[Webkit-unassigned] [Bug 13517] DOM Exception 8 in finance.aol.com sub-page

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=13517


cwzwarich at uwaterloo.ca changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #15495|                            |review?
               Flag|                            |




------- Comment #5 from cwzwarich at uwaterloo.ca  2007-07-12 19:07 PDT -------
Created an attachment (id=15495)
 --> (http://bugs.webkit.org/attachment.cgi?id=15495&action=view)
Proposed patch

Here is a patch that fixes the bug.

The problem was in VarDeclNode::evaluate. If a binding already exists in the
shallowest scope, then a var declaration should do nothing, except possibly
assign to it if there is an initializer. The check was there, but only for var
declarations without initializers. Hence, when there was already a binding in
the shallowest scope from the combination of try / throw, it incorrectly did
not assign to it, and instead caused some strange behaviour.

This patch also fixes bug 14237 and the test js1_5/Scope/regress-185485.js,
which does not include any examples with 'try' and 'catch', only examples using
'with'. Perhaps we should also include Alexey's example as an additional
regression test.

In the patched expected.html there is a recorded failure of the test
ecma/Date/15.9.5.12-6.js, but this has been failing for a while. Should have I
edited this out of the diff somehow, or simply not included the changed file?


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.