[V8] Fix issue with trying to access a constructor in a frame that has been removed
Created attachment 138436 [details] Patch
http://code.google.com/p/chromium/issues/detail?id=124165
Comment on attachment 138436 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=138436&action=review > LayoutTests/fast/dom/constructor-in-removed-frame.html:17 > + frame.Window; Shall we check the value of frame.Window?
(In reply to comment #3) > (From update of attachment 138436 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=138436&action=review > > > LayoutTests/fast/dom/constructor-in-removed-frame.html:17 > > + frame.Window; > > Shall we check the value of frame.Window? We could but V8 and JSC report different values. V8 returns undefined. JSC returns the Window constructor. V8 matches Firefox and Opera. IE throws access denied. Based on that I don't think we should check the actual value.
Comment on attachment 138436 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=138436&action=review >>> LayoutTests/fast/dom/constructor-in-removed-frame.html:17 >>> + frame.Window; >> >> Shall we check the value of frame.Window? > > We could but V8 and JSC report different values. > > V8 returns undefined. JSC returns the Window constructor. V8 matches Firefox and Opera. IE throws access denied. > > Based on that I don't think we should check the actual value. Sounds reasonable.
Comment on attachment 138436 [details] Patch Clearing flags on attachment: 138436 Committed r114989: <http://trac.webkit.org/changeset/114989>
All reviewed patches have been landed. Closing bug.