diff options
| author | ager@chromium.org <ager@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-05-07 12:27:47 +0000 |
|---|---|---|
| committer | ager@chromium.org <ager@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-05-07 12:27:47 +0000 |
| commit | a57da952311609a16aaa23d24de00a6179db627b (patch) | |
| tree | 3dbf00dcfde1f626bef48b9bbbdae610b2e19579 /webkit | |
| parent | 66e8f989b6f2e48f3f9160bd77969e62b35f09a6 (diff) | |
| download | chromium_src-a57da952311609a16aaa23d24de00a6179db627b.zip chromium_src-a57da952311609a16aaa23d24de00a6179db627b.tar.gz chromium_src-a57da952311609a16aaa23d24de00a6179db627b.tar.bz2 | |
Fix crash when attempting to construct XMLHttpRequest object in a
detached document.
If there is no frame corresponding to the DOMWindow object from which
we are retrieving the constructor function, return undefined.
Attempts to construct the object will therefore throw an exception
because an attempt is made to call undefined as a function.
BUG=10861
Review URL: http://codereview.chromium.org/115079
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@15541 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'webkit')
4 files changed, 12 insertions, 4 deletions
diff --git a/webkit/data/layout_tests/platform/chromium-mac/LayoutTests/fast/dom/xmlhttprequest-constructor-in-detached-document-expected.txt b/webkit/data/layout_tests/platform/chromium-mac/LayoutTests/fast/dom/xmlhttprequest-constructor-in-detached-document-expected.txt new file mode 100644 index 0000000..b648fe2 --- /dev/null +++ b/webkit/data/layout_tests/platform/chromium-mac/LayoutTests/fast/dom/xmlhttprequest-constructor-in-detached-document-expected.txt @@ -0,0 +1,5 @@ +CONSOLE MESSAGE: line 160: Uncaught TypeError: undefined is not a function
+Text for bug 25290: Crash when constructing XMLHttpRequest in a detached document.
+
+PASS
+
diff --git a/webkit/data/layout_tests/platform/chromium-win/LayoutTests/fast/dom/xmlhttprequest-constructor-in-detached-document-expected.txt b/webkit/data/layout_tests/platform/chromium-win/LayoutTests/fast/dom/xmlhttprequest-constructor-in-detached-document-expected.txt new file mode 100644 index 0000000..b648fe2 --- /dev/null +++ b/webkit/data/layout_tests/platform/chromium-win/LayoutTests/fast/dom/xmlhttprequest-constructor-in-detached-document-expected.txt @@ -0,0 +1,5 @@ +CONSOLE MESSAGE: line 160: Uncaught TypeError: undefined is not a function
+Text for bug 25290: Crash when constructing XMLHttpRequest in a detached document.
+
+PASS
+
diff --git a/webkit/port/bindings/scripts/CodeGeneratorV8.pm b/webkit/port/bindings/scripts/CodeGeneratorV8.pm index 1474888..600b568 100644 --- a/webkit/port/bindings/scripts/CodeGeneratorV8.pm +++ b/webkit/port/bindings/scripts/CodeGeneratorV8.pm @@ -442,10 +442,11 @@ END return WorkerContextExecutionProxy::retrieve()->GetConstructor(type); END } else { - push(@implContentDecls, " return V8Proxy::retrieve()->GetConstructor(type);"); + push(@implContentDecls, " return v8::Undefined();"); } push(@implContentDecls, <<END); + } END diff --git a/webkit/tools/layout_tests/test_expectations.txt b/webkit/tools/layout_tests/test_expectations.txt index 0ea43ed..89aa139 100644 --- a/webkit/tools/layout_tests/test_expectations.txt +++ b/webkit/tools/layout_tests/test_expectations.txt @@ -2268,9 +2268,6 @@ BUG10760 MAC : LayoutTests/svg/W3C-SVG-1.1/painting-marker-02-f.svg = PASS FAIL BUG10859 LINUX MAC : LayoutTests/fast/dom/HTMLSelectElement/named-options.html = FAIL BUG10861 WIN : LayoutTests/fast/dom/HTMLSelectElement/named-options.html = FAIL -// New tests from WebKit Merge 42671:42725 -BUG10861 WIN LINUX MAC : LayoutTests/fast/dom/xmlhttprequest-constructor-in-detached-document.html = CRASH - // New failures from WebKit Merge 42671:42725 BUG10861 WIN : LayoutTests/security/block-test.html = FAIL BUG10861 WIN : LayoutTests/http/tests/plugins/post-url-file.html = PASS |