Changeset 280886 in webkit

Timestamp:

Aug 11, 2021, 12:39:26 AM (5 years ago)

Author:

ysuzuki@apple.com

Message:

WTFCrash in JSC::Lexer<char16_t>::append8
​https://bugs.webkit.org/show_bug.cgi?id=228982

Reviewed by Mark Lam.

JSTests:

• stress/directive-includes-non-latin1.js: Added.

Source/JavaScriptCore:

sourceURL / sourceMapURL directive should not assume Latin1 characters.

• parser/Lexer.cpp:

(JSC::Lexer<T>::parseCommentDirectiveValue):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/directive-includes-non-latin1.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/parser/Lexer.cpp (modified) (2 diffs)

trunk/JSTests/ChangeLog

@@ +1 @@
+2021-08-11  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        WTFCrash in JSC::Lexer<char16_t>::append8
+        https://bugs.webkit.org/show_bug.cgi?id=228982
+
+        Reviewed by Mark Lam.
+
+        * stress/directive-includes-non-latin1.js: Added.
+
 2021-08-09  Yusuke Suzuki  <ysuzuki@apple.com>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-08-11  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        WTFCrash in JSC::Lexer<char16_t>::append8
+        https://bugs.webkit.org/show_bug.cgi?id=228982
+
+        Reviewed by Mark Lam.
+
+        sourceURL / sourceMapURL directive should not assume Latin1 characters.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::parseCommentDirectiveValue):
+
 2021-08-10  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/parser/Lexer.cpp

@@ -1843 +1843 @@
 {
     skipWhitespace();
+    bool hasNonLatin1 = false;
     const T* stringStart = currentSourcePtr();
-    while (!isWhiteSpace(m_current) && !isLineTerminator(m_current) && m_current != '"' && m_current != '\'' && !atEnd())
-        shift();
+    while (!isWhiteSpace(m_current) && !isLineTerminator(m_current) && m_current != '"' && m_current != '\'' && !atEnd()) {
+        if (!isLatin1(m_current))
+            hasNonLatin1 = true;
+        shift();
+    }
     const T* stringEnd = currentSourcePtr();
     skipWhitespace();
@@ -1852 +1856 @@
         return String();
 
-    append8(stringStart, stringEnd - stringStart);
-    String result = String(m_buffer8.data(), m_buffer8.size());
-    m_buffer8.shrink(0);
+    unsigned length = stringEnd - stringStart;
+    if (hasNonLatin1) {
+        UChar* buffer = nullptr;
+        String result = StringImpl::createUninitialized(length, buffer);
+        StringImpl::copyCharacters(buffer, stringStart, length);
+        return result;
+    }
+
+    LChar* buffer = nullptr;
+    String result = StringImpl::createUninitialized(length, buffer);
+    StringImpl::copyCharacters(buffer, stringStart, length);
     return result;
 }