Changeset 39942 in webkit for trunk/JavaScriptCore

Timestamp:

Jan 15, 2009, 1:15:24 PM (16 years ago)

Author:

[email protected]

Message:

Bug 23225: REGRESSION: Assertion failure in reparseInPlace() (m_sourceElements) at sfgate.com
<​https://bugs.webkit.org/show_bug.cgi?id=23225> <rdar://problem/6487432>

Reviewed by Geoff Garen

Character position for open and closing brace was incorrectly referencing m_position to
record their position in a source document, however this is unsafe as BOMs may lead to
m_position being an arbitrary position from the real position of the current character.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• parser/Lexer.cpp (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-01-15  Oliver Hunt  <[email protected]>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23225: REGRESSION: Assertion failure in reparseInPlace() (m_sourceElements) at sfgate.com
+        <https://bugs.webkit.org/show_bug.cgi?id=23225> <rdar://problem/6487432>
+
+        Character position for open and closing brace was incorrectly referencing m_position to
+        record their position in a source document, however this is unsafe as BOMs may lead to
+        m_position being an arbitrary position from the real position of the current character.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::matchPunctuator):
+
 2009-01-14  David Kilzer  <[email protected]>
 

trunk/JavaScriptCore/parser/Lexer.cpp

@@ -759 +759 @@
             return static_cast<int>(c1);
         case '{':
-            charPos = m_position - 4;
+            charPos = m_currentOffset;
             shift(1);
             return OPENBRACE;
         case '}':
-            charPos = m_position - 4;
+            charPos = m_currentOffset;
             shift(1);
             return CLOSEBRACE;