Bug 20293

Summary:

Crash in JavaScript codegen for eval("const a;")

Product:

WebKit

Reporter:

Cameron Zwarich (cpst) <zwarich>

Component:

JavaScriptCore

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

ggaren, mjs, oliver

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
Stack trace	none
Proposed patch	darin: review+

Cameron Zwarich (cpst)

Reported 2008-08-05 17:05:59 PDT

Executing eval("const a;") crashes WebKit, both in the JS shell and in the browser.

Attachments
Stack trace (3.71 KB, text/plain) 2008-08-05 17:14 PDT, Cameron Zwarich (cpst)	no flags	Details
Proposed patch (2.87 KB, patch) 2008-08-05 17:29 PDT, Cameron Zwarich (cpst)	darin: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Cameron Zwarich (cpst)

Comment 1 2008-08-05 17:14:00 PDT

Created attachment 22666 [details] Stack trace The reason for the crash is pretty obvious. The eval path assumes that there is an initializer. I'll change it so it returns undefined otherwise.

Cameron Zwarich (cpst)

Comment 2 2008-08-05 17:29:53 PDT

Created attachment 22668 [details] Proposed patch

Darin Adler

Comment 3 2008-08-05 17:31:22 PDT

Comment on attachment 22668 [details] Proposed patch r=me

Cameron Zwarich (cpst)

Comment 4 2008-08-05 17:42:08 PDT

Landed in r35584.

Note You need to log in before you can comment on or make changes to this bug.