[Webkit-unassigned] [Bug 146785] toJSDOMWindow() does not handle objects that descend from the JS DOM Window (crashes on use)
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Jul 13 10:24:00 PDT 2015
https://bugs.webkit.org/show_bug.cgi?id=146785
--- Comment #5 from Mark Lam <mark.lam at apple.com> ---
Comment on attachment 256676
--> https://bugs.webkit.org/attachment.cgi?id=256676
Patch
View in context: https://bugs.webkit.org/attachment.cgi?id=256676&action=review
Some suggestions below. Iâm also not convinced yet that this fix should be implemented in the toJSDOMWindow() function. Iâm currently researching the issue.
> Source/WebCore/bindings/js/JSDOMWindowBase.cpp:253
> + const ClassInfo* classInfo = asObject(value)->classInfo();
Youâve already computed the JSObject* above. You can simplify this to:
const ClassInfo* classInfo = object->classInfo();
> Source/WebCore/bindings/js/JSDOMWindowBase.cpp:255
> + return jsCast<JSDOMWindow*>(asObject(value));
Ditto. You can simplify this to:
return jsCast<JSDOMWindow*>(object);
> Source/WebCore/bindings/js/JSDOMWindowBase.cpp:257
> + return jsCast<JSDOMWindowShell*>(asObject(value))->window();
Ditto. Simplify to:
return jsCast<JSDOMWindowShell*>(object)->window();
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150713/62090474/attachment.html>
More information about the webkit-unassigned
mailing list