Changeset 239961 in webkit

Timestamp:

Jan 14, 2019 4:39:28 PM (5 years ago)

Author:

Caio Lima

Message:

[BigInt] Literal parsing is crashing when used inside a Object Literal
​https://bugs.webkit.org/show_bug.cgi?id=193404

Reviewed by Yusuke Suzuki.

JSTests:

• stress/big-int-literal-inside-literal-object.js: Added.

Source/JavaScriptCore:

Former implementation was relying into token.m_data.radix after the
call of next() into Parser.cpp. This is not safe because next
clobbers token.m_data.radix in some cases (e.g is CLOSEBRACE).
Now we get radix value before calling next() into parser and store
in a local variable.

• parser/Parser.cpp:

(JSC::Parser<LexerType>::parsePrimaryExpression):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/big-int-literal-inside-literal-object.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/parser/Parser.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog

@@ +1 @@
+2019-01-14  Caio Lima  <ticaiolima@gmail.com>
+
+        [BigInt] Literal parsing is crashing when used inside a Object Literal
+        https://bugs.webkit.org/show_bug.cgi?id=193404
+
+        Reviewed by Yusuke Suzuki.
+
+        * stress/big-int-literal-inside-literal-object.js: Added.
+
 2019-01-14  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-01-14  Caio Lima  <ticaiolima@gmail.com>
+
+        [BigInt] Literal parsing is crashing when used inside a Object Literal
+        https://bugs.webkit.org/show_bug.cgi?id=193404
+
+        Reviewed by Yusuke Suzuki.
+
+        Former implementation was relying into token.m_data.radix after the
+        call of `next()` into Parser.cpp. This is not safe because next
+        clobbers token.m_data.radix in some cases (e.g is CLOSEBRACE).
+        Now we get radix value before calling `next()` into parser and store
+        in a local variable.
+
+        * parser/Parser.cpp:
+        (JSC::Parser<LexerType>::parsePrimaryExpression):
+
 2019-01-14  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 

trunk/Source/JavaScriptCore/parser/Parser.cpp

@@ -4520 +4520 @@
     case BIGINT: {
         const Identifier* ident = m_token.m_data.bigIntString;
+        uint8_t radix = m_token.m_data.radix;
         JSTokenLocation location(tokenLocation());
         next();
-        return context.createBigInt(location, ident, m_token.m_data.radix);
+        return context.createBigInt(location, ident, radix);
     }
     case STRING: {