Bug 31485

Summary: JSValueProtect and JSValueUnprotect don't protect API wrapper values
Product: WebKit Reporter: Oliver Hunt <oliver>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
Attachments:
Description Flags
Patch ggaren: review+

Description Oliver Hunt 2009-11-13 11:57:28 PST 
toJS strips out the wrapper objects made for number cells in the API, which means the protect/unprotect become no-ops.  Clearly this is a Bad Thing (tm)
Comment 1 Oliver Hunt 2009-11-13 12:00:07 PST 
Created attachment 43182 [details]
Patch
Comment 2 Geoffrey Garen 2009-11-13 12:07:40 PST 
Comment on attachment 43182 [details]
Patch

r=me
Comment 3 Oliver Hunt 2009-11-13 12:42:41 PST 
Committed r50964