Bug 13456 - REGRESSION: setTimeout "arguments" object gets shadowed by a local variable (Can't get past splash screen for KLM airlines)
Summary: REGRESSION: setTimeout "arguments" object gets shadowed by a local variable (...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 523.x (Safari 3)
Hardware: Mac OS X 10.4
: P1 Major
Assignee: Nobody
URL: http://www.klm.com/travel/klm_splash/...
Keywords: HasReduction, InRadar, Regression
Depends on:
Blocks:
 
Reported: 2007-04-23 11:13 PDT by tim bates
Modified: 2007-05-25 17:14 PDT (History)
1 user (show)

See Also:


Attachments
test case (532 bytes, text/html)
2007-04-25 03:28 PDT, Alexey Proskuryakov
no flags Details
Fix by explicitly checking for arguments in VarDeclNode::evaluate (9.71 KB, patch)
2007-05-25 07:17 PDT, Kimmo Kinnunen
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description tim bates 2007-04-23 11:13:27 PDT
1. go to http://www.klm.com/

2. select country (UK)

--> expect go to localised booking page

OBTAINED: returned to splash page, with "Netherlands" as country and language options selected.
Comment 1 tim bates 2007-04-23 11:17:24 PDT
works fine in Tiger release Safari
Comment 2 Alexey Proskuryakov 2007-04-23 11:27:24 PDT
Confirmed with r21002.
Comment 3 Alexey Proskuryakov 2007-04-25 03:27:48 PDT
var arguments;
for (var c = 0; c < argpairs.length; c++)
{
	var pair = argpairs[c].split("=", 2);
	arguments[pair[0]] = pair[1]; // fails here, because arguments is undefined
}

This works in shipping Safari and in Firefox because the variable doesn't shadow a predefined parameters object.
Comment 4 Alexey Proskuryakov 2007-04-25 03:28:17 PDT
Created attachment 14173 [details]
test case
Comment 5 Darin Adler 2007-04-26 08:31:25 PDT
<rdar://problem/5163497>
Comment 6 Kimmo Kinnunen 2007-05-25 07:17:33 PDT
Created attachment 14721 [details]
Fix by explicitly checking for arguments in VarDeclNode::evaluate

The solution is not so nice because it uses explicit check. the error might show up somewhere else and of course if new similar properties are added to function call scope, same kind of bug will occur. Also the patch has has longer comment part than the actual code part.
At least it gives a hint on why the bug exists..
Comment 7 Darin Adler 2007-05-25 09:39:36 PDT
Comment on attachment 14721 [details]
Fix by explicitly checking for arguments in VarDeclNode::evaluate

r=me
Comment 8 Darin Adler 2007-05-25 17:14:21 PDT
Committed revision 21790.