Bug 142883 – eval("this.foo") causes a crash if this had not been initialized in a derived class's constructor

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Ryosuke Niwa]

new (class extends class {} {
    constructor() {
        eval("this.foo");
        super();
    }
}

new B;
print("PASS");

results in a crash because we fail to emit a TDZ check.

[Ryosuke Niwa]

Created attachment 249655 [details]
WIP

[Ryosuke Niwa]

Created attachment 249795 [details]
Fixes the crash

[WebKit Commit Bot]

Attachment 249795 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/parser/Parser.cpp:212:  Wrong number of spaces before statement. (expected: 8)  [whitespace/indent] [4]
Total errors found: 1 in 21 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Filip Pizlo]

Comment on attachment 249795 [details]
Fixes the crash

Nice!

[Ryosuke Niwa]

Committed r182198: <http://trac.webkit.org/changeset/182198>

[Alexey Proskuryakov]

Did this patch cause the below failures on Windows? The bot was broken due to r182200 at first, so the range is somewhat long - but I don't see anything else related checked in recently.

https://build.webkit.org/results/Apple%20Win%207%20Debug%20(Tests)/r182213%20(65485)/results.html

[Ryosuke Niwa]

(In reply to comment #6)
> Did this patch cause the below failures on Windows? The bot was broken due
> to r182200 at first, so the range is somewhat long - but I don't see
> anything else related checked in recently.
> 
> https://build.webkit.org/results/Apple%20Win%207%20Debug%20(Tests)/
> r182213%20(65485)/results.html

Seems unlikely as the code only runs when class syntax is used.