Fix crash in pixmapToImageData binding

The result of JSContextGetGlobalObject is a wrapper-object not a
direct pointer to the global object. Instead access the global object
directly since we are already using other parts of the internal JS API.

The patch also adds a missing API shim that should be held when using the
internal JS API.

Task-number: QTBUG-38809
Change-Id: I76eccbbd6cb1b9fd3322596bb7d6a3f9b0e694b8
Reviewed-by: Michael Bruning <michael.bruning@digia.com>

1 files changed, 6 insertions, 2 deletions

diff --git a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
index 8689307c5..2f81f44e7 100644
--- a/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
+++ b/Source/WebCore/bridge/qt/qt_pixmapruntime.cpp
@@ -20,6 +20,7 @@
 #include "qt_pixmapruntime.h"
 
 #include "APICast.h"
+#include "APIShims.h"
 #include "CachedImage.h"
 #include "HTMLImageElement.h"
 #include "ImageData.h"
@@ -149,10 +150,13 @@ static JSValueRef pixmapToImageData(JSContextRef context, JSObjectRef function,
     int width = image.width();
     int height = image.height();
 
+    JSC::ExecState* exec = ::toJS(context);
+    APIEntryShim entryShim(exec);
+
     RefPtr<ImageData> imageData = ImageData::create(IntSize(width, height));
     copyPixelsInto(image, width, height, imageData->data()->data());
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(::toJS(JSContextGetGlobalObject(context)));
-    JSC::ExecState* exec = ::toJS(context);
+
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
     return ::toRef(exec, toJS(exec, globalObject, imageData.get()));
 }