Bug 133915

Summary: No check for type on use of Dictionary
Product: WebKit Reporter: Dirk Schulze <krit>
Component: BindingsAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   

Description Dirk Schulze 2014-06-14 14:09:45 PDT
DOMPoint(Dictionary point) doesn't check for type of point in generated code. This allows basically every value and doesn't throw as it should.

    JSDOMPointConstructor* castedThis = jsCast<JSDOMPointConstructor*>(exec->callee());
    if (exec->argumentCount() < 1)
        return throwVMError(exec, createNotEnoughArgumentsError(exec));
    Dictionary point(exec, exec->argument(0));

DOMPoint(1) would not throw.