Bug 245066
| Summary: | Crash in /WebKit/Source/JavaScriptCore/parser/Parser.cpp(3012) | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | xiangwei1895 |
| Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | bfulgham, webkit-bug-importer, zhunkibatu |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Local Build | ||
| Hardware: | PC | ||
| OS: | Linux | ||
xiangwei1895
JSC crashes when executing the following codeļ¼
function main(){
class a{
g = []
'a'(){}
}
}
ASSERTION FAILED: ident
/data/WebKit/Source/JavaScriptCore/parser/Parser.cpp(3012) : typename TreeBuilder::ClassExpression JSC::Parser<JSC::Lexer<LChar> >::parseClass(TreeBuilder &, JSC::FunctionNameRequirements, ParserClassInfo<TreeBuilder> &) [LexerType = JSC::Lexer<LChar>, TreeBuilder = JSC::SyntaxChecker]
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/99815328>
Yusuke Suzuki
Pull request: https://github.com/WebKit/WebKit/pull/5065
Yusuke Suzuki
Making it non security since it is always a nullptr crash.
EWS
Committed 255212@main (89c0d4c38e9a): <https://commits.webkit.org/255212@main>
Reviewed commits have been landed. Closing PR #5065 and removing active labels.
Yusuke Suzuki
*** Bug 245657 has been marked as a duplicate of this bug. ***