NEW 133915
No check for type on use of Dictionary
https://bugs.webkit.org/show_bug.cgi?id=133915
Summary No check for type on use of Dictionary
Dirk Schulze
Reported 2014-06-14 14:09:45 PDT
DOMPoint(Dictionary point) doesn't check for type of point in generated code. This allows basically every value and doesn't throw as it should. JSDOMPointConstructor* castedThis = jsCast<JSDOMPointConstructor*>(exec->callee()); if (exec->argumentCount() < 1) return throwVMError(exec, createNotEnoughArgumentsError(exec)); Dictionary point(exec, exec->argument(0)); DOMPoint(1) would not throw.
Attachments
Note You need to log in before you can comment on or make changes to this bug.