Fix for Bug 16889: REGRESSION (r29425): Canvas-based graphing calculator fails to run
authoroliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 5 Feb 2008 07:58:06 +0000 (07:58 +0000)
committeroliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 5 Feb 2008 07:58:06 +0000 (07:58 +0000)
commit2e9a00d124c7120430c43270fc406a1cba10cc00
tree531cb2be421b5c22ab86a2f0563b52abe7910fba
parent940a93f3ae864d55315d5907a42c8b9dcfb592ee
Fix for Bug 16889: REGRESSION (r29425): Canvas-based graphing calculator fails to run
      Bug 17015: REGRESSION (r29414-29428): www.fox.com "shows" menu fails to render
      Bug 17164: REGRESSION: JavaScript pop-up menu appears at wrong location when hovering image at http://news.chinatimes.com/

Reviewed by Oliver Hunt

<http://bugs.webkit.org/show_bug.cgi?id=16889>
<rdar://problem/5696255>

<http://bugs.webkit.org/show_bug.cgi?id=17015>

<http://bugs.webkit.org/show_bug.cgi?id=17164>
<rdar://problem/5720947>

The ActivationImp tear-off (r29425) introduced a problem with ReadModify
nodes that first resolve a slot, call valueForReadModifyNode(), and then
store a value in the previously resolved slot. Since valueForReadModifyNode()
may cause a tear-off, the slot needs to be resolved again, but this was
not happening with the existing code.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@29997 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JavaScriptCore/ChangeLog
JavaScriptCore/kjs/nodes.cpp
LayoutTests/ChangeLog
LayoutTests/fast/js/read-modify-eval-expected.txt [new file with mode: 0644]
LayoutTests/fast/js/read-modify-eval.html [new file with mode: 0644]
LayoutTests/fast/js/resources/read-modify-eval.js [new file with mode: 0644]