Merge webkit.org at r60469 : Initial merge by git.

Change-Id: I66a0047aa2af802f66bb0c7f2a8b02247a596234

1 files changed, 14 insertions, 0 deletions

diff --git a/JavaScriptCore/runtime/JSObject.h b/JavaScriptCore/runtime/JSObject.h
index e942ad0..0738d60 100644
--- a/JavaScriptCore/runtime/JSObject.h
+++ b/JavaScriptCore/runtime/JSObject.h
@@ -88,6 +88,7 @@ namespace JSC {
 
         JSValue prototype() const;
         void setPrototype(JSValue prototype);
+        bool setPrototypeWithCycleCheck(JSValue prototype);
         
         void setStructure(NonNullPassRefPtr<Structure>);
         Structure* inheritorID();
@@ -312,6 +313,19 @@ inline JSValue JSObject::prototype() const
     return m_structure->storedPrototype();
 }
 
+inline bool JSObject::setPrototypeWithCycleCheck(JSValue prototype)
+{
+    JSValue nextPrototypeValue = prototype;
+    while (nextPrototypeValue && nextPrototypeValue.isObject()) {
+        JSObject* nextPrototype = asObject(nextPrototypeValue)->unwrappedObject();
+        if (nextPrototype == this)
+            return false;
+        nextPrototypeValue = nextPrototype->prototype();
+    }
+    setPrototype(prototype);
+    return true;
+}
+
 inline void JSObject::setPrototype(JSValue prototype)
 {
     ASSERT(prototype);