Changeset 280825 in webkit for trunk/Source/JavaScriptCore/parser/Lexer.cpp

Timestamp:

Aug 9, 2021, 11:56:17 PM (4 years ago)

Author:

[email protected]

Message:

[JSC] super-Latin1 white space and line terminator after regular expression literal misinterpreted as flags
​https://bugs.webkit.org/show_bug.cgi?id=227944

Reviewed by Alexey Shvayka.

JSTests:

• test262/expectations.yaml:

Source/JavaScriptCore:

There are non-Latin1 white-spaces and line-terminators, but Lexer::scanRegExp's code did not assume that.
As a result, if there is a non-Latin1 white-spaces or line-terminators after RegExp, we raise SyntaxError
while this is valid. This patch fixes that.

• parser/Lexer.cpp:

(JSC::Lexer<T>::scanRegExp):

File:

• trunk/Source/JavaScriptCore/parser/Lexer.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/parser/Lexer.cpp

@@ -2658 +2658 @@
 
     // Normally this would not be a lex error but dealing with surrogate pairs here is annoying and it's going to be an error anyway...
-    if (UNLIKELY(!isLatin1(m_current))) {
+    if (UNLIKELY(!isLatin1(m_current) && !isWhiteSpace(m_current) && !isLineTerminator(m_current))) {
         m_buffer8.shrink(0);
         JSTokenType token = INVALID_IDENTIFIER_UNICODE_ERRORTOK;
@@ -2673 +2673 @@
     m_buffer8.shrink(0);
 
-    // Since RegExp always ends with /, m_atLineStart always becomes false.
+    // Since RegExp always ends with / or flags (IdentifierPart), m_atLineStart always becomes false.
     m_atLineStart = false;