Bug 142883 - eval("this.foo") causes a crash if this had not been initialized in a derived class's constructor
Summary: eval("this.foo") causes a crash if this had not been initialized in a derived...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Ryosuke Niwa
URL:
Keywords:
Depends on:
Blocks: 140491
  Show dependency treegraph
 
Reported: 2015-03-19 15:52 PDT by Ryosuke Niwa
Modified: 2015-04-01 03:07 PDT (History)
9 users (show)

See Also:


Attachments
WIP (24.45 KB, patch)
2015-03-28 01:21 PDT, Ryosuke Niwa
no flags Details | Formatted Diff | Diff
Fixes the crash (25.08 KB, patch)
2015-03-30 21:15 PDT, Ryosuke Niwa
fpizlo: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ryosuke Niwa 2015-03-19 15:52:07 PDT
new (class extends class {} {
    constructor() {
        eval("this.foo");
        super();
    }
}

new B;
print("PASS");

results in a crash because we fail to emit a TDZ check.
Comment 1 Ryosuke Niwa 2015-03-28 01:21:52 PDT
Created attachment 249655 [details]
WIP
Comment 2 Ryosuke Niwa 2015-03-30 21:15:46 PDT
Created attachment 249795 [details]
Fixes the crash
Comment 3 WebKit Commit Bot 2015-03-30 21:18:03 PDT
Attachment 249795 [details] did not pass style-queue:


ERROR: Source/JavaScriptCore/parser/Parser.cpp:212:  Wrong number of spaces before statement. (expected: 8)  [whitespace/indent] [4]
Total errors found: 1 in 21 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 4 Filip Pizlo 2015-03-31 12:09:49 PDT
Comment on attachment 249795 [details]
Fixes the crash

Nice!
Comment 5 Ryosuke Niwa 2015-03-31 12:43:41 PDT
Committed r182198: <http://trac.webkit.org/changeset/182198>
Comment 6 Alexey Proskuryakov 2015-03-31 23:57:06 PDT
Did this patch cause the below failures on Windows? The bot was broken due to r182200 at first, so the range is somewhat long - but I don't see anything else related checked in recently.

https://build.webkit.org/results/Apple%20Win%207%20Debug%20(Tests)/r182213%20(65485)/results.html
Comment 7 Ryosuke Niwa 2015-04-01 03:07:44 PDT
(In reply to comment #6)
> Did this patch cause the below failures on Windows? The bot was broken due
> to r182200 at first, so the range is somewhat long - but I don't see
> anything else related checked in recently.
> 
> https://build.webkit.org/results/Apple%20Win%207%20Debug%20(Tests)/
> r182213%20(65485)/results.html

Seems unlikely as the code only runs when class syntax is used.