Changeset 31431 in webkit for trunk/JavaScriptCore/kjs/nodes.cpp

Timestamp:

Mar 29, 2008, 12:25:34 AM (17 years ago)

Author:

[email protected]

Message:

Bug 17924: Crash in KJS::ConstDeclNode::evaluate with |with| and |const|
<​http://bugs.webkit.org/show_bug.cgi?id=17924>
<rdar://problem/5806933>

Reviewed by Geoff.

It turns out this is trivially avoidable if we just match firefox's
semantics and ensure that an assignment in a const declaration always
writes to the variable object.

File:

• trunk/JavaScriptCore/kjs/nodes.cpp (modified) (1 diff)

trunk/JavaScriptCore/kjs/nodes.cpp

@@ -3837 +3837 @@
     ASSERT(iter != end);
 
-    PropertySlot slot;
     JSObject* base;
 
     do {
         base = *iter;
-        if (base->getPropertySlot(exec, m_ident, slot))
+        if (base->isVariableObject())
             break;
         ++iter;
     } while (iter != end);
 
-    ASSERT(base->isActivationObject() || base->isGlobalObject());
+    ASSERT(base && base->isVariableObject());
 
     static_cast<JSVariableObject*>(base)->initializeVariable(exec, m_ident, val, ReadOnly);