Changeset 39942 in webkit

Timestamp:

Jan 15, 2009 1:15:24 PM (15 years ago)

Author:

oliver@apple.com

Message:

Bug 23225: REGRESSION: Assertion failure in reparseInPlace() (m_sourceElements) at sfgate.com
<​https://bugs.webkit.org/show_bug.cgi?id=23225> <rdar://problem/6487432>

Reviewed by Geoff Garen

Character position for open and closing brace was incorrectly referencing m_position to
record their position in a source document, however this is unsafe as BOMs may lead to
m_position being an arbitrary position from the real position of the current character.

Location:

trunk

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/parser/Lexer.cpp (modified) (1 diff)
• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/bom-in-file-retains-correct-offset-expected.txt (added)
• LayoutTests/fast/js/bom-in-file-retains-correct-offset.html (added)
• LayoutTests/fast/js/resources/bom-in-file-retains-correct-offset.js (added)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23225: REGRESSION: Assertion failure in reparseInPlace() (m_sourceElements) at sfgate.com
+        <https://bugs.webkit.org/show_bug.cgi?id=23225> <rdar://problem/6487432>
+
+        Character position for open and closing brace was incorrectly referencing m_position to
+        record their position in a source document, however this is unsafe as BOMs may lead to
+        m_position being an arbitrary position from the real position of the current character.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::matchPunctuator):
+
 2009-01-14  David Kilzer  <ddkilzer@apple.com>
 

trunk/JavaScriptCore/parser/Lexer.cpp

@@ -759 +759 @@
             return static_cast<int>(c1);
         case '{':
-            charPos = m_position - 4;
+            charPos = m_currentOffset;
             shift(1);
             return OPENBRACE;
         case '}':
-            charPos = m_position - 4;
+            charPos = m_currentOffset;
             shift(1);
             return CLOSEBRACE;

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23225: REGRESSION: Assertion failure in reparseInPlace() (m_sourceElements) at sfgate.com
+        <https://bugs.webkit.org/show_bug.cgi?id=23225> <rdar://problem/6487432>
+
+        Test to verify reparsing behaviour in the face of a BOM in the middle of the file.
+
+        * fast/js/bom-in-file-retains-correct-offset-expected.txt: Added.
+        * fast/js/bom-in-file-retains-correct-offset.html: Added.
+        * fast/js/resources/bom-in-file-retains-correct-offset.js: Added.
+
 2009-01-14  David Kilzer  <ddkilzer@apple.com>