Bug 24424 - Unify JSC/V8 Location.idl
: Unify JSC/V8 Location.idl
Status: RESOLVED FIXED
: WebKit
WebCore JavaScript
: 528+ (Nightly build)
: PC Mac OS X 10.5
: P2 Normal
Assigned To:
:
:
:
:
  Show dependency treegraph
 
Reported: 2009-03-06 09:02 PST by
Modified: 2009-03-10 15:56 PST (History)


Attachments
patch (1.77 KB, patch)
2009-03-06 09:08 PST, Mike Belshe
eric: review+
Review Patch | Details | Formatted Diff | Diff


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2009-03-06 09:02:40 PST
There is no functionality difference between V8 and JSC here.

Implementation differences:
  * V8 uses CheckDomainSecurity on the interface.  (JSC does this in CustomGetOwnPropertySlot)
  * V8 assigns some methods on the instance to prevent cross site access.
  * V8 generates valueOf, which needs to be protected similarly to toString().
------- Comment #1 From 2009-03-06 09:08:04 PST -------
Created an attachment (id=28362) [details]
patch
------- Comment #2 From 2009-03-06 09:58:19 PST -------
The reason to declare valueOf() is so that this code works:
   var foo = cross_site_protected_frame.location + "boo";

The implicit conversion of location here will go through valueOf, and it should be protected just as toString is.  JSC deals with this in its own CustomPropertySlot.
------- Comment #3 From 2009-03-06 10:32:34 PST -------
(From update of attachment 28362 [details])
Do these V8OnInstance flags override "custom"?  or does "Custom" really mean "JSCCustom" these days?  Either way looks fine.  CCing Sam so he sees it go by as well.
------- Comment #4 From 2009-03-06 13:46:48 PST -------
"Custom" (or "JSCCustom" or "V8Custom") tells the IDL Code Generator "don't generate binding for this, there is one hand-crafted".  The "V8OnInstance" tells the V8 code generator that this property should be installed on the object instance, rather than the prototype.  It is V8 specific (I've made all V8-specific attributes start with "V8"), and the V8 code generator knows how to generate the binding.
------- Comment #5 From 2009-03-06 14:59:45 PST -------
Does this introduce difference between the JSC and V8 bindings?  That is something we should try very hard to avoid.
------- Comment #6 From 2009-03-09 08:36:32 PST -------
@Sam: No.
------- Comment #7 From 2009-03-09 12:48:52 PST -------
    M    WebCore/ChangeLog
    M    WebCore/page/Location.idl
Committed r41535
------- Comment #8 From 2009-03-10 15:56:21 PST -------
After a little discussion, it seems that this patch did infact implement a different behavior than JSC, for one, putting the functions on the instance instead of the prototype.  The intent of my question was to try and stop any divergence at the bindings layer for the two js engines as that only hurts webkit.  

Mike, perhaps I misunderstood your answer?