diff options
| author | ager@google.com <ager@google.com@0039d316-1c4b-4281-b951-d872f2087c98> | 2008-11-04 13:02:55 +0000 |
|---|---|---|
| committer | ager@google.com <ager@google.com@0039d316-1c4b-4281-b951-d872f2087c98> | 2008-11-04 13:02:55 +0000 |
| commit | 8c24781522df3715ba67507cf39749e487357fe6 (patch) | |
| tree | 245279b18d125aa10531928bb5105483f81a0efa /webkit/data | |
| parent | 227b893438d86342020ee9b4a7cbf17b03d4452b (diff) | |
| download | chromium_src-8c24781522df3715ba67507cf39749e487357fe6.zip chromium_src-8c24781522df3715ba67507cf39749e487357fe6.tar.gz chromium_src-8c24781522df3715ba67507cf39749e487357fe6.tar.bz2 | |
Fix two issues with window.location:
- Disallow shadowing of window.location using __defineGetter__ and
__defineSetter__.
- Make sure that funtions such as toString on location objects cannot
be overwritten by user functions.
This needs V8 revision 656. This will be put back once we have pushed
that version.
Review URL: http://codereview.chromium.org/8737
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@4598 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'webkit/data')
| -rw-r--r-- | webkit/data/layout_tests/chrome/fast/dom/location-shadowing-expected.txt | 5 | ||||
| -rw-r--r-- | webkit/data/layout_tests/chrome/fast/dom/location-shadowing.html | 49 |
2 files changed, 54 insertions, 0 deletions
diff --git a/webkit/data/layout_tests/chrome/fast/dom/location-shadowing-expected.txt b/webkit/data/layout_tests/chrome/fast/dom/location-shadowing-expected.txt new file mode 100644 index 0000000..a9b2554 --- /dev/null +++ b/webkit/data/layout_tests/chrome/fast/dom/location-shadowing-expected.txt @@ -0,0 +1,5 @@ +PASS +PASS +PASS +PASS + diff --git a/webkit/data/layout_tests/chrome/fast/dom/location-shadowing.html b/webkit/data/layout_tests/chrome/fast/dom/location-shadowing.html new file mode 100644 index 0000000..6e9bac4 --- /dev/null +++ b/webkit/data/layout_tests/chrome/fast/dom/location-shadowing.html @@ -0,0 +1,49 @@ +<html> +<body onload="test()"> +<script> +// This tests that the location property on the window object +// cannot be overwritten by using accessors defined using +// __defineGetter__ and __defineSetter__ and that functions +//on location objects are read-only. + +if (window.layoutTestController) { + layoutTestController.dumpAsText(); +} + +function check(passed) { + if (passed) { + document.write("PASS<br>"); + } else { + document.write("FAIL<br>"); + } +} + +var locationFunctions = ["reload", "replace", "assign", "toString"]; + +function overwrite() { return 'overwrite'; }; + +function testFunctionOverwrite() { + for (var i = 0; i < locationFunctions.length; i++) { + location[locationFunctions[i]] = overwrite; + check(location[locationFunctions[i]] != overwrite); + } +} + +function failIfCalled() { check(false); } + +function testAccessorOverwrite() { + __defineGetter__("location", failIfCalled); + var l = location; + window.__defineGetter__("location", failIfCalled); + l = window.location; + this.__defineGetter__("location", failIfCalled); + l = this.location; +} + +function test() { + testFunctionOverwrite(); + testAccessorOverwrite(); +} +</script> +</body> +</html> |