[webkit-reviews] review requested: [Bug 12216] Stack overflow crash in JavaScript garbage collector mark pass : [Attachment 17550] [3/6] JavaScriptCore:

[bugzilla-daemon at webkit.org]

Maciej Stachowiak <mjs at apple.com> has asked  for review:
Bug 12216: Stack overflow crash in JavaScript garbage collector mark pass
http://bugs.webkit.org/show_bug.cgi?id=12216

Attachment 17550: [3/6] JavaScriptCore:
http://bugs.webkit.org/attachment.cgi?id=17550&action=edit

------- Additional Comments from Maciej Stachowiak <mjs at apple.com>

	Not reviewed.

	Change things around so JSWrapperObject takes the internal value
	as a constructor argument, instead of initially filling in
	jsUndefined(). Plus corresponding cleanup.

	* JavaScriptCore.exp:
	* kjs/JSWrapperObject.h:
	* kjs/bool_object.cpp:
	(BooleanPrototype::BooleanPrototype):
	(BooleanObjectImp::construct):
	* kjs/bool_object.h:
	* kjs/date_object.cpp:
	(KJS::DateObjectImp::construct):
	* kjs/date_object.h:
	* kjs/number_object.cpp:
	(NumberPrototype::NumberPrototype):
	(NumberObjectImp::construct):
	* kjs/number_object.h:
	* kjs/string_object.cpp:
	(KJS::StringInstance::StringInstance):
	(KJS::StringObjectImp::construct):
	* kjs/string_object.h:

WebCore:

	Not reviewed.

	Change things around so JSWrapperObject takes the internal value
	as a constructor argument, instead of initially filling in
	jsUndefined(). Plus corresponding cleanup.

	* bindings/js/JSCSSStyleDeclarationCustom.cpp:
	(WebCore::JSCSSStyleDeclaration::nameGetter):
---
 JavaScriptCore/ChangeLog			    |	26 ++++++++++++++++
 JavaScriptCore/JavaScriptCore.exp		    |	 3 +-
 JavaScriptCore/kjs/JSWrapperObject.h		    |	 6 ++--
 JavaScriptCore/kjs/bool_object.cpp		    |	13 ++-----
 JavaScriptCore/kjs/bool_object.h		    |	 2 +-
 JavaScriptCore/kjs/date_object.cpp		    |	13 +++-----
 JavaScriptCore/kjs/date_object.h		    |	 6 ++-
 JavaScriptCore/kjs/number_object.cpp		    |	16 +++-------
 JavaScriptCore/kjs/number_object.h		    |	 4 +-
 JavaScriptCore/kjs/string_object.cpp		    |	32 ++++++-------------
 JavaScriptCore/kjs/string_object.h		    |	11 +++----
 WebCore/ChangeLog				    |	11 +++++++
 .../bindings/js/JSCSSStyleDeclarationCustom.cpp    |	 2 +-
 13 files changed, 78 insertions(+), 67 deletions(-)