Changeset 47828 in webkit for trunk/JavaScriptCore/runtime/LiteralParser.cpp

Timestamp:

Aug 27, 2009, 12:15:31 PM (16 years ago)

Author:

[email protected]

Message:

JSON parser accepts trailing comma in array literals
​https://bugs.webkit.org/show_bug.cgi?id=28779

Reviewed by Alexey Proskuryakov.

Update parser to correctly fail if there's a trailing comma.

File:

• trunk/JavaScriptCore/runtime/LiteralParser.cpp (modified) (1 diff)

trunk/JavaScriptCore/runtime/LiteralParser.cpp

@@ -296 +296 @@
             doParseArrayStartExpression:
             case DoParseArrayStartExpression: {
+                TokenType lastToken = m_lexer.currentToken().type;
                 if (m_lexer.next() == TokRBracket) {
+                    if (lastToken == TokComma)
+                        return JSValue();
                     m_lexer.next();
                     lastValue = objectStack.last();