Bug 24424 - Unify JSC/V8 Location.idl
: Unify JSC/V8 Location.idl
Product: WebKit
Classification: Unclassified
Component: WebCore JavaScript
: 528+ (Nightly build)
: PC Mac OS X 10.5
: P2 Normal
Assigned To: Mike Belshe
Depends on:
  Show dependency treegraph
Reported: 2009-03-06 09:02 PST by Mike Belshe
Modified: 2009-03-10 15:56 PDT (History)
1 user (show)

See Also:

patch (1.77 KB, patch)
2009-03-06 09:08 PST, Mike Belshe
eric: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Belshe 2009-03-06 09:02:40 PST
There is no functionality difference between V8 and JSC here.

Implementation differences:
  * V8 uses CheckDomainSecurity on the interface.  (JSC does this in CustomGetOwnPropertySlot)
  * V8 assigns some methods on the instance to prevent cross site access.
  * V8 generates valueOf, which needs to be protected similarly to toString().
Comment 1 Mike Belshe 2009-03-06 09:08:04 PST
Created attachment 28362 [details]
Comment 2 Mike Belshe 2009-03-06 09:58:19 PST
The reason to declare valueOf() is so that this code works:
   var foo = cross_site_protected_frame.location + "boo";

The implicit conversion of location here will go through valueOf, and it should be protected just as toString is.  JSC deals with this in its own CustomPropertySlot.
Comment 3 Eric Seidel 2009-03-06 10:32:34 PST
Comment on attachment 28362 [details]

Do these V8OnInstance flags override "custom"?  or does "Custom" really mean "JSCCustom" these days?  Either way looks fine.  CCing Sam so he sees it go by as well.
Comment 4 Mike Belshe 2009-03-06 13:46:48 PST
"Custom" (or "JSCCustom" or "V8Custom") tells the IDL Code Generator "don't generate binding for this, there is one hand-crafted".  The "V8OnInstance" tells the V8 code generator that this property should be installed on the object instance, rather than the prototype.  It is V8 specific (I've made all V8-specific attributes start with "V8"), and the V8 code generator knows how to generate the binding.
Comment 5 Sam Weinig 2009-03-06 14:59:45 PST
Does this introduce difference between the JSC and V8 bindings?  That is something we should try very hard to avoid.
Comment 6 Mike Belshe 2009-03-09 08:36:32 PDT
@Sam: No.
Comment 7 Eric Seidel 2009-03-09 12:48:52 PDT
	M	WebCore/ChangeLog
	M	WebCore/page/Location.idl
Committed r41535
Comment 8 Sam Weinig 2009-03-10 15:56:21 PDT
After a little discussion, it seems that this patch did infact implement a different behavior than JSC, for one, putting the functions on the instance instead of the prototype.  The intent of my question was to try and stop any divergence at the bindings layer for the two js engines as that only hurts webkit.  

Mike, perhaps I misunderstood your answer?