Title: [280886] trunk
- Revision
- 280886
- Author
- [email protected]
- Date
- 2021-08-11 00:39:26 -0700 (Wed, 11 Aug 2021)
Log Message
WTFCrash in JSC::Lexer<char16_t>::append8
https://bugs.webkit.org/show_bug.cgi?id=228982
Reviewed by Mark Lam.
JSTests:
* stress/directive-includes-non-latin1.js: Added.
Source/_javascript_Core:
sourceURL / sourceMapURL directive should not assume Latin1 characters.
* parser/Lexer.cpp:
(JSC::Lexer<T>::parseCommentDirectiveValue):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (280885 => 280886)
--- trunk/JSTests/ChangeLog 2021-08-11 06:57:42 UTC (rev 280885)
+++ trunk/JSTests/ChangeLog 2021-08-11 07:39:26 UTC (rev 280886)
@@ -1,3 +1,12 @@
+2021-08-11 Yusuke Suzuki <[email protected]>
+
+ WTFCrash in JSC::Lexer<char16_t>::append8
+ https://bugs.webkit.org/show_bug.cgi?id=228982
+
+ Reviewed by Mark Lam.
+
+ * stress/directive-includes-non-latin1.js: Added.
+
2021-08-09 Yusuke Suzuki <[email protected]>
[JSC] super-Latin1 white space and line terminator after regular _expression_ literal misinterpreted as flags
Added: trunk/JSTests/stress/directive-includes-non-latin1.js (0 => 280886)
--- trunk/JSTests/stress/directive-includes-non-latin1.js (rev 0)
+++ trunk/JSTests/stress/directive-includes-non-latin1.js 2021-08-11 07:39:26 UTC (rev 280886)
@@ -0,0 +1,2 @@
+//# sourceURL=https://日本語.com/
+// Running this file should not crash on Debug build.
Modified: trunk/Source/_javascript_Core/ChangeLog (280885 => 280886)
--- trunk/Source/_javascript_Core/ChangeLog 2021-08-11 06:57:42 UTC (rev 280885)
+++ trunk/Source/_javascript_Core/ChangeLog 2021-08-11 07:39:26 UTC (rev 280886)
@@ -1,3 +1,15 @@
+2021-08-11 Yusuke Suzuki <[email protected]>
+
+ WTFCrash in JSC::Lexer<char16_t>::append8
+ https://bugs.webkit.org/show_bug.cgi?id=228982
+
+ Reviewed by Mark Lam.
+
+ sourceURL / sourceMapURL directive should not assume Latin1 characters.
+
+ * parser/Lexer.cpp:
+ (JSC::Lexer<T>::parseCommentDirectiveValue):
+
2021-08-10 Keith Miller <[email protected]>
CallFrame::returnPC should untag the return address before passing it to ReturnAddressPtr
Modified: trunk/Source/_javascript_Core/parser/Lexer.cpp (280885 => 280886)
--- trunk/Source/_javascript_Core/parser/Lexer.cpp 2021-08-11 06:57:42 UTC (rev 280885)
+++ trunk/Source/_javascript_Core/parser/Lexer.cpp 2021-08-11 07:39:26 UTC (rev 280886)
@@ -1842,9 +1842,13 @@
ALWAYS_INLINE String Lexer<T>::parseCommentDirectiveValue()
{
skipWhitespace();
+ bool hasNonLatin1 = false;
const T* stringStart = currentSourcePtr();
- while (!isWhiteSpace(m_current) && !isLineTerminator(m_current) && m_current != '"' && m_current != '\'' && !atEnd())
+ while (!isWhiteSpace(m_current) && !isLineTerminator(m_current) && m_current != '"' && m_current != '\'' && !atEnd()) {
+ if (!isLatin1(m_current))
+ hasNonLatin1 = true;
shift();
+ }
const T* stringEnd = currentSourcePtr();
skipWhitespace();
@@ -1851,9 +1855,17 @@
if (!isLineTerminator(m_current) && !atEnd())
return String();
- append8(stringStart, stringEnd - stringStart);
- String result = String(m_buffer8.data(), m_buffer8.size());
- m_buffer8.shrink(0);
+ unsigned length = stringEnd - stringStart;
+ if (hasNonLatin1) {
+ UChar* buffer = nullptr;
+ String result = StringImpl::createUninitialized(length, buffer);
+ StringImpl::copyCharacters(buffer, stringStart, length);
+ return result;
+ }
+
+ LChar* buffer = nullptr;
+ String result = StringImpl::createUninitialized(length, buffer);
+ StringImpl::copyCharacters(buffer, stringStart, length);
return result;
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
