Changeset 40131 in webkit for trunk/JavaScriptCore/parser/Lexer.h

Timestamp:

Jan 22, 2009, 1:07:14 PM (16 years ago)

Author:

[email protected]

Message:

<rdar://problem/6516853> (r39682-r39736) JSFunFuzz: crash on "(function(){({ x2: x }), })()"
<​https://bugs.webkit.org/show_bug.cgi?id=23479>

Reviewed by Geoff Garen.

Automatic semicolon insertion was resulting in this being accepted in the initial
nodeless parsing, but subsequent reparsing for code generation would fail, leading
to a crash. The solution is to ensure that reparsing a function performs parsing
in the same state as the initial parse. We do this by modifying the saved source
ranges to include rather than exclude the opening and closing braces.

File:

• trunk/JavaScriptCore/parser/Lexer.h (modified) (1 diff)

trunk/JavaScriptCore/parser/Lexer.h

@@ -89 +89 @@
 
         void clear();
-        SourceCode sourceCode(int openBrace, int closeBrace, int firstLine) { return SourceCode(m_source->provider(), openBrace + 1, closeBrace, firstLine); }
+        SourceCode sourceCode(int openBrace, int closeBrace, int firstLine) { return SourceCode(m_source->provider(), openBrace, closeBrace + 1, firstLine); }
 
     private: