Bug 49383 - Incorrect handling of global writes in dynamic contexts
Summary: Incorrect handling of global writes in dynamic contexts
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P1 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2010-11-11 07:34 PST by Yong Li
Modified: 2011-02-16 11:36 PST (History)
3 users (show)

See Also:


Attachments
Patch (11.75 KB, patch)
2011-02-16 10:43 PST, Oliver Hunt
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Yong Li 2010-11-11 07:34:34 PST
When assigning value to a variable in "catch" block, browser always throws InvalidGlobalAssignment exception. Note: this doesn't happen when using JIT.

It could be an old problem, but become visible since http://trac.webkit.org/changeset/69940.

JSObject* createErrorForInvalidGlobalAssignment(ExecState* exec, const UString& propertyName)
{
   return createReferenceError(exec, makeUString("Strict mode forbids implicit creation of global property '", propertyName, "'"));
} 

A simple test case can reproduce it:

<html>
<script>
try {
   throw "test";
} catch (e1) {
    try {
       var s;
       s = e1.message;
       document.write("succeeded");
    } catch (e2) {
        alert(e2);
    }
}
</script>
<body>
</body>
</html>
Comment 1 Geoffrey Garen 2010-11-11 16:34:04 PST
Seems like the problem here is that strict mode is being enforced even in non-strict contexts.
Comment 2 Geoffrey Garen 2010-11-11 16:34:27 PST
<rdar://problem/8660072>
Comment 3 Darin Adler 2010-12-13 14:23:54 PST
How did you find this problem? Did you discover this on an actual website?
Comment 4 Yong Li 2011-02-10 11:38:35 PST
(In reply to comment #3)
> How did you find this problem? Did you discover this on an actual website?

It is acid3 I remember.
Comment 5 Darin Adler 2011-02-10 11:39:18 PST
Don’t want Acid3 to fail!
Comment 6 Oliver Hunt 2011-02-15 17:57:13 PST
Weeee, so many bugs in one small test case!

The original issue (strict mode applied to non-strict code) was fixed a while ago, but this has exposed a bevy of additional bugs which i am determining the root cause of now.
Comment 7 Oliver Hunt 2011-02-16 10:43:51 PST
Created attachment 82661 [details]
Patch
Comment 8 Oliver Hunt 2011-02-16 11:26:22 PST
Comment on attachment 82661 [details]
Patch

r=geoff
Comment 9 Oliver Hunt 2011-02-16 11:36:49 PST
Committed r78727: <http://trac.webkit.org/changeset/78727>