Changeset 47062 in webkit


Ignore:
Timestamp:
Aug 11, 2009 2:30:11 PM (15 years ago)
Author:
oliver@apple.com
Message:

REGRESSION: Hang/crash in BytecodeGenerator::constRegisterFor loading simple page
​https://bugs.webkit.org/show_bug.cgi?id=28169

Reviewed by Geoff Garen.

Handle the case where someone has attempted to shadow a property
on the global object with a constant.

Location:
trunk
Files:
7 edited

Legend:

Unmodified
Added
Removed

  • trunk/JavaScriptCore/ChangeLog

    r47056 r47062  
     12009-08-11  Oliver Hunt  <oliver@apple.com>
     2
     3        Reviewed by Geoff Garen.
     4
     5        REGRESSION: Hang/crash in BytecodeGenerator::constRegisterFor loading simple page
     6        https://bugs.webkit.org/show_bug.cgi?id=28169
     7
     8        Handle the case where someone has attempted to shadow a property
     9        on the global object with a constant.
     10
     11        * bytecompiler/BytecodeGenerator.cpp:
     12        (JSC::BytecodeGenerator::constRegisterFor):
     13        * parser/Nodes.cpp:
     14        (JSC::ConstDeclNode::emitCodeSingle):
     15
    1162009-08-11  John Gregg  <johnnyg@google.com>
    217

  • trunk/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

    r46879 r47062  
    471471
    472472    SymbolTableEntry entry = symbolTable().get(ident.ustring().rep());
    473     ASSERT(!entry.isNull());
     473    if (entry.isNull())
     474        return 0;
    474475
    475476    return &registerFor(entry.getIndex());

  • trunk/JavaScriptCore/parser/Nodes.cpp

    r47022 r47062  
    12061206        return generator.emitNode(local, m_init);
    12071207    }
    1208    
     1208
     1209    if (generator.codeType() != EvalCode) {
     1210        if (m_init)
     1211            return generator.emitNode(m_init);
     1212        else
     1213            return generator.emitResolve(generator.newTemporary(), m_ident);
     1214    }
    12091215    // FIXME: While this code should only be hit in eval code, it will potentially
    12101216    // assign to the wrong base if m_ident exists in an intervening dynamic scope.

  • trunk/LayoutTests/ChangeLog

    r47056 r47062  
     12009-08-11  Oliver Hunt  <oliver@apple.com>
     2
     3        Reviewed by Geoff Garen.
     4
     5        REGRESSION: Hang/crash in BytecodeGenerator::constRegisterFor loading simple page
     6        https://bugs.webkit.org/show_bug.cgi?id=28169
     7
     8        Ensure that const declarations work correctly when attempting to shadow a
     9        property on the global object.
     10
     11        * fast/js/const-expected.txt:
     12        * fast/js/const.html:
     13        * fast/js/resources/const.js:
     14
    1152009-08-11  John Gregg  <johnnyg@google.com>
    216

  • trunk/LayoutTests/fast/js/const-expected.txt

    r39125 r47062  
    5050PASS f() is f
    5151PASS const a; is undefined
     52PASS bodyId is document.getElementById('bodyId')
     53PASS ranConstInitialiser is true
    5254PASS successfullyParsed is true
    5355

  • trunk/LayoutTests/fast/js/const.html

    r11995 r47062  
    55<script src="resources/js-test-pre.js"></script>
    66</head>
    7 <body>
     7<body id="bodyId">
    88<p id="description"></p>
    99<div id="console"></div>

  • trunk/LayoutTests/fast/js/resources/const.js

    r37543 r47062  
    113113shouldBe("const a;", "undefined");
    114114
     115// Make sure we don't override properties placed on the global object
     116var ranConstInitialiser = false;
     117const bodyId = (ranConstInitialiser = true, "Const initialiser overwrote existing property");
     118shouldBe("bodyId", "document.getElementById('bodyId')");
     119shouldBeTrue("ranConstInitialiser");
    115120var successfullyParsed = true;
Note: See TracChangeset for help on using the changeset viewer.