2011-03-28  Oliver Hunt  <oliver@apple.com>

        Reviewed by Geoffrey Garen.

        instanceof Array test fails when using iframes
        https://bugs.webkit.org/show_bug.cgi?id=17250

        Add test cases for correct behaviour

        * fast/js/js-constructors-use-correct-global-expected.txt: Added.
        * fast/js/js-constructors-use-correct-global.html: Added.
        * fast/js/resources/js-constructors-use-correct-global.js: Added.
2011-03-28  Oliver Hunt  <oliver@apple.com>

        Reviewed by Geoffrey Garen.

        instanceof Array test fails when using iframes
        https://bugs.webkit.org/show_bug.cgi?id=17250

        This is a problem with all built in constructors, the use of
        lexicalGlobalObject rather than the constructors own
        global object reference means that a builtin will always use
        the prototype from the lexical global object rather than that
        of the constructors origin.

        * API/JSObjectRef.cpp:
        (JSObjectMakeFunction):
        (JSObjectMakeRegExp):
        * JavaScriptCore.exp:
        * runtime/ArrayConstructor.cpp:
        (JSC::constructArrayWithSizeQuirk):
        * runtime/BooleanConstructor.cpp:
        (JSC::constructBoolean):
        (JSC::constructBooleanFromImmediateBoolean):
        * runtime/BooleanConstructor.h:
        * runtime/DateConstructor.cpp:
        (JSC::constructDate):
        * runtime/DateInstance.cpp:
        * runtime/DateInstance.h:
        * runtime/ErrorConstructor.cpp:
        (JSC::constructWithErrorConstructor):
        (JSC::callErrorConstructor):
        * runtime/FunctionConstructor.cpp:
        (JSC::constructWithFunctionConstructor):
        (JSC::callFunctionConstructor):
        (JSC::constructFunction):
        * runtime/FunctionConstructor.h:
        * runtime/JSCell.cpp:
        (JSC::JSCell::getOwnPropertySlot):
        (JSC::JSCell::put):
        (JSC::JSCell::deleteProperty):
        (JSC::JSCell::toThisObject):
        (JSC::JSCell::toObject):
        * runtime/JSCell.h:
        (JSC::JSCell::JSValue::toObject):
        * runtime/JSNotAnObject.cpp:
        (JSC::JSNotAnObject::toObject):
        * runtime/JSNotAnObject.h:
        * runtime/JSObject.cpp:
        (JSC::JSObject::toObject):
        * runtime/JSObject.h:
        * runtime/JSString.cpp:
        (JSC::StringObject::create):
        (JSC::JSString::toObject):
        (JSC::JSString::toThisObject):
        * runtime/JSString.h:
        * runtime/JSValue.cpp:
        (JSC::JSValue::toObjectSlowCase):
        (JSC::JSValue::toThisObjectSlowCase):
        (JSC::JSValue::synthesizeObject):
        * runtime/JSValue.h:
        * runtime/NumberConstructor.cpp:
        (JSC::constructWithNumberConstructor):
        * runtime/NumberObject.cpp:
        (JSC::constructNumber):
        * runtime/NumberObject.h:
        * runtime/ObjectConstructor.cpp:
        (JSC::constructObject):
        (JSC::constructWithObjectConstructor):
        (JSC::callObjectConstructor):
        * runtime/RegExpConstructor.cpp:
        (JSC::constructRegExp):
        (JSC::constructWithRegExpConstructor):
        (JSC::callRegExpConstructor):
        * runtime/RegExpConstructor.h:
        * runtime/StringConstructor.cpp:
        (JSC::constructWithStringConstructor):
        * runtime/StringObject.h:
2011-03-25  Oliver Hunt  <oliver@apple.com>

        Reviewed by Geoffrey Garen.

        instanceof Array test fails when using iframes
        https://bugs.webkit.org/show_bug.cgi?id=17250

        Up date for new toObject api

        * UserObjectImp.cpp:
        (UserObjectImp::toPrimitive):
        (UserObjectImp::toBoolean):
        (UserObjectImp::toNumber):
        (UserObjectImp::toString):
2011-03-28  Oliver Hunt  <oliver@apple.com>

        Reviewed by Geoffrey Garen.

        instanceof Array test fails when using iframes
        https://bugs.webkit.org/show_bug.cgi?id=17250

        Update for new function and date apis

        Test: fast/js/js-constructors-use-correct-global.html

        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::jsDateOrNull):
        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::initializeJSFunction):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@82173 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/runtime/JSString.cpp b/Source/JavaScriptCore/runtime/JSString.cpp
index c4ae969..d9c4d46 100644
--- a/Source/JavaScriptCore/runtime/JSString.cpp
+++ b/Source/JavaScriptCore/runtime/JSString.cpp
@@ -253,19 +253,19 @@
     return value(exec);
 }
 
-inline StringObject* StringObject::create(ExecState* exec, JSString* string)
+inline StringObject* StringObject::create(ExecState* exec, JSGlobalObject* globalObject, JSString* string)
 {
-    return new (exec) StringObject(exec->globalData(), exec->lexicalGlobalObject()->stringObjectStructure(), string);
+    return new (exec) StringObject(exec->globalData(), globalObject->stringObjectStructure(), string);
 }
 
-JSObject* JSString::toObject(ExecState* exec) const
+JSObject* JSString::toObject(ExecState* exec, JSGlobalObject* globalObject) const
 {
-    return StringObject::create(exec, const_cast<JSString*>(this));
+    return StringObject::create(exec, globalObject, const_cast<JSString*>(this));
 }
 
 JSObject* JSString::toThisObject(ExecState* exec) const
 {
-    return StringObject::create(exec, const_cast<JSString*>(this));
+    return StringObject::create(exec, exec->lexicalGlobalObject(), const_cast<JSString*>(this));
 }
 
 bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)