Bug 158128 – JS parser incorrectly handles invalid utf8 in error messages.

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Oliver Hunt]

The bug occurs with an input like this:
eval('({m("\udeaf")})');


The initial parsing of this results in the \udeaf escape being converted to an actual literal. This is correct.
eval then parses that string, which results in a parse error while parsing the parameter list (string literals aren't valid parameter names).

The bug occurs when we try to actually set the error message:
failWithMessage("Expected a parameter pattern or a ')' in parameter list");

This tries to produce an error message that includes the bogus token:
Exception: SyntaxError: Unexpected string literal "<The failing token>". Expected a parameter pattern or a ')' in parameter list.

This string is produced via concatenation in PrintStringStream (or whatever it's called), which calls fromUTF8() on the buffer, because \udeaf isn't a valid utf8 sequence fromUTF8 fails and returns String().

The parser then checks the error state by checking errorMessage.isNull(), which it now is. This leads to the parser continuing in a bogus state and subsequently crashing.

[Oliver Hunt]

Created attachment 280373 [details]
Patch

[Oliver Hunt]

Committed r201624: <http://trac.webkit.org/changeset/201624>

[Oliver Hunt]

*** Bug 158082 has been marked as a duplicate of this bug. ***