Bug 23479 – (r39682-r39736) JSFunFuzz: crash on "(function(){({ x2: x }), })()"

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Oliver Hunt]

1/22/09 9:38 AM Oliver Hunt:
* SUMMARY
The expression (function(){({ x2: x }), })() crashes due to reparsing failure, it should fail to parse on the first run

* STEPS TO REPRODUCE
1. Evaluate the expression (function(){({ x2: x }), })() in jsc or the browser

* RESULTS
Crashing badness

1/22/09 9:50 AM Oliver Hunt:
I've reduced the range where this started crashing, but the fact of the matter is that it should not be getting through the first parser

[Oliver Hunt]

<rdar://problem/6516853>

[Oliver Hunt]

Okay, the problem is that we incorrectly accept a comma after ()'s inside braces. why?

[Oliver Hunt]

Created attachment 26936 [details]
Fixeration for fun and profit

Fixerated

[Geoffrey Garen]

Comment on attachment 26936 [details]
Fixeration for fun and profit

r=me

[Oliver Hunt]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	JavaScriptCore/ChangeLog
	M	JavaScriptCore/bytecode/CodeBlock.cpp
	M	JavaScriptCore/parser/Lexer.h
	M	JavaScriptCore/parser/Nodes.h
	M	LayoutTests/ChangeLog
	M	LayoutTests/fast/js/reparsing-semicolon-insertion-expected.txt
	M	LayoutTests/fast/js/resources/reparsing-semicolon-insertion.js
Committed r40131