Bug 23049 – [jsfunfuzz] With blocks do not correctly protect their scope object

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Oliver Hunt]

JSFunFuzz found this

with(1){gc();a;}

Which crashes as the scope object (1->toObject()) is not protected by the registerfile as is expected.  Looking into this i also found that we would not correctly protect the scope when local variables are usedfor scope, as in:
var z; with(z={}){z=null; {}; {}; [1,2,3,4*{}]; gc(); b}

[Oliver Hunt]

<rdar://problem/6469742> Crash in JSC::TypeInfo::hasStandardGetOwnPropertySlot() running jsfunfuzz

[Oliver Hunt]

Created attachment 26330 [details]
Correctly guard the scope object

Yay, fixeration \o/

[Darin Adler]

Comment on attachment 26330 [details]
Correctly guard the scope object

Seems like a good solution.

r=me

> +        * fast/js/resources/with-scope-gc.js: Added.
> +        (gc):
> +        ():

You should remove the function names here. In particular, the "()" doesn't add much.

[Oliver Hunt]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	JavaScriptCore/ChangeLog
	M	JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
	M	JavaScriptCore/interpreter/Interpreter.cpp
	M	JavaScriptCore/interpreter/Interpreter.h
	M	JavaScriptCore/jit/JIT.cpp
	M	JavaScriptCore/parser/Nodes.cpp
	M	LayoutTests/ChangeLog
	A	LayoutTests/fast/js/resources/with-scope-gc.js
	A	LayoutTests/fast/js/with-scope-gc-expected.txt
	A	LayoutTests/fast/js/with-scope-gc.html
Committed r39524