Bug 49383

Summary: Incorrect handling of global writes in dynamic contexts
Product: WebKit Reporter: Yong Li <yong.li.webkit>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: darin, ggaren, oliver
Priority: P1 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
Patch oliver: review+

Yong Li
Reported 2010-11-11 07:34:34 PST
When assigning value to a variable in "catch" block, browser always throws InvalidGlobalAssignment exception. Note: this doesn't happen when using JIT. It could be an old problem, but become visible since http://trac.webkit.org/changeset/69940. JSObject* createErrorForInvalidGlobalAssignment(ExecState* exec, const UString& propertyName) { return createReferenceError(exec, makeUString("Strict mode forbids implicit creation of global property '", propertyName, "'")); } A simple test case can reproduce it: <html> <script> try { throw "test"; } catch (e1) { try { var s; s = e1.message; document.write("succeeded"); } catch (e2) { alert(e2); } } </script> <body> </body> </html>
Attachments
Patch (11.75 KB, patch)
2011-02-16 10:43 PST, Oliver Hunt 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Geoffrey Garen
Comment 1 2010-11-11 16:34:04 PST
Seems like the problem here is that strict mode is being enforced even in non-strict contexts.
Geoffrey Garen
Comment 2 2010-11-11 16:34:27 PST
<rdar://problem/8660072>
Darin Adler
Comment 3 2010-12-13 14:23:54 PST
How did you find this problem? Did you discover this on an actual website?
Yong Li
Comment 4 2011-02-10 11:38:35 PST
(In reply to comment #3) > How did you find this problem? Did you discover this on an actual website? It is acid3 I remember.
Darin Adler
Comment 5 2011-02-10 11:39:18 PST
Don’t want Acid3 to fail!
Oliver Hunt
Comment 6 2011-02-15 17:57:13 PST
Weeee, so many bugs in one small test case! The original issue (strict mode applied to non-strict code) was fixed a while ago, but this has exposed a bevy of additional bugs which i am determining the root cause of now.
Oliver Hunt
Comment 7 2011-02-16 10:43:51 PST
Created attachment 82661 [details] Patch
Oliver Hunt
Comment 8 2011-02-16 11:26:22 PST
Comment on attachment 82661 [details] Patch r=geoff
Oliver Hunt
Comment 9 2011-02-16 11:36:49 PST
Committed r78727: <http://trac.webkit.org/changeset/78727>
Note You need to log in before you can comment on or make changes to this bug.