2007-01-18 Mark Rowe <mrowe@apple.com>

        Reviewed by Tim H.

        Fix for http://bugs.webkit.org/show_bug.cgi?id=7926
        Bug 7926: Crash using -callWebScriptMethod to access offsetTop property

        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject callWebScriptMethod:withArguments:]): Bail out early if function value is an immediate,
        or if the function object is not callable.


git-svn-id: svn://svn.chromium.org/blink/trunk@18973 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/WebCore/ChangeLog

+2007-01-18  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim H.
+
+        Fix for http://bugs.webkit.org/show_bug.cgi?id=7926
+        Bug 7926: Crash using -callWebScriptMethod to access offsetTop property
+
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]): Bail out early if function value is an immediate,
+        or if the function object is not callable.
+
 2007-01-18  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Maciej.

third_party/WebKit/WebCore/bindings/objc/WebScriptObject.mm

@@ -181,13 +181,15 @@ static List listFromNSArray(ExecState *exec, NSArray *array)
     Identifier identifier(v->toString(exec));
     JSValue *func = [self _imp]->get(exec, identifier);
 
-    if (!func || func->isUndefined()) {
+    if (!func || !func->isObject())
         // Maybe throw an exception here?
         return 0;
-    }
 
-    // Call the function object.    
+    // Call the function object.
     JSObject *funcImp = static_cast<JSObject*>(func);
+    if (!funcImp->implementsCall())
+        return 0;
+
     JSObject *thisObj = const_cast<JSObject*>([self _imp]);
     List argList = listFromNSArray(exec, args);
     JSValue *result = funcImp->call(exec, thisObj, argList);