Title: [284830] branches/safari-612-branch
- Revision
- 284830
- Author
- [email protected]
- Date
- 2021-10-25 14:50:57 -0700 (Mon, 25 Oct 2021)
Log Message
Cherry-pick r283600. rdar://problem/84625586
Don't pass DontBuildStrings to next token after parsing an empty parameter list
https://bugs.webkit.org/show_bug.cgi?id=225094
<rdar://problem/77231778>
Reviewed by Yusuke Suzuki.
JSTests:
* stress/dont-pass-DontBuildStrings-when-building-empty-arguments-list.js: Added.
(main.a.prototype.g.toString.string_appeared_here):
(main.a):
(main):
Source/_javascript_Core:
We might need the string, it turns out!
* parser/Parser.cpp:
(JSC::Parser<LexerType>::parseArguments):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283600 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: branches/safari-612-branch/JSTests/ChangeLog (284829 => 284830)
--- branches/safari-612-branch/JSTests/ChangeLog 2021-10-25 21:50:54 UTC (rev 284829)
+++ branches/safari-612-branch/JSTests/ChangeLog 2021-10-25 21:50:57 UTC (rev 284830)
@@ -1,3 +1,43 @@
+2021-10-25 Null <[email protected]>
+
+ Cherry-pick r283600. rdar://problem/84625586
+
+ Don't pass DontBuildStrings to next token after parsing an empty parameter list
+ https://bugs.webkit.org/show_bug.cgi?id=225094
+ <rdar://problem/77231778>
+
+ Reviewed by Yusuke Suzuki.
+
+ JSTests:
+
+ * stress/dont-pass-DontBuildStrings-when-building-empty-arguments-list.js: Added.
+ (main.a.prototype.g.toString.string_appeared_here):
+ (main.a):
+ (main):
+
+ Source/_javascript_Core:
+
+ We might need the string, it turns out!
+
+ * parser/Parser.cpp:
+ (JSC::Parser<LexerType>::parseArguments):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283600 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-10-05 Saam Barati <[email protected]>
+
+ Don't pass DontBuildStrings to next token after parsing an empty parameter list
+ https://bugs.webkit.org/show_bug.cgi?id=225094
+ <rdar://problem/77231778>
+
+ Reviewed by Yusuke Suzuki.
+
+ * stress/dont-pass-DontBuildStrings-when-building-empty-arguments-list.js: Added.
+ (main.a.prototype.g.toString.string_appeared_here):
+ (main.a):
+ (main):
+
2021-10-18 Russell Epstein <[email protected]>
Cherry-pick r284348. rdar://problem/84398090
Added: branches/safari-612-branch/JSTests/stress/dont-pass-DontBuildStrings-when-building-empty-arguments-list.js (0 => 284830)
--- branches/safari-612-branch/JSTests/stress/dont-pass-DontBuildStrings-when-building-empty-arguments-list.js (rev 0)
+++ branches/safari-612-branch/JSTests/stress/dont-pass-DontBuildStrings-when-building-empty-arguments-list.js 2021-10-25 21:50:57 UTC (rev 284830)
@@ -0,0 +1,7 @@
+// This should not crash the parser.
+function main() {
+ class a {
+ g = [].toString()
+ 'a'(){}
+ }
+}
Modified: branches/safari-612-branch/Source/_javascript_Core/ChangeLog (284829 => 284830)
--- branches/safari-612-branch/Source/_javascript_Core/ChangeLog 2021-10-25 21:50:54 UTC (rev 284829)
+++ branches/safari-612-branch/Source/_javascript_Core/ChangeLog 2021-10-25 21:50:57 UTC (rev 284830)
@@ -1,5 +1,45 @@
2021-10-25 Null <[email protected]>
+ Cherry-pick r283600. rdar://problem/84625586
+
+ Don't pass DontBuildStrings to next token after parsing an empty parameter list
+ https://bugs.webkit.org/show_bug.cgi?id=225094
+ <rdar://problem/77231778>
+
+ Reviewed by Yusuke Suzuki.
+
+ JSTests:
+
+ * stress/dont-pass-DontBuildStrings-when-building-empty-arguments-list.js: Added.
+ (main.a.prototype.g.toString.string_appeared_here):
+ (main.a):
+ (main):
+
+ Source/_javascript_Core:
+
+ We might need the string, it turns out!
+
+ * parser/Parser.cpp:
+ (JSC::Parser<LexerType>::parseArguments):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283600 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2021-10-05 Saam Barati <[email protected]>
+
+ Don't pass DontBuildStrings to next token after parsing an empty parameter list
+ https://bugs.webkit.org/show_bug.cgi?id=225094
+ <rdar://problem/77231778>
+
+ Reviewed by Yusuke Suzuki.
+
+ We might need the string, it turns out!
+
+ * parser/Parser.cpp:
+ (JSC::Parser<LexerType>::parseArguments):
+
+2021-10-25 Null <[email protected]>
+
Cherry-pick r284699. rdar://problem/84340372
canDoFastSpread should also check that the Structure is from the global object we're watching
Modified: branches/safari-612-branch/Source/_javascript_Core/parser/Parser.cpp (284829 => 284830)
--- branches/safari-612-branch/Source/_javascript_Core/parser/Parser.cpp 2021-10-25 21:50:54 UTC (rev 284829)
+++ branches/safari-612-branch/Source/_javascript_Core/parser/Parser.cpp 2021-10-25 21:50:57 UTC (rev 284830)
@@ -4981,7 +4981,7 @@
consumeOrFailWithFlags(OPENPAREN, TreeBuilder::DontBuildStrings, "Expected opening '(' at start of argument list");
JSTokenLocation location(tokenLocation());
if (match(CLOSEPAREN)) {
- next(TreeBuilder::DontBuildStrings);
+ next();
return context.createArguments();
}
auto argumentsStart = m_token.m_startPosition;
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
