[webkit-reviews] review denied: [Bug 86991] REGRESSION r110315: Event handler throws TypeError for an input element with name="arguments" : [Attachment 142950] Patch

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Mon May 21 09:27:42 PDT 2012


Erik Arvidsson <arv at chromium.org> has denied  review:
Bug 86991: REGRESSION r110315: Event handler throws TypeError for an input
element with name="arguments"
https://bugs.webkit.org/show_bug.cgi?id=86991

Attachment 142950: Patch
https://bugs.webkit.org/attachment.cgi?id=142950&action=review

------- Additional Comments from Erik Arvidsson <arv at chromium.org>
View in context: https://bugs.webkit.org/attachment.cgi?id=142950&action=review


This is wrong. See previous bugs that this fixed.

>> Source/WebCore/bindings/v8/V8LazyEventListener.cpp:143
>> +	    "with (this.ownerDocument ? this.ownerDocument : {}) {" \
>> +	    "with (this.form ? this.form : {}) {" \
>> +	    "with (this) {";
> 
> This code is so ridiculous.

This is wrong. We must not use the JS properties here since they might be
overridden.


More information about the webkit-reviews mailing list