Bug 84640

Summary: [V8] Fix issue with trying to access a constructor in a frame that has been removed
Product: WebKit Reporter: Erik Arvidsson <arv>
Component: New BugsAssignee: Erik Arvidsson <arv>
Status: RESOLVED FIXED    
Severity: Normal CC: abarth, adamk, haraken, japhet, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Erik Arvidsson
Reported 2012-04-23 15:17:24 PDT
[V8] Fix issue with trying to access a constructor in a frame that has been removed
Attachments
Patch (3.81 KB, patch)
2012-04-23 15:20 PDT, Erik Arvidsson 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Erik Arvidsson
Comment 1 2012-04-23 15:20:39 PDT
Created attachment 138436 [details] Patch
Kentaro Hara
Comment 3 2012-04-23 15:29:25 PDT
Comment on attachment 138436 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=138436&action=review > LayoutTests/fast/dom/constructor-in-removed-frame.html:17 > + frame.Window; Shall we check the value of frame.Window?
Erik Arvidsson
Comment 4 2012-04-23 15:41:24 PDT
(In reply to comment #3) > (From update of attachment 138436 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=138436&action=review > > > LayoutTests/fast/dom/constructor-in-removed-frame.html:17 > > + frame.Window; > > Shall we check the value of frame.Window? We could but V8 and JSC report different values. V8 returns undefined. JSC returns the Window constructor. V8 matches Firefox and Opera. IE throws access denied. Based on that I don't think we should check the actual value.
Kentaro Hara
Comment 5 2012-04-23 15:43:07 PDT
Comment on attachment 138436 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=138436&action=review >>> LayoutTests/fast/dom/constructor-in-removed-frame.html:17 >>> + frame.Window; >> >> Shall we check the value of frame.Window? > > We could but V8 and JSC report different values. > > V8 returns undefined. JSC returns the Window constructor. V8 matches Firefox and Opera. IE throws access denied. > > Based on that I don't think we should check the actual value. Sounds reasonable.
WebKit Review Bot
Comment 6 2012-04-23 20:22:06 PDT
Comment on attachment 138436 [details] Patch Clearing flags on attachment: 138436 Committed r114989: <http://trac.webkit.org/changeset/114989>
WebKit Review Bot
Comment 7 2012-04-23 20:22:11 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.