Bug 95913

Summary: Bug, assignment within subscript of prefix/postfix increment of bracket access
Product: WebKit Reporter: Gavin Barraclough <barraclough>
Component: JavaScriptCoreAssignee: Gavin Barraclough <barraclough>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
URL: javascript:alert((function(){ var a = { x:1 }; var b = { x:1 }; a[a=b,"x"]++; return a.x; })())
Attachments:
Description Flags
Fix oliver: review+

Gavin Barraclough
Reported 2012-09-05 17:01:52 PDT
See URL.
Attachments
Fix (5.94 KB, patch)
2012-09-05 17:22 PDT, Gavin Barraclough 		oliver: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Gavin Barraclough
Comment 1 2012-09-05 17:22:10 PDT
Created attachment 162375 [details] Fix
Gavin Barraclough
Comment 2 2012-09-05 17:55:24 PDT
Fixed in r127666
Note You need to log in before you can comment on or make changes to this bug.