The bug occurs with an input like this: eval('({m("\udeaf")})'); The initial parsing of this results in the \udeaf escape being converted to an actual literal. This is correct. eval then parses that string, which results in a parse error while parsing the parameter list (string literals aren't valid parameter names). The bug occurs when we try to actually set the error message: failWithMessage("Expected a parameter pattern or a ')' in parameter list"); This tries to produce an error message that includes the bogus token: Exception: SyntaxError: Unexpected string literal "<The failing token>". Expected a parameter pattern or a ')' in parameter list. This string is produced via concatenation in PrintStringStream (or whatever it's called), which calls fromUTF8() on the buffer, because \udeaf isn't a valid utf8 sequence fromUTF8 fails and returns String(). The parser then checks the error state by checking errorMessage.isNull(), which it now is. This leads to the parser continuing in a bogus state and subsequently crashing.
Created attachment 280373 [details] Patch
Committed r201624: <http://trac.webkit.org/changeset/201624>
*** Bug 158082 has been marked as a duplicate of this bug. ***