Bug 84640 – [V8] Fix issue with trying to access a constructor in a frame that has been removed

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Erik Arvidsson]

[V8] Fix issue with trying to access a constructor in a frame that has been removed

[Erik Arvidsson]

Created attachment 138436 [details]
Patch

[Erik Arvidsson]

http://code.google.com/p/chromium/issues/detail?id=124165

[Kentaro Hara]

Comment on attachment 138436 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=138436&action=review

> LayoutTests/fast/dom/constructor-in-removed-frame.html:17
> +            frame.Window;

Shall we check the value of frame.Window?

[Erik Arvidsson]

(In reply to comment #3)
> (From update of attachment 138436 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=138436&action=review
> 
> > LayoutTests/fast/dom/constructor-in-removed-frame.html:17
> > +            frame.Window;
> 
> Shall we check the value of frame.Window?

We could but V8 and JSC report different values.

V8 returns undefined. JSC returns the Window constructor. V8 matches Firefox and Opera. IE throws access denied.

Based on that I don't think we should check the actual value.

[Kentaro Hara]

Comment on attachment 138436 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=138436&action=review

>>> LayoutTests/fast/dom/constructor-in-removed-frame.html:17
>>> +            frame.Window;
>> 
>> Shall we check the value of frame.Window?
> 
> We could but V8 and JSC report different values.
> 
> V8 returns undefined. JSC returns the Window constructor. V8 matches Firefox and Opera. IE throws access denied.
> 
> Based on that I don't think we should check the actual value.

Sounds reasonable.

[WebKit Review Bot]

Comment on attachment 138436 [details]
Patch

Clearing flags on attachment: 138436

Committed r114989: <http://trac.webkit.org/changeset/114989>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.