[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

[oliver at apple.com]

The following commit has been merged in the webkit-1.2 branch:
commit dbc4406447f9b50c253993e8c6405ab07f03becb
Author: oliver at apple.com <oliver at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Mon Dec 7 13:50:57 2009 +0000

    Object.create fails if properties on the descriptor are getters
    https://bugs.webkit.org/show_bug.cgi?id=32219
    
    Reviewed by Maciej Stachowiak.
    
    Correctly initialise the PropertySlots with the descriptor object.
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@51760 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 7f50860..5da0107 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,15 @@
+2009-12-07  Oliver Hunt  <oliver at apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.create fails if properties on the descriptor are getters
+        https://bugs.webkit.org/show_bug.cgi?id=32219
+
+        Correctly initialise the PropertySlots with the descriptor object.
+
+        * runtime/ObjectConstructor.cpp:
+        (JSC::toPropertyDescriptor):
+
 2009-12-06  Maciej Stachowiak  <mjs at apple.com>
 
         Not reviewed, build fix.
diff --git a/JavaScriptCore/runtime/ObjectConstructor.cpp b/JavaScriptCore/runtime/ObjectConstructor.cpp
index 837d5a6..693efc3 100644
--- a/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -148,14 +148,14 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
     }
     JSObject* description = asObject(in);
 
-    PropertySlot enumerableSlot;
+    PropertySlot enumerableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().enumerable, enumerableSlot)) {
         desc.setEnumerable(enumerableSlot.getValue(exec, exec->propertyNames().enumerable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot configurableSlot;
+    PropertySlot configurableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().configurable, configurableSlot)) {
         desc.setConfigurable(configurableSlot.getValue(exec, exec->propertyNames().configurable).toBoolean(exec));
         if (exec->hadException())
@@ -163,21 +163,21 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
     }
 
     JSValue value;
-    PropertySlot valueSlot;
+    PropertySlot valueSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().value, valueSlot)) {
         desc.setValue(valueSlot.getValue(exec, exec->propertyNames().value));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot writableSlot;
+    PropertySlot writableSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().writable, writableSlot)) {
         desc.setWritable(writableSlot.getValue(exec, exec->propertyNames().writable).toBoolean(exec));
         if (exec->hadException())
             return false;
     }
 
-    PropertySlot getSlot;
+    PropertySlot getSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().get, getSlot)) {
         JSValue get = getSlot.getValue(exec, exec->propertyNames().get);
         if (exec->hadException())
@@ -193,7 +193,7 @@ static bool toPropertyDescriptor(ExecState* exec, JSValue in, PropertyDescriptor
         desc.setGetter(get);
     }
 
-    PropertySlot setSlot;
+    PropertySlot setSlot(description);
     if (description->getPropertySlot(exec, exec->propertyNames().set, setSlot)) {
         JSValue set = setSlot.getValue(exec, exec->propertyNames().set);
         if (exec->hadException())
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 47acbcb..57d8413 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,19 @@
+2009-12-07  Oliver Hunt  <oliver at apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Object.create fails if properties on the descriptor are getters
+        https://bugs.webkit.org/show_bug.cgi?id=32219
+
+        Add tests for descriptors using getters instead of raw values
+
+        * fast/js/Object-create-expected.txt:
+        * fast/js/script-tests/Object-create.js:
+        (valueGet):
+        (get var):
+        (get var.DescriptorWithGetGetter.foo.Object.create.):
+        (get var.DescriptorWithSetGetter.foo.Object.create.):
+
 2009-12-06  Oliver Hunt  <oliver at apple.com>
 
         Reviewed by Maciej Stachowiak.
diff --git a/LayoutTests/fast/js/Object-create-expected.txt b/LayoutTests/fast/js/Object-create-expected.txt
index b89fdf0..7eb4cf9 100644
--- a/LayoutTests/fast/js/Object-create-expected.txt
+++ b/LayoutTests/fast/js/Object-create-expected.txt
@@ -13,6 +13,12 @@ PASS JSON.stringify(Object.create({},{property:{value:'foo'}, property2:{value:'
 PASS JSON.stringify(Object.create(null,{property:{value:'foo'}, property2:{value:'foo', enumerable:true}})) is '{"property2":"foo"}'
 PASS Object.getPrototypeOf(Object.create(Array.prototype)) is Array.prototype
 PASS Object.getPrototypeOf(Object.create(null)) is null
+PASS Object.create(null, DescriptorWithValueGetter).foo is true
+PASS Object.create(null, DescriptorWithEnumerableGetter).foo is true
+PASS Object.create(null, DescriptorWithConfigurableGetter).foo is true
+PASS Object.create(null, DescriptorWithWritableGetter).foo is true
+PASS Object.create(null, DescriptorWithGetGetter).foo is true
+PASS Object.create(null, DescriptorWithSetGetter).foo is true
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/LayoutTests/fast/js/script-tests/Object-create.js b/LayoutTests/fast/js/script-tests/Object-create.js
index 8deef0d..7791d72 100644
--- a/LayoutTests/fast/js/script-tests/Object-create.js
+++ b/LayoutTests/fast/js/script-tests/Object-create.js
@@ -10,4 +10,17 @@ shouldBe("JSON.stringify(Object.create({},{property:{value:'foo'}, property2:{va
 shouldBe("JSON.stringify(Object.create(null,{property:{value:'foo'}, property2:{value:'foo', enumerable:true}}))", '\'{"property2":"foo"}\'');
 shouldBe("Object.getPrototypeOf(Object.create(Array.prototype))", "Array.prototype");
 shouldBe("Object.getPrototypeOf(Object.create(null))", "null");
+function valueGet() { return true; }
+var DescriptorWithValueGetter = { foo: Object.create(null, { value: { get: valueGet }})};
+var DescriptorWithEnumerableGetter = { foo: Object.create(null, { value: {value: true}, enumerable: { get: valueGet }})};
+var DescriptorWithConfigurableGetter = { foo: Object.create(null, { value: {value: true}, configurable: { get: valueGet }})};
+var DescriptorWithWritableGetter = { foo: Object.create(null, { value: {value: true}, writable: { get: valueGet }})};
+var DescriptorWithGetGetter = { foo: Object.create(null, { get: { get: function() { return valueGet } }})};
+var DescriptorWithSetGetter = { foo: Object.create(null, { get: { value: valueGet}, set: { get: function(){ return valueGet; } }})};
+shouldBeTrue("Object.create(null, DescriptorWithValueGetter).foo");
+shouldBeTrue("Object.create(null, DescriptorWithEnumerableGetter).foo");
+shouldBeTrue("Object.create(null, DescriptorWithConfigurableGetter).foo");
+shouldBeTrue("Object.create(null, DescriptorWithWritableGetter).foo");
+shouldBeTrue("Object.create(null, DescriptorWithGetGetter).foo");
+shouldBeTrue("Object.create(null, DescriptorWithSetGetter).foo");
 successfullyParsed = true;

-- 
WebKit Debian packaging