[PATCH v3 2/3] mshtml: Validate builtin host functions in IE9+ using prototype_id rather than tid where possible.

[Gabriel Ivăncescu]

From: Gabriel Ivăncescu

Signed-off-by: Gabriel Ivăncescu 
---
 dlls/mshtml/dispex.c              |  6 +++---
 dlls/mshtml/tests/documentmode.js | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/dlls/mshtml/dispex.c b/dlls/mshtml/dispex.c
index 80ccc83069f..8ef29452c19 100644
--- a/dlls/mshtml/dispex.c
+++ b/dlls/mshtml/dispex.c
@@ -2614,13 +2614,13 @@ static HRESULT get_host_property_descriptor(DispatchEx *This, DISPID id, struct
         desc->flags = PROPF_CONFIGURABLE;
         desc->name = func->name;
         if(func->func_disp_idx >= 0) {
-            desc->iid = func->tid;
+            desc->iid = This->info->desc->id;
             desc->flags |= PROPF_METHOD | PROPF_WRITABLE;
         }else {
             if(func->func_disp_idx == -1)
                 desc->flags |= PROPF_ENUMERABLE;
             if(This->info->is_prototype) {
-                desc->iid = func->tid;
+                desc->iid = This->info->desc->id;
                 if(func->put_vtbl_off)
                     desc->flags |= PROPF_WRITABLE;
             }else {
@@ -2731,7 +2731,7 @@ static HRESULT WINAPI JSDispatchHost_CallFunction(IWineJSDispatchHost *iface, DI
     TRACE("%s (%p)->(%lx %x %lx %p %p %p %p)\n", This->info->name, This, id, iid, flags, dp, ret, ei, caller);

hres = get_builtin_func(This->info, id, &func);
-    if(FAILED(hres) || func->tid != iid)
+    if(FAILED(hres) || iid != (This->info->compat_mode < COMPAT_MODE_IE9 ? func->tid : func->prototype_id))
         return E_UNEXPECTED;

switch(flags) {
diff --git a/dlls/mshtml/tests/documentmode.js b/dlls/mshtml/tests/documentmode.js
index f9967e8a6bd..634f4ad3420 100644
--- a/dlls/mshtml/tests/documentmode.js
+++ b/dlls/mshtml/tests/documentmode.js
@@ -3146,6 +3146,13 @@ sync_test("__proto__", function() {
         ok(e.number === 0xa13b6 - 0x80000000 && e.name === "TypeError",
             "changing __proto__ on non-extensible object threw exception " + e.number + " (" + e.name + ")");
     }
+
+    obj = document.createElement("img");
+    obj.__proto__ = ctor.prototype;
+    document.body.setAttribute.call(obj, "height", "101");
+    r = document.body.getAttribute.call(obj, "height");
+    ok(r === "101", "getAttribute(height) = " + r);
+    ok(!("getAttribute" in obj), "getAttribute exposed in obj");
 });

sync_test("__defineGetter__", function() {
@@ -3765,6 +3772,13 @@ sync_test("prototypes", function() {
     check(Attr.prototype, Node.prototype, "attr prototype");
     check(document.createDocumentFragment(), DocumentFragment.prototype, "fragment");
     check(DocumentFragment.prototype, Node.prototype, "fragment prototype");
+
+    try {
+        HTMLAreaElement.prototype.toString.call(document.createElement("a"));
+        ok(false, "Area element's toString on Anchor element didn't fail");
+    } catch(e) {
+        ok(e.number == 0xffff - 0x80000000, "Area element's toString on Anchor element threw exception " + e.number);
+    }
 });

sync_test("prototype props", function() {