Changeset 75872 in webkit for trunk/Source/JavaScriptCore/parser/JSParser.cpp

Timestamp:

Jan 14, 2011, 10:35:13 PM (14 years ago)

Author:

[email protected]

Message:

2011-01-14 Oliver Hunt <​[email protected]>

Reviewed by Maciej Stachowiak.

[jsfunfuzz] Incorrect handling of consecutive duplicate labels
​https://bugs.webkit.org/show_bug.cgi?id=52505

Add a few tests of consecutive labels containing duplicates to the parser check.

• fast/js/parser-syntax-check-expected.txt:
• fast/js/script-tests/parser-syntax-check.js:

2011-01-14 Oliver Hunt <​[email protected]>

Reviewed by Maciej Stachowiak.

[jsfunfuzz] Incorrect handling of consecutive duplicate labels
​https://bugs.webkit.org/show_bug.cgi?id=52505

Compare StringImpl*'s instead of Identifier*'s when looking for duplicate
labels.

• parser/JSParser.cpp: (JSC::JSParser::parseExpressionOrLabelStatement):

File:

• trunk/Source/JavaScriptCore/parser/JSParser.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/parser/JSParser.cpp

@@ -1309 +1309 @@
             // have never seen more than one label in a row in the real world.
             for (size_t i = 0; i < labels.size(); i++)
-                failIfTrue(ident == labels[i].m_ident);
+                failIfTrue(ident->impl() == labels[i].m_ident->impl());
             failIfTrue(getLabel(ident));
             labels.append(LabelInfo(ident, start, end));