Title: [292886] trunk/Source/_javascript_Core
- Revision
- 292886
- Author
- [email protected]
- Date
- 2022-04-14 13:19:14 -0700 (Thu, 14 Apr 2022)
Log Message
InternalFunction::createSubclassStructure() should use base object's global object
https://bugs.webkit.org/show_bug.cgi?id=239346
Unreviewed, account for offline feedback by Yusuke Suzuki.
* runtime/InternalFunction.cpp:
(JSC::InternalFunction::createSubclassStructure):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (292885 => 292886)
--- trunk/Source/_javascript_Core/ChangeLog 2022-04-14 19:52:17 UTC (rev 292885)
+++ trunk/Source/_javascript_Core/ChangeLog 2022-04-14 20:19:14 UTC (rev 292886)
@@ -3,6 +3,16 @@
InternalFunction::createSubclassStructure() should use base object's global object
https://bugs.webkit.org/show_bug.cgi?id=239346
+ Unreviewed, account for offline feedback by Yusuke Suzuki.
+
+ * runtime/InternalFunction.cpp:
+ (JSC::InternalFunction::createSubclassStructure):
+
+2022-04-14 Alexey Shvayka <[email protected]>
+
+ InternalFunction::createSubclassStructure() should use base object's global object
+ https://bugs.webkit.org/show_bug.cgi?id=239346
+
Reviewed by Darin Adler.
Chrome and Firefox don't agree on interoperable behavior in case of cross-realm
Modified: trunk/Source/_javascript_Core/runtime/InternalFunction.cpp (292885 => 292886)
--- trunk/Source/_javascript_Core/runtime/InternalFunction.cpp 2022-04-14 19:52:17 UTC (rev 292885)
+++ trunk/Source/_javascript_Core/runtime/InternalFunction.cpp 2022-04-14 20:19:14 UTC (rev 292886)
@@ -161,7 +161,7 @@
if (JSObject* prototype = jsDynamicCast<JSObject*>(vm, prototypeValue)) {
// This only happens if someone Reflect.constructs our builtin constructor with another builtin constructor as the new.target.
// Thus, we don't care about the cost of looking up the structure from our hash table every time.
- return baseGlobalObject->structureCache().emptyStructureForPrototypeFromBaseStructure(globalObject, prototype, baseClass);
+ return baseGlobalObject->structureCache().emptyStructureForPrototypeFromBaseStructure(baseGlobalObject, prototype, baseClass);
}
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
