Bug 73368 - toStringCallback and valueOfCallback do not check the entire prototype chain for convertToType callback
Summary: toStringCallback and valueOfCallback do not check the entire prototype chain ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Hahnenberg
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-11-29 15:05 PST by Mark Hahnenberg
Modified: 2011-11-30 11:43 PST (History)
2 users (show)

See Also:


Attachments
Patch (3.67 KB, patch)
2011-11-29 15:07 PST, Mark Hahnenberg
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Hahnenberg 2011-11-29 15:05:27 PST
We need to check the entire chain, since the first JSClassRef may not be the one with the convertToType callback.
Comment 1 Mark Hahnenberg 2011-11-29 15:07:46 PST
Created attachment 117054 [details]
Patch
Comment 2 Mark Hahnenberg 2011-11-29 16:14:01 PST
<rdar://problem/10493218>
Comment 3 Darin Adler 2011-11-29 17:42:13 PST
Comment on attachment 117054 [details]
Patch

WebKit coding style requires more braces around those if statement bodies. We only omit them when the body is 1-line, not 1-statement-over-multiple-lines.
Comment 4 Mark Hahnenberg 2011-11-30 11:43:07 PST
Committed r101539: <http://trac.webkit.org/changeset/101539>