Fix crash in String.arg()

This commit ensures that the String.arg() function works correctly,
by registering an anonymous function with the String Prototype object
which calls the StringArg function, ensuring that the "this" object
is valid (and passing the string as an argument to StringArg instead).

Change-Id: I0a8cbaa12b39beb03a237c3ab62c6e21fafdedbf
Reviewed-on: http://codereview.qt-project.org/4385
Reviewed-by: Qt Sanity Bot <qt_sanity_bot@ovi.com>
Reviewed-by: Aaron Kennedy <aaron.kennedy@nokia.com>

2 files changed, 26 insertions, 12 deletions

diff --git a/src/declarative/qml/v8/qdeclarativebuiltinfunctions.cpp b/src/declarative/qml/v8/qdeclarativebuiltinfunctions.cpp
index 8dfc11fed8..96c51da0ef 100644
--- a/src/declarative/qml/v8/qdeclarativebuiltinfunctions.cpp
+++ b/src/declarative/qml/v8/qdeclarativebuiltinfunctions.cpp
@@ -98,17 +98,19 @@ v8::Handle<v8::Value> stringArg(const v8::Arguments &args)
     if (args.Length() != 1)
         V8THROW_ERROR("String.arg(): Invalid arguments");
 
-    if (args[0]->IsUint32())
-        return V8ENGINE()->toString(value.arg(args[0]->Uint32Value()));
-    else if (args[0]->IsInt32())
-        return V8ENGINE()->toString(value.arg(args[0]->Int32Value()));
-    else if (args[0]->IsNumber())
-        return V8ENGINE()->toString(value.arg(args[0]->NumberValue()));
-    else if (args[0]->IsBoolean())
-        return V8ENGINE()->toString(value.arg(args[0]->BooleanValue()));
+    v8::Handle<v8::Value> arg = args[0];
+    if (arg->IsUint32())
+        return V8ENGINE()->toString(value.arg(arg->Uint32Value()));
+    else if (arg->IsInt32())
+        return V8ENGINE()->toString(value.arg(arg->Int32Value()));
+    else if (arg->IsNumber())
+        return V8ENGINE()->toString(value.arg(arg->NumberValue()));
+    else if (arg->IsBoolean())
+        return V8ENGINE()->toString(value.arg(arg->BooleanValue()));
 
-    return V8ENGINE()->toString(value.arg(V8ENGINE()->toString(args[0])));
+    return V8ENGINE()->toString(value.arg(V8ENGINE()->toString(arg)));
 }
+
 /*!
 \qmlmethod bool Qt::isQtObject(object)
 Returns true if \c object is a valid reference to a Qt or QML object, otherwise false.
diff --git a/src/declarative/qml/v8/qv8engine.cpp b/src/declarative/qml/v8/qv8engine.cpp
index 7be74f8711..4bbea93c00 100644
--- a/src/declarative/qml/v8/qv8engine.cpp
+++ b/src/declarative/qml/v8/qv8engine.cpp
@@ -546,9 +546,21 @@ void QV8Engine::initializeGlobal(v8::Handle<v8::Object> global)
     global->Set(v8::String::New("Qt"), qt);
     global->Set(v8::String::New("gc"), V8FUNCTION(QDeclarativeBuiltinFunctions::gc, this));
 
-    v8::Local<v8::Object> string = v8::Local<v8::Object>::Cast(global->Get(v8::String::New("String")));
-    v8::Local<v8::Object> stringPrototype = v8::Local<v8::Object>::Cast(string->Get(v8::String::New("prototype")));
-    stringPrototype->Set(v8::String::New("arg"), V8FUNCTION(stringArg, this));
+    {
+#define STRING_ARG "(function(stringArg) { "\
+                   "    String.prototype.arg = (function() {"\
+                   "        return stringArg.apply(this, arguments);"\
+                   "    })"\
+                   "})"
+
+        v8::Local<v8::Script> registerArg = v8::Script::New(v8::String::New(STRING_ARG), 0, 0, v8::Handle<v8::String>(), v8::Script::NativeMode);
+        v8::Local<v8::Value> result = registerArg->Run();
+        Q_ASSERT(result->IsFunction());
+        v8::Local<v8::Function> registerArgFunc = v8::Local<v8::Function>::Cast(result);
+        v8::Handle<v8::Value> args = V8FUNCTION(stringArg, this);
+        registerArgFunc->Call(v8::Local<v8::Object>::Cast(registerArgFunc), 1, &args);
+#undef STRING_ARG
+    }
 
     qt_add_domexceptions(this);
     m_xmlHttpRequestData = qt_add_qmlxmlhttprequest(this);