Bug 13456 – REGRESSION: setTimeout "arguments" object gets shadowed by a local variable (Can't get past splash screen for KLM airlines)

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[tim bates]

1. go to http://www.klm.com/

2. select country (UK)

--> expect go to localised booking page

OBTAINED: returned to splash page, with "Netherlands" as country and language options selected.

[tim bates]

works fine in Tiger release Safari

[Alexey Proskuryakov]

Confirmed with r21002.

[Alexey Proskuryakov]

var arguments;
for (var c = 0; c < argpairs.length; c++)
{
	var pair = argpairs[c].split("=", 2);
	arguments[pair[0]] = pair[1]; // fails here, because arguments is undefined
}

This works in shipping Safari and in Firefox because the variable doesn't shadow a predefined parameters object.

[Alexey Proskuryakov]

Created attachment 14173 [details]
test case

[Darin Adler]

<rdar://problem/5163497>

[Kimmo Kinnunen]

Created attachment 14721 [details]
Fix by explicitly checking for arguments in VarDeclNode::evaluate

The solution is not so nice because it uses explicit check. the error might show up somewhere else and of course if new similar properties are added to function call scope, same kind of bug will occur. Also the patch has has longer comment part than the actual code part.
At least it gives a hint on why the bug exists..

[Darin Adler]

Comment on attachment 14721 [details]
Fix by explicitly checking for arguments in VarDeclNode::evaluate

r=me

[Darin Adler]

Committed revision 21790.