up handling
+        of JavaScript wrappers. Easy to fix.
+
+        * runtime/JSObject.h:
+        (JSC::JSValue::get): Return the prototype itself if the property name
+        is __proto__.
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot): Ditto.
+
 2009-05-09  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Maciej Stachowiak.
index bc577f1..1d5dad3 100644 (file)
@@ -494,6 +494,8 @@ inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName, Pro
 {
     if (UNLIKELY(!isCell())) {
         JSObject* prototype = JSImmediate::prototype(asValue(), exec);
+        if (propertyName == exec->propertyNames().underscoreProto)
+            return prototype;
         if (!prototype->getPropertySlot(exec, propertyName, slot))
             return jsUndefined();
         return slot.getValue(exec, propertyName);
index ef4a388..86f95e0 100644 (file)
@@ -88,6 +88,10 @@ bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     // This function should only be called by JSValue::get.
     if (getStringPropertySlot(exec, propertyName, slot))
         return true;
+    if (propertyName == exec->propertyNames().underscoreProto) {
+        slot.setValue(exec->lexicalGlobalObject()->stringPrototype());
+        return true;
+    }
     slot.setBase(this);
     JSObject* object;
     for (JSValue prototype = exec->lexicalGlobalObject()->stringPrototype(); !prototype.isNull(); prototype = object->prototype()) {
index a23069b..8ebeb49 100644 (file)
@@ -1,3 +1,15 @@
+2009-05-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 25560: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
+        https://bugs.webkit.org/show_bug.cgi?id=25560
+        rdar://problem/6861069
+
+        * fast/js/prototypes-expected.txt: Added.
+        * fast/js/prototypes.html: Added.
+        * fast/js/resources/prototypes.js: Added.
+
 2009-05-11  David Kilzer  <ddkilzer@apple.com>
 
         Added webarchive/test-link-rel-icon.html to gtk Skipped list
diff --git a/LayoutTests/fast/js/prototypes-expected.txt b/LayoutTests/fast/js/prototypes-expected.txt
new file mode 100644 (file)
index 0000000..ed16b7e
--- /dev/null
@@ -0,0 +1,26 @@
+Test prototoypes of various objects.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS ('').__proto__ is String.prototype
+PASS (0).__proto__ is Number.prototype
+PASS ([]).__proto__ is Array.prototype
+PASS ({}).__proto__ is Object.prototype
+PASS (new Date).__proto__ is Date.prototype
+PASS (new Number).__proto__ is Number.prototype
+PASS (new Object).__proto__ is Object.prototype
+PASS (new String).__proto__ is String.prototype
+PASS Array.prototype.__proto__ is Object.prototype
+PASS Date.prototype.__proto__ is Object.prototype
+PASS Number.prototype.__proto__ is Object.prototype
+PASS Object.prototype.__proto__ is null
+PASS String.prototype.__proto__ is Object.prototype
+PASS Array.__proto__ is Object.__proto__
+PASS Date.__proto__ is Object.__proto__
+PASS Number.__proto__ is Object.__proto__
+PASS String.__proto__ is Object.__proto__
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/js/prototypes.html b/LayoutTests/fast/js/prototypes.html
new file mode 100644 (file)
index 0000000..2c6df35
--- /dev/null
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="resources/js-test-style.css">
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="resources/prototypes.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/js/resources/prototypes.js b/LayoutTests/fast/js/resources/prototypes.js
new file mode 100644 (file)
index 0000000..7e4ca24
--- /dev/null
@@ -0,0 +1,23 @@
+description(
+'Test prototoypes of various objects.'
+);
+
+shouldBe("('').__proto__", "String.prototype");
+shouldBe("(0).__proto__", "Number.prototype");
+shouldBe("([]).__proto__", "Array.prototype");
+shouldBe("({}).__proto__", "Object.prototype");
+shouldBe("(new Date).__proto__", "Date.prototype");
+shouldBe("(new Number).__proto__", "Number.prototype");
+shouldBe("(new Object).__proto__", "Object.prototype");
+shouldBe("(new String).__proto__", "String.prototype");
+shouldBe("Array.prototype.__proto__", "Object.prototype");
+shouldBe("Date.prototype.__proto__", "Object.prototype");
+shouldBe("Number.prototype.__proto__", "Object.prototype");
+shouldBe("Object.prototype.__proto__", "null");
+shouldBe("String.prototype.__proto__", "Object.prototype");
+shouldBe("Array.__proto__", "Object.__proto__");
+shouldBe("Date.__proto__", "Object.__proto__");
+shouldBe("Number.__proto__", "Object.__proto__");
+shouldBe("String.__proto__", "Object.__proto__");
+
+var successfullyParsed = true;