Changeset 76148 in webkit for trunk/Source/JavaScriptCore/parser/JSParser.cpp

Timestamp:

Jan 19, 2011, 12:18:57 PM (14 years ago)

Author:

[email protected]

Message:

2011-01-19 Oliver Hunt <​[email protected]>

Reviewed by Gavin Barraclough.

[jsfunfuzz] Defining a function called proto inside an eval triggers an assertion
​https://bugs.webkit.org/show_bug.cgi?id=52672

Add tests to ensure that we disallow proto as a function name.

• fast/js/parser-syntax-check-expected.txt:
• fast/js/script-tests/parser-syntax-check.js:

2011-01-19 Oliver Hunt <​[email protected]>

Reviewed by Gavin Barraclough.

[jsfunfuzz] Defining a function called proto inside an eval triggers an assertion
​https://bugs.webkit.org/show_bug.cgi?id=52672

Rather than coming up with a somewhat convoluted mechanism to ensure that
developers can override the global objects prototype with a function named
proto and expect it to work, we just disallow it at the syntax level.

• parser/JSParser.cpp: (JSC::JSParser::parseFunctionInfo):

File:

• trunk/Source/JavaScriptCore/parser/JSParser.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/parser/JSParser.cpp

@@ -1224 +1224 @@
     if (match(IDENT)) {
         name = m_token.m_data.ident;
+        failIfTrue(*name == m_globalData->propertyNames->underscoreProto);
         next();
         if (!nameIsInContainingScope)