Changeset 201737 in webkit

Timestamp:

Jun 6, 2016 8:02:06 PM (8 years ago)

Author:

msaboff@apple.com

Message:

octal and binary parsing is wrong for some programs
​https://bugs.webkit.org/show_bug.cgi?id=158437

Reviewed by Saam Barati.

When there is an error parsing an binary or octal literal, we need to clear the returnValue
of any residual value. This is because the processing of returnValue happens before the
syntax check for the extra character. Without clearing returnValue, we end trying to
categorize the value as an INTEGER or DOUBLE token. If the value happens to be an
impure NaN, we ASSERT.

• parser/Lexer.cpp:

(JSC::Lexer<T>::parseBinary):
(JSC::Lexer<T>::parseOctal):

• tests/stress/regress-158437.js: New test.

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• parser/Lexer.cpp (modified) (2 diffs)
• tests/stress/regress-158437.js (added)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2016-06-06  Michael Saboff  <msaboff@apple.com>
+
+        octal and binary parsing is wrong for some programs
+        https://bugs.webkit.org/show_bug.cgi?id=158437
+
+        Reviewed by Saam Barati.
+
+        When there is an error parsing an binary or octal literal, we need to clear the returnValue
+        of any residual value.  This is because the processing of returnValue happens before the
+        syntax check for the extra character.  Without clearing returnValue, we end trying to
+        categorize the value as an INTEGER or DOUBLE token.  If the value happens to be an
+        impure NaN, we ASSERT.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer<T>::parseBinary):
+        (JSC::Lexer<T>::parseOctal):
+        * tests/stress/regress-158437.js: New test.
+
 2016-06-06  Mark Lam  <mark.lam@apple.com>
 

trunk/Source/JavaScriptCore/parser/Lexer.cpp

@@ -1569 +1569 @@
     }
 
-    if (isASCIIDigit(m_current))
+    if (isASCIIDigit(m_current)) {
+        returnValue = 0;
         return false;
+    }
 
     returnValue = parseIntOverflow(m_buffer8.data(), m_buffer8.size(), 2);
@@ -1607 +1609 @@
     }
 
-    if (isASCIIDigit(m_current))
+    if (isASCIIDigit(m_current)) {
+        returnValue = 0;
         return false;
+    }
 
     returnValue = parseIntOverflow(m_buffer8.data(), m_buffer8.size(), 8);