Bug 1258379 - prevent null pointer derefence on |last|. r?jorendorff draft
authorAndi-Bogdan Postelnicu <bogdan.postelnicu@softvision.ro>
Mon, 21 Mar 2016 16:31:43 +0200
changeset 342864 62a2fb5f438b2ce8c2c4d8ed5c747d10d7a38717
parent 342671 f14898695ee0dd14615914f3e1401f17df57fdd7
child 516641 a4f708f1c9f13212270e5dc7c07dda3d11090b30
push id13477
push userBogdan.Postelnicu@softvision.ro
push dateMon, 21 Mar 2016 14:33:53 +0000
reviewersjorendorff
bugs1258379
milestone48.0a1
Bug 1258379 - prevent null pointer derefence on |last|. r?jorendorff MozReview-Commit-ID: HkW8HzKqjxG
js/src/frontend/Parser.cpp
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -4118,27 +4118,29 @@ Parser<ParseHandler>::bindVar(BindData<P
         // (Ideally, the 'e' in 'e = 42' can be linked up as a use to the
         // def of the catch parameter. However, in practice this is messy
         // because we then need to emit the synthesized var name node to
         // ensure that functionless scopes get the proper DEFVAR emits.)
         parser->handler.setFlag(pn, PND_DEOPTIMIZED);
 
         // Synthesize a new 'var' binding if one does not exist.
         DefinitionNode last = pc->decls().lookupLast(name);
-        Definition::Kind lastKind = parser->handler.getDefinitionKind(last);
-        if (last && lastKind != Definition::VAR && lastKind != Definition::ARG) {
-            parser->handler.setFlag(parser->handler.getDefinitionNode(last), PND_CLOSED);
-
-            Node synthesizedVarName = parser->newName(name);
-            if (!synthesizedVarName)
-                return false;
-            if (!pc->define(parser->tokenStream, name, synthesizedVarName, Definition::VAR,
-                            /* declaringVarInCatchBody = */ true))
-            {
-                return false;
+        if (last) {
+            Definition::Kind lastKind = parser->handler.getDefinitionKind(last);
+            if (lastKind != Definition::VAR && lastKind != Definition::ARG) {
+                parser->handler.setFlag(parser->handler.getDefinitionNode(last), PND_CLOSED);
+
+                Node synthesizedVarName = parser->newName(name);
+                if (!synthesizedVarName)
+                  return false;
+                if (!pc->define(parser->tokenStream, name, synthesizedVarName, Definition::VAR,
+                  /* declaringVarInCatchBody = */ true))
+                {
+                  return false;
+                }
             }
         }
     }
 
     /*
      * There was a previous declaration with the same name. The standard
      * disallows several forms of redeclaration. Critically,
      *   let (x) { var x; } // error