JSFunFuzz found this with(1){gc();a;} Which crashes as the scope object (1->toObject()) is not protected by the registerfile as is expected. Looking into this i also found that we would not correctly protect the scope when local variables are usedfor scope, as in: var z; with(z={}){z=null; {}; {}; [1,2,3,4*{}]; gc(); b}
<rdar://problem/6469742> Crash in JSC::TypeInfo::hasStandardGetOwnPropertySlot() running jsfunfuzz
Created attachment 26330 [details] Correctly guard the scope object Yay, fixeration \o/
Comment on attachment 26330 [details] Correctly guard the scope object Seems like a good solution. r=me > + * fast/js/resources/with-scope-gc.js: Added. > + (gc): > + (): You should remove the function names here. In particular, the "()" doesn't add much.
Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/bytecompiler/BytecodeGenerator.cpp M JavaScriptCore/interpreter/Interpreter.cpp M JavaScriptCore/interpreter/Interpreter.h M JavaScriptCore/jit/JIT.cpp M JavaScriptCore/parser/Nodes.cpp M LayoutTests/ChangeLog A LayoutTests/fast/js/resources/with-scope-gc.js A LayoutTests/fast/js/with-scope-gc-expected.txt A LayoutTests/fast/js/with-scope-gc.html Committed r39524