Crash on http://www.rickshawbags.com/
authorbarraclough@apple.com <barraclough@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 7 Feb 2012 23:43:28 +0000 (23:43 +0000)
committerbarraclough@apple.com <barraclough@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 7 Feb 2012 23:43:28 +0000 (23:43 +0000)
commitcce352d7a24e3afb2b8cd46aed81c5751882d9ff
tree6bf01d703524538affc4abf263be6b539dbb674e
parenta1ad8b75d9d91e0f23d4cc52f40be1c4ba0159e1
Crash on http://www.rickshawbags.com/
https://bugs.webkit.org/show_bug.cgi?id=78045

Reviewed by Darin Adler.

Problem URL is: http://www.rickshawbags.com/customize/custom-bag#!thl=rickshaw/bag()

This is a bug introduced by https://bugs.webkit.org/show_bug.cgi?id=71933,
isVariableObject() checks were excluding StaticScopeObjects, this patch
inadvertently changed them to be included.

* runtime/JSType.h:
    - sort JSType enum such that StaticScopeObjectType comes before VariableObjectType,
      and thus is excluded from isVariableObject() checks.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@106999 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/runtime/JSType.h