Bug 17924: Crash in KJS::ConstDeclNode::evaluate with |with| and |const|
authoroliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 29 Mar 2008 07:25:34 +0000 (07:25 +0000)
committeroliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Sat, 29 Mar 2008 07:25:34 +0000 (07:25 +0000)
commit83dcd3a4ce6152df1f75e46296474ca5fdf8c394
treec0f0b8a4ec085de329be64ae0d7e8adea5cf4ce1
parent1e79fc089b4e2566ade71ec4b3dec21dd2542b65
Bug 17924: Crash in KJS::ConstDeclNode::evaluate with |with| and |const|
<http://bugs.webkit.org/show_bug.cgi?id=17924>
<rdar://problem/5806933>

Reviewed by Geoff.

It turns out this is trivially avoidable if we just match firefox's
semantics and ensure that an assignment in a const declaration always
writes to the variable object.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@31431 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JavaScriptCore/ChangeLog
JavaScriptCore/kjs/nodes.cpp
LayoutTests/ChangeLog
LayoutTests/fast/js/const-expected.txt
LayoutTests/fast/js/resources/const.js