Bug 24424 - Unify JSC/V8 Location.idl
Summary: Unify JSC/V8 Location.idl
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore JavaScript (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Mike Belshe
Depends on:
Reported: 2009-03-06 09:02 PST by Mike Belshe
Modified: 2009-03-10 15:56 PDT (History)
1 user (show)

See Also:

patch (1.77 KB, patch)
2009-03-06 09:08 PST, Mike Belshe
eric: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Belshe 2009-03-06 09:02:40 PST
There is no functionality difference between V8 and JSC here.

Implementation differences:
  * V8 uses CheckDomainSecurity on the interface.  (JSC does this in CustomGetOwnPropertySlot)
  * V8 assigns some methods on the instance to prevent cross site access.
  * V8 generates valueOf, which needs to be protected similarly to toString().
Comment 1 Mike Belshe 2009-03-06 09:08:04 PST
Created attachment 28362 [details]
Comment 2 Mike Belshe 2009-03-06 09:58:19 PST
The reason to declare valueOf() is so that this code works:
   var foo = cross_site_protected_frame.location + "boo";

The implicit conversion of location here will go through valueOf, and it should be protected just as toString is.  JSC deals with this in its own CustomPropertySlot.
Comment 3 Eric Seidel (no email) 2009-03-06 10:32:34 PST
Comment on attachment 28362 [details]

Do these V8OnInstance flags override "custom"?  or does "Custom" really mean "JSCCustom" these days?  Either way looks fine.  CCing Sam so he sees it go by as well.
Comment 4 Mike Belshe 2009-03-06 13:46:48 PST
"Custom" (or "JSCCustom" or "V8Custom") tells the IDL Code Generator "don't generate binding for this, there is one hand-crafted".  The "V8OnInstance" tells the V8 code generator that this property should be installed on the object instance, rather than the prototype.  It is V8 specific (I've made all V8-specific attributes start with "V8"), and the V8 code generator knows how to generate the binding.
Comment 5 Sam Weinig 2009-03-06 14:59:45 PST
Does this introduce difference between the JSC and V8 bindings?  That is something we should try very hard to avoid.
Comment 6 Mike Belshe 2009-03-09 08:36:32 PDT
@Sam: No.
Comment 7 Eric Seidel (no email) 2009-03-09 12:48:52 PDT
	M	WebCore/ChangeLog
	M	WebCore/page/Location.idl
Committed r41535
Comment 8 Sam Weinig 2009-03-10 15:56:21 PDT
After a little discussion, it seems that this patch did infact implement a different behavior than JSC, for one, putting the functions on the instance instead of the prototype.  The intent of my question was to try and stop any divergence at the bindings layer for the two js engines as that only hurts webkit.  

Mike, perhaps I misunderstood your answer?