Updated WebKit to efbf910ad7c49e8cdf81411b4ac0abeea0efd8f8

Reviewed by: Andreas Kling

4 files changed, 27 insertions, 7 deletions

diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSFunction.cpp b/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSFunction.cpp
index 639cea8..407b3b1 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSFunction.cpp
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSFunction.cpp
@@ -174,6 +174,23 @@ JSValue JSFunction::lengthGetter(ExecState*, JSValue slotBase, const Identifier&
     return jsNumber(thisObj->jsExecutable()->parameterCount());
 }
 
+static inline WriteBarrierBase<Unknown>* createPrototypeProperty(JSGlobalData& globalData, JSGlobalObject* globalObject, JSFunction* function)
+{
+    ExecState* exec = globalObject->globalExec();
+    if (WriteBarrierBase<Unknown>* location = function->getDirectLocation(globalData, exec->propertyNames().prototype))
+        return location;
+    JSObject* prototype = constructEmptyObject(exec, globalObject->emptyObjectStructure());
+    prototype->putDirect(globalData, exec->propertyNames().constructor, function, DontEnum);
+    function->putDirect(globalData, exec->propertyNames().prototype, prototype, DontDelete | DontEnum);
+    return function->getDirectLocation(exec->globalData(), exec->propertyNames().prototype);
+}
+
+void JSFunction::preventExtensions(JSGlobalData& globalData)
+{
+    createPrototypeProperty(globalData, scope()->globalObject.get(), this);
+    JSObject::preventExtensions(globalData);
+}
+
 bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     if (isHostFunction())
@@ -182,12 +199,8 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     if (propertyName == exec->propertyNames().prototype) {
         WriteBarrierBase<Unknown>* location = getDirectLocation(exec->globalData(), propertyName);
 
-        if (!location) {
-            JSObject* prototype = constructEmptyObject(exec, scope()->globalObject->emptyObjectStructure());
-            prototype->putDirect(exec->globalData(), exec->propertyNames().constructor, this, DontEnum);
-            putDirect(exec->globalData(), exec->propertyNames().prototype, prototype, DontDelete | DontEnum);
-            location = getDirectLocation(exec->globalData(), propertyName);
-        }
+        if (!location)
+            location = createPrototypeProperty(exec->globalData(), scope()->globalObject.get(), this);
 
         slot.setValue(this, location->get(), offsetForLocation(location));
     }
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSFunction.h b/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSFunction.h
index ba0a792..42fd62a 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSFunction.h
@@ -91,6 +91,7 @@ namespace JSC {
 
         bool isHostFunctionNonInline() const;
 
+        virtual void preventExtensions(JSGlobalData&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
         virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&, EnumerationMode mode = ExcludeDontEnumProperties);
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSObject.cpp
index ae29a7b..ce21703 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSObject.cpp
@@ -508,11 +508,17 @@ JSObject* JSObject::unwrappedObject()
 
 void JSObject::seal(JSGlobalData& globalData)
 {
+    if (isSealed(globalData))
+        return;
+    preventExtensions(globalData);
     setStructure(globalData, Structure::sealTransition(globalData, m_structure.get()));
 }
 
 void JSObject::freeze(JSGlobalData& globalData)
 {
+    if (isFrozen(globalData))
+        return;
+    preventExtensions(globalData);
     setStructure(globalData, Structure::freezeTransition(globalData, m_structure.get()));
 }
 
diff --git a/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSObject.h
index a6b78bd..768c457 100644
--- a/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/Source/JavaScriptCore/runtime/JSObject.h
@@ -211,7 +211,7 @@ namespace JSC {
 
         void seal(JSGlobalData&);
         void freeze(JSGlobalData&);
-        void preventExtensions(JSGlobalData&);
+        virtual void preventExtensions(JSGlobalData&);
         bool isSealed(JSGlobalData& globalData) { return m_structure->isSealed(globalData); }
         bool isFrozen(JSGlobalData& globalData) { return m_structure->isFrozen(globalData); }
         bool isExtensible() { return m_structure->isExtensible(); }