Changeset 76148 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Jan 19, 2011, 12:18:57 PM (14 years ago)

Author:

[email protected]

Message:

2011-01-19 Oliver Hunt <​[email protected]>

Reviewed by Gavin Barraclough.

[jsfunfuzz] Defining a function called proto inside an eval triggers an assertion
​https://bugs.webkit.org/show_bug.cgi?id=52672

Add tests to ensure that we disallow proto as a function name.

• fast/js/parser-syntax-check-expected.txt:
• fast/js/script-tests/parser-syntax-check.js:

2011-01-19 Oliver Hunt <​[email protected]>

Reviewed by Gavin Barraclough.

[jsfunfuzz] Defining a function called proto inside an eval triggers an assertion
​https://bugs.webkit.org/show_bug.cgi?id=52672

Rather than coming up with a somewhat convoluted mechanism to ensure that
developers can override the global objects prototype with a function named
proto and expect it to work, we just disallow it at the syntax level.

• parser/JSParser.cpp: (JSC::JSParser::parseFunctionInfo):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• parser/JSParser.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-01-19  Oliver Hunt  <[email protected]>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] Defining a function called __proto__ inside an eval triggers an assertion
+        https://bugs.webkit.org/show_bug.cgi?id=52672
+
+        Rather than coming up with a somewhat convoluted mechanism to ensure that
+        developers can override the global objects prototype with a function named
+        __proto__ and expect it to work, we just disallow it at the syntax level.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseFunctionInfo):
+
 2011-01-19  Michael Saboff  <[email protected]>
 

trunk/Source/JavaScriptCore/parser/JSParser.cpp

@@ -1224 +1224 @@
     if (match(IDENT)) {
         name = m_token.m_data.ident;
+        failIfTrue(*name == m_globalData->propertyNames->underscoreProto);
         next();
         if (!nameIsInContainingScope)