[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

Thu Apr 8 01:04:20 UTC 2010

The following commit has been merged in the webkit-1.2 branch:
commit fdbe981e8cdd9112bbd6701d9d7c57ccd74f2d1a
Author: ap at apple.com <ap at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Thu Jan 14 01:36:07 2010 +0000

            Reviewed by Darin Adler.
    
            https://bugs.webkit.org/show_bug.cgi?id=33641
            Assertion failure in Lexer.cpp if input stream ends while in string escape
    
            Test: fast/js/end-in-string-escape.html
    
            * parser/Lexer.cpp: (JSC::Lexer::lex): Bail out quickly on end of stream, not giving the
            assertion a chance to fire.
    
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53224 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 642471c..0364d6c 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-01-13  Alexey Proskuryakov  <ap at apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33641
+        Assertion failure in Lexer.cpp if input stream ends while in string escape
+
+        Test: fast/js/end-in-string-escape.html
+
+        * parser/Lexer.cpp: (JSC::Lexer::lex): Bail out quickly on end of stream, not giving the
+        assertion a chance to fire.
+
 2010-01-13  Gavin Barraclough  <barraclough at apple.com>
 
         Reviewed by NOBODY (buildfix).
diff --git a/JavaScriptCore/parser/Lexer.cpp b/JavaScriptCore/parser/Lexer.cpp
index 9148230..83f56bd 100644
--- a/JavaScriptCore/parser/Lexer.cpp
+++ b/JavaScriptCore/parser/Lexer.cpp
@@ -639,6 +639,8 @@ inStringEscapeSequence:
         shiftLineTerminator();
         goto inString;
     }
+    if (m_current == -1)
+        goto returnError;
     record16(singleEscape(m_current));
     shift1();
     goto inString;
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index e38df49..5e538af 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2010-01-13  Alexey Proskuryakov  <ap at apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=33641
+        Assertion failure in Lexer.cpp if input stream ends while in string escape
+
+        * fast/js/end-in-string-escape-expected.txt: Added.
+        * fast/js/end-in-string-escape.html: Added.
+        * fast/js/script-tests/end-in-string-escape.js: Added.
+
 2010-01-13  Jon Honeycutt  <jhoneycutt at apple.com>
 
         MSAA: selected, selectable, extended selectable, and multiple
diff --git a/LayoutTests/fast/js/end-in-string-escape-expected.txt b/LayoutTests/fast/js/end-in-string-escape-expected.txt
new file mode 100644
index 0000000..957b940
--- /dev/null
+++ b/LayoutTests/fast/js/end-in-string-escape-expected.txt
@@ -0,0 +1,10 @@
+Test for bug 33641: Assertion failure in Lexer.cpp if input stream ends while in string escape.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Passed if no assertion failure.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/js/end-in-string-escape.html b/LayoutTests/fast/js/end-in-string-escape.html
new file mode 100644
index 0000000..3b5bfb0
--- /dev/null
+++ b/LayoutTests/fast/js/end-in-string-escape.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="resources/js-test-style.css">
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/end-in-string-escape.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/js/script-tests/end-in-string-escape.js b/LayoutTests/fast/js/script-tests/end-in-string-escape.js
new file mode 100644
index 0000000..5a1fd98
--- /dev/null
+++ b/LayoutTests/fast/js/script-tests/end-in-string-escape.js
@@ -0,0 +1,10 @@
+description('Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=33641">bug 33641</a>: Assertion failure in Lexer.cpp if input stream ends while in string escape.');
+
+debug("Passed if no assertion failure.");
+
+try {
+    eval('"\\');
+} catch (ex) {
+}
+
+var successfullyParsed = true;

-- 
WebKit Debian packaging

