diff options
| author | ager@chromium.org <ager@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-05-07 12:27:47 +0000 |
|---|---|---|
| committer | ager@chromium.org <ager@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-05-07 12:27:47 +0000 |
| commit | a57da952311609a16aaa23d24de00a6179db627b (patch) | |
| tree | 3dbf00dcfde1f626bef48b9bbbdae610b2e19579 /webkit/port | |
| parent | 66e8f989b6f2e48f3f9160bd77969e62b35f09a6 (diff) | |
| download | chromium_src-a57da952311609a16aaa23d24de00a6179db627b.zip chromium_src-a57da952311609a16aaa23d24de00a6179db627b.tar.gz chromium_src-a57da952311609a16aaa23d24de00a6179db627b.tar.bz2 | |
Fix crash when attempting to construct XMLHttpRequest object in a
detached document.
If there is no frame corresponding to the DOMWindow object from which
we are retrieving the constructor function, return undefined.
Attempts to construct the object will therefore throw an exception
because an attempt is made to call undefined as a function.
BUG=10861
Review URL: http://codereview.chromium.org/115079
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@15541 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'webkit/port')
| -rw-r--r-- | webkit/port/bindings/scripts/CodeGeneratorV8.pm | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/webkit/port/bindings/scripts/CodeGeneratorV8.pm b/webkit/port/bindings/scripts/CodeGeneratorV8.pm index 1474888..600b568 100644 --- a/webkit/port/bindings/scripts/CodeGeneratorV8.pm +++ b/webkit/port/bindings/scripts/CodeGeneratorV8.pm @@ -442,10 +442,11 @@ END return WorkerContextExecutionProxy::retrieve()->GetConstructor(type); END } else { - push(@implContentDecls, " return V8Proxy::retrieve()->GetConstructor(type);"); + push(@implContentDecls, " return v8::Undefined();"); } push(@implContentDecls, <<END); + } END |