Title: [141168] trunk
- Revision
- 141168
- Author
- [email protected]
- Date
- 2013-01-29 14:52:58 -0800 (Tue, 29 Jan 2013)
Log Message
REGRESSION (r140594): RELEASE_ASSERT_NOT_REACHED in JSC::Interpreter::execute
https://bugs.webkit.org/show_bug.cgi?id=108097
Reviewed by Geoffrey Garen.
Source/_javascript_Core:
LiteralParser was accepting a bogus 'var a.b = c' statement
* runtime/LiteralParser.cpp:
(JSC::::tryJSONPParse):
LayoutTests:
Add parser test for invalid var a.b syntax
* fast/js/parser-syntax-check-expected.txt:
* fast/js/script-tests/parser-syntax-check.js:
Modified Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (141167 => 141168)
--- trunk/LayoutTests/ChangeLog 2013-01-29 22:52:19 UTC (rev 141167)
+++ trunk/LayoutTests/ChangeLog 2013-01-29 22:52:58 UTC (rev 141168)
@@ -1,3 +1,15 @@
+2013-01-29 Oliver Hunt <[email protected]>
+
+ REGRESSION (r140594): RELEASE_ASSERT_NOT_REACHED in JSC::Interpreter::execute
+ https://bugs.webkit.org/show_bug.cgi?id=108097
+
+ Reviewed by Geoffrey Garen.
+
+ Add parser test for invalid var a.b syntax
+
+ * fast/js/parser-syntax-check-expected.txt:
+ * fast/js/script-tests/parser-syntax-check.js:
+
2013-01-29 Roger Fong <[email protected]>
Unreviewed. Temporarily disable inspector tests.
Modified: trunk/LayoutTests/fast/js/parser-syntax-check-expected.txt (141167 => 141168)
--- trunk/LayoutTests/fast/js/parser-syntax-check-expected.txt 2013-01-29 22:52:19 UTC (rev 141167)
+++ trunk/LayoutTests/fast/js/parser-syntax-check-expected.txt 2013-01-29 22:52:58 UTC (rev 141168)
@@ -575,6 +575,10 @@
PASS Valid: "function f() { ([1 || 1].a = 1) }"
PASS Valid: "({a: 1 || 1}.a = 1)"
PASS Valid: "function f() { ({a: 1 || 1}.a = 1) }"
+PASS Invalid: "var a.b = c"
+PASS Invalid: "function f() { var a.b = c }"
+PASS Invalid: "var a.b;"
+PASS Invalid: "function f() { var a.b; }"
PASS e.line is 1
PASS foo is 'PASS'
PASS bar is 'PASS'
Modified: trunk/LayoutTests/fast/js/script-tests/parser-syntax-check.js (141167 => 141168)
--- trunk/LayoutTests/fast/js/script-tests/parser-syntax-check.js 2013-01-29 22:52:19 UTC (rev 141167)
+++ trunk/LayoutTests/fast/js/script-tests/parser-syntax-check.js 2013-01-29 22:52:58 UTC (rev 141168)
@@ -366,6 +366,9 @@
valid("([1 || 1].a = 1)");
valid("({a: 1 || 1}.a = 1)");
+invalid("var a.b = c");
+invalid("var a.b;");
+
try { eval("a.b.c = {};"); } catch(e1) { e=e1; shouldBe("e.line", "1") }
foo = 'FAIL';
bar = 'PASS';
Modified: trunk/Source/_javascript_Core/ChangeLog (141167 => 141168)
--- trunk/Source/_javascript_Core/ChangeLog 2013-01-29 22:52:19 UTC (rev 141167)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-01-29 22:52:58 UTC (rev 141168)
@@ -1,5 +1,17 @@
2013-01-29 Oliver Hunt <[email protected]>
+ REGRESSION (r140594): RELEASE_ASSERT_NOT_REACHED in JSC::Interpreter::execute
+ https://bugs.webkit.org/show_bug.cgi?id=108097
+
+ Reviewed by Geoffrey Garen.
+
+ LiteralParser was accepting a bogus 'var a.b = c' statement
+
+ * runtime/LiteralParser.cpp:
+ (JSC::::tryJSONPParse):
+
+2013-01-29 Oliver Hunt <[email protected]>
+
Force debug builds to do bounds checks on contiguous property storage
https://bugs.webkit.org/show_bug.cgi?id=108212
Modified: trunk/Source/_javascript_Core/runtime/LiteralParser.cpp (141167 => 141168)
--- trunk/Source/_javascript_Core/runtime/LiteralParser.cpp 2013-01-29 22:52:19 UTC (rev 141167)
+++ trunk/Source/_javascript_Core/runtime/LiteralParser.cpp 2013-01-29 22:52:58 UTC (rev 141168)
@@ -73,6 +73,8 @@
if (m_exec->globalData().keywords->isKeyword(entry.m_pathEntryName))
return false;
TokenType tokenType = m_lexer.next();
+ if (entry.m_type == JSONPPathEntryTypeDeclare && tokenType != TokAssign)
+ return false;
while (tokenType != TokAssign) {
switch (tokenType) {
case TokLBracket: {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
