[v8] unsafe persistent access in V8LazyEventListener
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Mar 2013 14:34:33 +0000 (14:34 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 20 Mar 2013 14:34:33 +0000 (14:34 +0000)
https://bugs.webkit.org/show_bug.cgi?id=112807

Patch by Dan Carney <dcarney@google.com> on 2013-03-20
Reviewed by Kentaro Hara.

No new tests.

* bindings/v8/V8LazyEventListener.cpp:
(WebCore::toObjectWrapper):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@146344 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebCore/ChangeLog
Source/WebCore/bindings/v8/V8LazyEventListener.cpp

index 5b1ba95..8eb65f0 100644 (file)
@@ -1,3 +1,15 @@
+2013-03-20  Dan Carney  <dcarney@google.com>
+
+        [v8] unsafe persistent access in V8LazyEventListener
+        https://bugs.webkit.org/show_bug.cgi?id=112807
+
+        Reviewed by Kentaro Hara.
+
+        No new tests.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::toObjectWrapper):
+
 2013-03-20  Arvid Nilsson  <anilsson@rim.com>
 
         [BlackBerry] Enable appropriate vertex attribute arrays in LayerRenderer::useProgram()
index 6fd8d59..501c9ce 100644 (file)
@@ -70,7 +70,7 @@ v8::Handle<v8::Object> toObjectWrapper(T* domObject, v8::Isolate* isolate)
     v8::Handle<v8::Value> value = toV8(domObject, v8::Handle<v8::Object>(), isolate);
     if (value.IsEmpty())
         return v8::Object::New();
-    return value.As<v8::Object>();
+    return v8::Local<v8::Object>::New(isolate, value.As<v8::Object>());
 }
 
 v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(ScriptExecutionContext* context, v8::Handle<v8::Value> jsEvent, Event* event)