Bug 31485 - JSValueProtect and JSValueUnprotect don't protect API wrapper values
Summary: JSValueProtect and JSValueUnprotect don't protect API wrapper values
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-11-13 11:57 PST by Oliver Hunt
Modified: 2009-11-13 18:09 PST (History)
0 users

See Also:


Attachments
Patch (3.41 KB, patch)
2009-11-13 12:00 PST, Oliver Hunt
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2009-11-13 11:57:28 PST
toJS strips out the wrapper objects made for number cells in the API, which means the protect/unprotect become no-ops.  Clearly this is a Bad Thing (tm)
Comment 1 Oliver Hunt 2009-11-13 12:00:07 PST
Created attachment 43182 [details]
Patch
Comment 2 Geoffrey Garen 2009-11-13 12:07:40 PST
Comment on attachment 43182 [details]
Patch

r=me
Comment 3 Oliver Hunt 2009-11-13 12:42:41 PST
Committed r50964