Changeset 39942 in webkit for trunk/JavaScriptCore/parser/Lexer.cpp

Timestamp:

Jan 15, 2009, 1:15:24 PM (16 years ago)

Author:

[email protected]

Message:

Bug 23225: REGRESSION: Assertion failure in reparseInPlace() (m_sourceElements) at sfgate.com
<​https://bugs.webkit.org/show_bug.cgi?id=23225> <rdar://problem/6487432>

Reviewed by Geoff Garen

Character position for open and closing brace was incorrectly referencing m_position to
record their position in a source document, however this is unsafe as BOMs may lead to
m_position being an arbitrary position from the real position of the current character.

File:

• trunk/JavaScriptCore/parser/Lexer.cpp (modified) (1 diff)

trunk/JavaScriptCore/parser/Lexer.cpp

@@ -759 +759 @@
             return static_cast<int>(c1);
         case '{':
-            charPos = m_position - 4;
+            charPos = m_currentOffset;
             shift(1);
             return OPENBRACE;
         case '}':
-            charPos = m_position - 4;
+            charPos = m_currentOffset;
             shift(1);
             return CLOSEBRACE;