[SCM] WebKit Debian packaging branch, debian/unstable, updated. debian/1.1.18-1-697-g2f78b87
ap at apple.com
ap at apple.com
Wed Jan 20 22:23:17 UTC 2010
The following commit has been merged in the debian/unstable branch:
commit 89aea9e6860c1b7eb461ba24fe7b8d7b28c5e024
Author: ap at apple.com <ap at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Thu Jan 14 01:36:07 2010 +0000
Reviewed by Darin Adler.
https://bugs.webkit.org/show_bug.cgi?id=33641
Assertion failure in Lexer.cpp if input stream ends while in string escape
Test: fast/js/end-in-string-escape.html
* parser/Lexer.cpp: (JSC::Lexer::lex): Bail out quickly on end of stream, not giving the
assertion a chance to fire.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@53224 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 642471c..0364d6c 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-01-13 Alexey Proskuryakov <ap at apple.com>
+
+ Reviewed by Darin Adler.
+
+ https://bugs.webkit.org/show_bug.cgi?id=33641
+ Assertion failure in Lexer.cpp if input stream ends while in string escape
+
+ Test: fast/js/end-in-string-escape.html
+
+ * parser/Lexer.cpp: (JSC::Lexer::lex): Bail out quickly on end of stream, not giving the
+ assertion a chance to fire.
+
2010-01-13 Gavin Barraclough <barraclough at apple.com>
Reviewed by NOBODY (buildfix).
diff --git a/JavaScriptCore/parser/Lexer.cpp b/JavaScriptCore/parser/Lexer.cpp
index 9148230..83f56bd 100644
--- a/JavaScriptCore/parser/Lexer.cpp
+++ b/JavaScriptCore/parser/Lexer.cpp
@@ -639,6 +639,8 @@ inStringEscapeSequence:
shiftLineTerminator();
goto inString;
}
+ if (m_current == -1)
+ goto returnError;
record16(singleEscape(m_current));
shift1();
goto inString;
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index e38df49..5e538af 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2010-01-13 Alexey Proskuryakov <ap at apple.com>
+
+ Reviewed by Darin Adler.
+
+ https://bugs.webkit.org/show_bug.cgi?id=33641
+ Assertion failure in Lexer.cpp if input stream ends while in string escape
+
+ * fast/js/end-in-string-escape-expected.txt: Added.
+ * fast/js/end-in-string-escape.html: Added.
+ * fast/js/script-tests/end-in-string-escape.js: Added.
+
2010-01-13 Jon Honeycutt <jhoneycutt at apple.com>
MSAA: selected, selectable, extended selectable, and multiple
diff --git a/LayoutTests/fast/js/end-in-string-escape-expected.txt b/LayoutTests/fast/js/end-in-string-escape-expected.txt
new file mode 100644
index 0000000..957b940
--- /dev/null
+++ b/LayoutTests/fast/js/end-in-string-escape-expected.txt
@@ -0,0 +1,10 @@
+Test for bug 33641: Assertion failure in Lexer.cpp if input stream ends while in string escape.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Passed if no assertion failure.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/js/end-in-string-escape.html b/LayoutTests/fast/js/end-in-string-escape.html
new file mode 100644
index 0000000..3b5bfb0
--- /dev/null
+++ b/LayoutTests/fast/js/end-in-string-escape.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="resources/js-test-style.css">
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/end-in-string-escape.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/js/script-tests/end-in-string-escape.js b/LayoutTests/fast/js/script-tests/end-in-string-escape.js
new file mode 100644
index 0000000..5a1fd98
--- /dev/null
+++ b/LayoutTests/fast/js/script-tests/end-in-string-escape.js
@@ -0,0 +1,10 @@
+description('Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=33641">bug 33641</a>: Assertion failure in Lexer.cpp if input stream ends while in string escape.');
+
+debug("Passed if no assertion failure.");
+
+try {
+ eval('"\\');
+} catch (ex) {
+}
+
+var successfullyParsed = true;
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list