Commit de018444 authored by oliver@apple.com's avatar oliver@apple.com
Browse files

2011-01-19 Oliver Hunt <oliver@apple.com>

        Reviewed by Gavin Barraclough.

        [jsfunfuzz] Defining a function called __proto__ inside an eval triggers an assertion
        https://bugs.webkit.org/show_bug.cgi?id=52672

        Add tests to ensure that we disallow __proto__ as a function name.

        * fast/js/parser-syntax-check-expected.txt:
        * fast/js/script-tests/parser-syntax-check.js:
2011-01-19  Oliver Hunt  <oliver@apple.com>

        Reviewed by Gavin Barraclough.

        [jsfunfuzz] Defining a function called __proto__ inside an eval triggers an assertion
        https://bugs.webkit.org/show_bug.cgi?id=52672

        Rather than coming up with a somewhat convoluted mechanism to ensure that
        developers can override the global objects prototype with a function named
        __proto__ and expect it to work, we just disallow it at the syntax level.

        * parser/JSParser.cpp:
        (JSC::JSParser::parseFunctionInfo):

git-svn-id: http://svn.webkit.org/repository/w...
parent 42995a13
2011-01-19 Oliver Hunt <oliver@apple.com>
Reviewed by Gavin Barraclough.
[jsfunfuzz] Defining a function called __proto__ inside an eval triggers an assertion
https://bugs.webkit.org/show_bug.cgi?id=52672
Add tests to ensure that we disallow __proto__ as a function name.
* fast/js/parser-syntax-check-expected.txt:
* fast/js/script-tests/parser-syntax-check.js:
2011-01-19 Chang Shu <chang.shu@nokia.com>
 
Reviewed by Darin Adler.
......
......@@ -541,6 +541,14 @@ PASS Invalid: "for(var a,b 'this shouldn't be allowed' false ; ) ;"
PASS Invalid: "function f() { for(var a,b 'this shouldn't be allowed' false ; ) ; }"
PASS Invalid: "for(var a,b '"
PASS Invalid: "function f() { for(var a,b ' }"
PASS Invalid: "function __proto__(){}"
PASS Invalid: "function f() { function __proto__(){} }"
PASS Invalid: "(function __proto__(){})"
PASS Invalid: "function f() { (function __proto__(){}) }"
PASS Invalid: "'use strict'; function __proto__(){}"
PASS Invalid: "function f() { 'use strict'; function __proto__(){} }"
PASS Invalid: "'use strict'; (function __proto__(){})"
PASS Invalid: "function f() { 'use strict'; (function __proto__(){}) }"
PASS successfullyParsed is true
TEST COMPLETE
......
......@@ -346,4 +346,9 @@ invalid("L: L1: L2: L3: L4: L: ;");
invalid("for(var a,b 'this shouldn\'t be allowed' false ; ) ;");
invalid("for(var a,b '");
invalid("function __proto__(){}")
invalid("(function __proto__(){})")
invalid("'use strict'; function __proto__(){}")
invalid("'use strict'; (function __proto__(){})")
var successfullyParsed = true;
2011-01-19 Oliver Hunt <oliver@apple.com>
Reviewed by Gavin Barraclough.
[jsfunfuzz] Defining a function called __proto__ inside an eval triggers an assertion
https://bugs.webkit.org/show_bug.cgi?id=52672
Rather than coming up with a somewhat convoluted mechanism to ensure that
developers can override the global objects prototype with a function named
__proto__ and expect it to work, we just disallow it at the syntax level.
* parser/JSParser.cpp:
(JSC::JSParser::parseFunctionInfo):
2011-01-19 Michael Saboff <msaboff@apple.com>
 
Reviewed by Darin Adler.
......
......@@ -1223,6 +1223,7 @@ template <JSParser::FunctionRequirements requirements, bool nameIsInContainingSc
functionScope->setIsFunction();
if (match(IDENT)) {
name = m_token.m_data.ident;
failIfTrue(*name == m_globalData->propertyNames->underscoreProto);
next();
if (!nameIsInContainingScope)
failIfFalseIfStrict(functionScope->declareVariable(name));
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment