Title: [223093] branches/safari-604-branch

Diff

Modified: branches/safari-604-branch/JSTests/ChangeLog (223092 => 223093)


--- branches/safari-604-branch/JSTests/ChangeLog	2017-10-10 00:07:48 UTC (rev 223092)
+++ branches/safari-604-branch/JSTests/ChangeLog	2017-10-10 00:07:52 UTC (rev 223093)
@@ -1,3 +1,17 @@
+2017-10-02  Jason Marcell  <[email protected]>
+
+        Cherry-pick r221400. rdar://problem/34771396
+
+    2017-08-30  Saam Barati  <[email protected]>
+
+            semicolon is being interpreted as an = in the LiteralParser
+            https://bugs.webkit.org/show_bug.cgi?id=176114
+
+            Reviewed by Oliver Hunt.
+
+            * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
+            * stress/resources/literal-parser-test-case.js: Added.
+
 2017-09-12  Jason Marcell  <[email protected]>
 
         Cherry-pick r221711. rdar://problem/34404472

Added: branches/safari-604-branch/JSTests/stress/jsonp-literal-parser-semicolon-is-not-assignment.js (0 => 223093)


--- branches/safari-604-branch/JSTests/stress/jsonp-literal-parser-semicolon-is-not-assignment.js	                        (rev 0)
+++ branches/safari-604-branch/JSTests/stress/jsonp-literal-parser-semicolon-is-not-assignment.js	2017-10-10 00:07:52 UTC (rev 223093)
@@ -0,0 +1,4 @@
+x = undefined;
+load("./resources/literal-parser-test-case.js");
+if (x !== undefined)
+    throw new Error("Bad result");

Added: branches/safari-604-branch/JSTests/stress/resources/literal-parser-test-case.js (0 => 223093)


--- branches/safari-604-branch/JSTests/stress/resources/literal-parser-test-case.js	                        (rev 0)
+++ branches/safari-604-branch/JSTests/stress/resources/literal-parser-test-case.js	2017-10-10 00:07:52 UTC (rev 223093)
@@ -0,0 +1 @@
+x;1234

Modified: branches/safari-604-branch/Source/_javascript_Core/ChangeLog (223092 => 223093)


--- branches/safari-604-branch/Source/_javascript_Core/ChangeLog	2017-10-10 00:07:48 UTC (rev 223092)
+++ branches/safari-604-branch/Source/_javascript_Core/ChangeLog	2017-10-10 00:07:52 UTC (rev 223093)
@@ -1,3 +1,26 @@
+2017-10-02  Jason Marcell  <[email protected]>
+
+        Cherry-pick r221400. rdar://problem/34771396
+
+    2017-08-30  Saam Barati  <[email protected]>
+
+            semicolon is being interpreted as an = in the LiteralParser
+            https://bugs.webkit.org/show_bug.cgi?id=176114
+
+            Reviewed by Oliver Hunt.
+
+            When lexing a semicolon in the LiteralParser, we were properly
+            setting the TokenType on the current token, however, we were
+            *returning* the wrong TokenType. The lex function both returns
+            the TokenType and sets it on the current token. Semicolon was
+            setting the TokenType to semicolon, but returning the TokenType
+            for '='. This caused programs like `x;123` to be interpreted as
+            `x=123`.
+
+            * runtime/LiteralParser.cpp:
+            (JSC::LiteralParser<CharType>::Lexer::lex):
+            (JSC::LiteralParser<CharType>::Lexer::next):
+
 2017-09-12  Jason Marcell  <[email protected]>
 
         Cherry-pick r221711. rdar://problem/34404472

Modified: branches/safari-604-branch/Source/_javascript_Core/runtime/LiteralParser.cpp (223092 => 223093)


--- branches/safari-604-branch/Source/_javascript_Core/runtime/LiteralParser.cpp	2017-10-10 00:07:48 UTC (rev 223092)
+++ branches/safari-604-branch/Source/_javascript_Core/runtime/LiteralParser.cpp	2017-10-10 00:07:52 UTC (rev 223093)
@@ -272,7 +272,7 @@
         if (*m_ptr == ';') {
             token.type = TokSemi;
             token.end = ++m_ptr;
-            return TokAssign;
+            return TokSemi;
         }
         if (isASCIIAlpha(*m_ptr) || *m_ptr == '_' || *m_ptr == '$')
             return lexIdentifier(token);
@@ -317,11 +317,15 @@
 template <typename CharType>
 TokenType LiteralParser<CharType>::Lexer::next()
 {
+    TokenType result;
     if (m_mode == NonStrictJSON)
-        return lex<NonStrictJSON>(m_currentToken);
-    if (m_mode == JSONP)
-        return lex<JSONP>(m_currentToken);
-    return lex<StrictJSON>(m_currentToken);
+        result = lex<NonStrictJSON>(m_currentToken);
+    else if (m_mode == JSONP)
+        result = lex<JSONP>(m_currentToken);
+    else
+        result = lex<StrictJSON>(m_currentToken);
+    ASSERT(m_currentToken.type == result);
+    return result;
 }
 
 template <>
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to