summaryrefslogtreecommitdiffstats
path: root/src/script/api
diff options
context:
space:
mode:
authorKent Hansen <kent.hansen@nokia.com>2011-03-02 07:43:54 (GMT)
committerKent Hansen <kent.hansen@nokia.com>2011-03-02 08:23:55 (GMT)
commitb991134fe4d90fcd46bab50ba164f2c28b8942db (patch)
treef7150d8f6b3b0bcaef209c9b48e2ad2cc85b0576 /src/script/api
parentd276c62812cf7404c45d447b211109f985da74a5 (diff)
downloadQt-b991134fe4d90fcd46bab50ba164f2c28b8942db.zip
Qt-b991134fe4d90fcd46bab50ba164f2c28b8942db.tar.gz
Qt-b991134fe4d90fcd46bab50ba164f2c28b8942db.tar.bz2
Don't allow non-Object values to be set as prototype
It should only be possible to set an object or null as prototype. This is consistent with both JSC and V8. Additionally, it keeps JSC from asserting in debug mode. Task-number: QTBUG-15154 Reviewed-by: Jedrzej Nowacki
Diffstat (limited to 'src/script/api')
-rw-r--r--src/script/api/qscriptvalue.cpp8
1 files changed, 6 insertions, 2 deletions
diff --git a/src/script/api/qscriptvalue.cpp b/src/script/api/qscriptvalue.cpp
index e0dc385..4772fa1 100644
--- a/src/script/api/qscriptvalue.cpp
+++ b/src/script/api/qscriptvalue.cpp
@@ -531,7 +531,12 @@ void QScriptValue::setPrototype(const QScriptValue &prototype)
Q_D(QScriptValue);
if (!d || !d->isObject())
return;
- if (prototype.isValid() && QScriptValuePrivate::getEngine(prototype)
+
+ JSC::JSValue other = d->engine->scriptValueToJSCValue(prototype);
+ if (!other || !(other.isObject() || other.isNull()))
+ return;
+
+ if (QScriptValuePrivate::getEngine(prototype)
&& (QScriptValuePrivate::getEngine(prototype) != d->engine)) {
qWarning("QScriptValue::setPrototype() failed: "
"cannot set a prototype created in "
@@ -539,7 +544,6 @@ void QScriptValue::setPrototype(const QScriptValue &prototype)
return;
}
JSC::JSObject *thisObject = JSC::asObject(d->jscValue);
- JSC::JSValue other = d->engine->scriptValueToJSCValue(prototype);
// check for cycle
JSC::JSValue nextPrototypeValue = other;