Bug 34899 - [V8] Crash regression in r54305 when window.event is set by a script
Summary: [V8] Crash regression in r54305 when window.event is set by a script
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nate Chapin
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-02-12 10:11 PST by Nate Chapin
Modified: 2010-02-18 09:25 PST (History)
0 users

See Also:


Attachments
patch (5.18 KB, patch)
2010-02-12 10:23 PST, Nate Chapin
eric: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Nate Chapin 2010-02-12 10:11:13 PST
ScriptController.cpp:174 doesn't handle the possibility that the event field on the global object is set to a v8::Object that isn't a DOM wrapper.  This can only happen if a script has directly set window.event.
Comment 1 Nate Chapin 2010-02-12 10:23:33 PST
Created attachment 48651 [details]
patch
Comment 2 Eric Seidel (no email) 2010-02-17 16:15:20 PST
Comment on attachment 48651 [details]
patch

Ideally fast/dom/Window/window-event-override-no-crash.html should have a newline at the end, but this looks great!