[Webkit-unassigned] [Bug 146785] New: toJSDOMWindow() does not handle objects that descend from the JS DOM Window

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=146785

            Bug ID: 146785
           Summary: toJSDOMWindow() does not handle objects that descend
                    from the JS DOM Window
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mark.s.dittmer at gmail.com

toJSDOMWindow() expects to be passed JSValue that is a JSDOMWindow, but it is invoked in contexts where the value may be some other Javascript object that hs the JS DOM Window in its prototype chain.

To reproduce, attempt to run the following line of Javascript:

Object.create(window).location;

The ensuing crash can be traced back to oJSDOMWindow() returning 0 (or NULL) in a context where it shouldn't because the JS DOM Window object can be readily looked up by walking the prototype chain of the Object.create-ed object.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150709/b7c1e6e6/attachment.html>