Changeset 47062 in webkit for trunk/JavaScriptCore/parser/Nodes.cpp

Timestamp:

Aug 11, 2009, 2:30:11 PM (16 years ago)

Author:

[email protected]

Message:

REGRESSION: Hang/crash in BytecodeGenerator::constRegisterFor loading simple page
​https://bugs.webkit.org/show_bug.cgi?id=28169

Reviewed by Geoff Garen.

Handle the case where someone has attempted to shadow a property
on the global object with a constant.

File:

• trunk/JavaScriptCore/parser/Nodes.cpp (modified) (1 diff)

trunk/JavaScriptCore/parser/Nodes.cpp

@@ -1206 +1206 @@
         return generator.emitNode(local, m_init);
     }
-    
+
+    if (generator.codeType() != EvalCode) {
+        if (m_init)
+            return generator.emitNode(m_init);
+        else
+            return generator.emitResolve(generator.newTemporary(), m_ident);
+    }
     // FIXME: While this code should only be hit in eval code, it will potentially
     // assign to the wrong base if m_ident exists in an intervening dynamic scope.