[jsfunfuzz] Assertion + incorrect behaviour with dynamically created local variable...
authoroliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 1 Jan 2009 08:22:40 +0000 (08:22 +0000)
committeroliver@apple.com <oliver@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 1 Jan 2009 08:22:40 +0000 (08:22 +0000)
commita89d97b74a1922ff8b84007eed1182a6203ca8c2
tree4242c70e1b4e03d6aef86c2189e4ee5c5cd4484d
parentca10094248d6e618eb5e43a00b0163ada09751e5
[jsfunfuzz] Assertion + incorrect behaviour with dynamically created local variable in a catch block
<https://bugs.webkit.org/show_bug.cgi?id=23063>

Reviewed by Cameron Zwarich

Eval inside a catch block attempts to use the catch block's static scope in
an unsafe way by attempting to add new properties to the scope.  This patch
fixes this issue simply by preventing the catch block from using a static
scope if it contains an eval.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@39534 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JavaScriptCore/ChangeLog
JavaScriptCore/parser/Grammar.y
JavaScriptCore/parser/Nodes.cpp
JavaScriptCore/parser/Nodes.h
LayoutTests/ChangeLog
LayoutTests/fast/js/eval-var-decl-expected.txt
LayoutTests/fast/js/resources/eval-var-decl.js