Title: [92785] trunk
- Revision
- 92785
- Author
- [email protected]
- Date
- 2011-08-10 12:42:17 -0700 (Wed, 10 Aug 2011)
Log Message
JSEvaluteScript does not return the correct object when given JSONP data
https://bugs.webkit.org/show_bug.cgi?id=66003
Reviewed by Gavin Barraclough.
Source/_javascript_Core:
Make sure we propagate the result of the function call rather than the
argument.
* interpreter/Interpreter.cpp:
(JSC::Interpreter::execute):
Tools:
Add a test case.
* DumpRenderTree/mac/DumpRenderTree.mm:
(testStringByEvaluatingJavaScriptFromString):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (92784 => 92785)
--- trunk/Source/_javascript_Core/ChangeLog 2011-08-10 19:35:01 UTC (rev 92784)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-08-10 19:42:17 UTC (rev 92785)
@@ -1,3 +1,16 @@
+2011-08-10 Oliver Hunt <[email protected]>
+
+ JSEvaluteScript does not return the correct object when given JSONP data
+ https://bugs.webkit.org/show_bug.cgi?id=66003
+
+ Reviewed by Gavin Barraclough.
+
+ Make sure we propagate the result of the function call rather than the
+ argument.
+
+ * interpreter/Interpreter.cpp:
+ (JSC::Interpreter::execute):
+
2011-08-10 Filip Pizlo <[email protected]>
DFG JIT heap prediction causes regressions when combined with
Modified: trunk/Source/_javascript_Core/interpreter/Interpreter.cpp (92784 => 92785)
--- trunk/Source/_javascript_Core/interpreter/Interpreter.cpp 2011-08-10 19:35:01 UTC (rev 92784)
+++ trunk/Source/_javascript_Core/interpreter/Interpreter.cpp 2011-08-10 19:42:17 UTC (rev 92785)
@@ -841,7 +841,7 @@
MarkedArgumentBuffer jsonArg;
jsonArg.append(JSONPValue);
JSValue thisValue = JSONPPath.size() == 1 ? jsUndefined(): baseObject;
- JSC::call(callFrame, function, callType, callData, thisValue, jsonArg);
+ JSONPValue = JSC::call(callFrame, function, callType, callData, thisValue, jsonArg);
if (callFrame->hadException())
return jsUndefined();
break;
Modified: trunk/Tools/ChangeLog (92784 => 92785)
--- trunk/Tools/ChangeLog 2011-08-10 19:35:01 UTC (rev 92784)
+++ trunk/Tools/ChangeLog 2011-08-10 19:42:17 UTC (rev 92785)
@@ -1,3 +1,15 @@
+2011-08-10 Oliver Hunt <[email protected]>
+
+ JSEvaluteScript does not return the correct object when given JSONP data
+ https://bugs.webkit.org/show_bug.cgi?id=66003
+
+ Reviewed by Gavin Barraclough.
+
+ Add a test case.
+
+ * DumpRenderTree/mac/DumpRenderTree.mm:
+ (testStringByEvaluatingJavaScriptFromString):
+
2011-08-10 Eric Seidel <[email protected]>
WIN: NRWT runs compositing tests on configurations that don't support compositing
Modified: trunk/Tools/DumpRenderTree/mac/DumpRenderTree.mm (92784 => 92785)
--- trunk/Tools/DumpRenderTree/mac/DumpRenderTree.mm 2011-08-10 19:35:01 UTC (rev 92784)
+++ trunk/Tools/DumpRenderTree/mac/DumpRenderTree.mm 2011-08-10 19:42:17 UTC (rev 92785)
@@ -354,6 +354,7 @@
@"", @"undefined",
@"true", @"true",
@"false", @"false",
+ @"", @"alert('Should not be result')",
nil
];
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
