Bug 852016 - Watch for uses of 'arguments' in eval() inside generator expressions, r=luke.
authorBrian Hackett <bhackett1024@gmail.com>
Tue, 19 Mar 2013 12:23:24 -0600
changeset 125476 26b4880c8a64c5cf49ea1d1ae06242168d86a6ba
parent 125475 704c1658d47eb6fb04696bd5112dad6a045537e9
child 125477 2b2de9cc2f59ebd402b2eda8168e92c4c19e4f1c
push id24459
push useremorley@mozilla.com
push dateWed, 20 Mar 2013 11:46:36 +0000
treeherdermozilla-central@1d6fe70c79c5 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersluke
bugs852016
milestone22.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 852016 - Watch for uses of 'arguments' in eval() inside generator expressions, r=luke.
js/src/frontend/BytecodeCompiler.cpp
js/src/jit-test/tests/basic/bug852016-2.js
js/src/jit-test/tests/basic/bug852016.js
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@@ -61,16 +61,22 @@ CheckArgumentsWithinEval(JSContext *cx, 
     // Force construction of arguments objects for functions that use
     // |arguments| within an eval.
     RootedScript script(cx, fun->nonLazyScript());
     if (script->argumentsHasVarBinding()) {
         if (!JSScript::argumentsOptimizationFailed(cx, script))
             return false;
     }
 
+    // It's an error to use |arguments| in a generator expression.
+    if (script->isGeneratorExp) {
+        parser.report(ParseError, false, NULL, JSMSG_BAD_GENEXP_BODY, js_arguments_str);
+        return false;
+    }
+
     return true;
 }
 
 RawScript
 frontend::CompileScript(JSContext *cx, HandleObject scopeChain,
                         HandleScript evalCaller,
                         const CompileOptions &options,
                         const jschar *chars, size_t length,
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug852016-2.js
@@ -0,0 +1,8 @@
+
+function foo(str) {
+  var x = eval(str); yield x[0];
+}
+for (var i = 0; i < 5; i++)
+  assertEq(foo("[4,5,6]").next(), 4);
+for (var i = 0; i < 5; i++)
+  assertEq(foo("arguments").next(), "arguments");
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug852016.js
@@ -0,0 +1,9 @@
+//|jit-test| error: SyntaxError
+
+(function() {
+    x = "arguments";
+    f = eval("(function(){return(c for (x in eval('print(arguments[0])')))})");
+    for (e in f()) {
+        (function() {});
+    }
+})(3)