2008-03-19 Mark Rowe <mrowe@apple.com>

        Reviewed by Oliver Hunt.

        Fix http://bugs.webkit.org/show_bug.cgi?id=17939
        Bug 17939: Crash decompiling "const a = 1, b;"

        * kjs/nodes2string.cpp:
        (KJS::ConstDeclNode::streamTo): Null-check the correct variable.

2008-03-19  Mark Rowe  <mrowe@apple.com>

        Reviewed by Oliver Hunt.

        Test for http://bugs.webkit.org/show_bug.cgi?id=17939
        Bug 17939: Crash decompiling "const a = 1, b;"

        * fast/js/function-toString-parentheses-expected.txt:
        * fast/js/resources/function-toString-parentheses.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@31149 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 066577e..f5f0e2b 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,13 @@
+2008-03-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix http://bugs.webkit.org/show_bug.cgi?id=17939
+        Bug 17939: Crash decompiling "const a = 1, b;"
+
+        * kjs/nodes2string.cpp:
+        (KJS::ConstDeclNode::streamTo): Null-check the correct variable.
+
 2008-03-18  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Mark Rowe.

diff --git a/JavaScriptCore/kjs/nodes2string.cpp b/JavaScriptCore/kjs/nodes2string.cpp
index ffe4033..906822e 100644 (file)
--- a/JavaScriptCore/kjs/nodes2string.cpp
+++ b/JavaScriptCore/kjs/nodes2string.cpp
@@ -770,7 +770,7 @@ void ConstDeclNode::streamTo(SourceStream& s) const
         s << " = " << PrecAssignment << m_init;
     for (ConstDeclNode* n = m_next.get(); n; n = n->m_next.get()) {
         s << ", " << n->m_ident;
-        if (m_init)
+        if (n->m_init)
             s << " = " << PrecAssignment << n->m_init;
     }
 }

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index eb40c1e..c760356 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2008-03-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Test for http://bugs.webkit.org/show_bug.cgi?id=17939
+        Bug 17939: Crash decompiling "const a = 1, b;"
+
+        * fast/js/function-toString-parentheses-expected.txt:
+        * fast/js/resources/function-toString-parentheses.js:
+
 2008-03-18  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Mark Rowe.

diff --git a/LayoutTests/fast/js/function-toString-parentheses-expected.txt b/LayoutTests/fast/js/function-toString-parentheses-expected.txt
index fe68cce..b6a64c1 100644 (file)
--- a/LayoutTests/fast/js/function-toString-parentheses-expected.txt
+++ b/LayoutTests/fast/js/function-toString-parentheses-expected.txt
@@ -489,6 +489,8 @@ PASS compileAndSerializeLeftmostTest('var a, b, c') is 'var a, b, c'
 PASS compileAndSerializeLeftmostTest('var a = 1, b = 2, c = 3') is 'var a = 1, b = 2, c = 3'
 PASS compileAndSerializeLeftmostTest('const a = 1') is 'const a = 1'
 PASS compileAndSerializeLeftmostTest('const a = (1, 2)') is 'const a = (1, 2)'
+PASS compileAndSerializeLeftmostTest('const a, b = 1') is 'const a, b = 1'
+PASS compileAndSerializeLeftmostTest('const a = 1, b') is 'const a = 1, b'
 PASS compileAndSerializeLeftmostTest('const a = 1, b = 1') is 'const a = 1, b = 1'
 PASS compileAndSerializeLeftmostTest('const a = (1, 2), b = 1') is 'const a = (1, 2), b = 1'
 PASS compileAndSerializeLeftmostTest('const a = 1, b = (1, 2)') is 'const a = 1, b = (1, 2)'

diff --git a/LayoutTests/fast/js/resources/function-toString-parentheses.js b/LayoutTests/fast/js/resources/function-toString-parentheses.js
index 353d624..d2de260 100644 (file)
--- a/LayoutTests/fast/js/resources/function-toString-parentheses.js
+++ b/LayoutTests/fast/js/resources/function-toString-parentheses.js
@@ -207,6 +207,8 @@ shouldBe("compileAndSerializeLeftmostTest('var a = 1, b = 2, c = 3')", "'var a =
 
 shouldBe("compileAndSerializeLeftmostTest('const a = 1')", "'const a = 1'");
 shouldBe("compileAndSerializeLeftmostTest('const a = (1, 2)')", "'const a = (1, 2)'");
+shouldBe("compileAndSerializeLeftmostTest('const a, b = 1')", "'const a, b = 1'");
+shouldBe("compileAndSerializeLeftmostTest('const a = 1, b')", "'const a = 1, b'");
 shouldBe("compileAndSerializeLeftmostTest('const a = 1, b = 1')", "'const a = 1, b = 1'");
 shouldBe("compileAndSerializeLeftmostTest('const a = (1, 2), b = 1')", "'const a = (1, 2), b = 1'");
 shouldBe("compileAndSerializeLeftmostTest('const a = 1, b = (1, 2)')", "'const a = 1, b = (1, 2)'");