[Webkit-unassigned] [Bug 158128] New: JS parser incorrectly handles invalid utf8 in error messages.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=158128

            Bug ID: 158128
           Summary: JS parser incorrectly handles invalid utf8 in error
                    messages.
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Keywords: EasyFix, HasReduction, NeedsRadar
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: oliver at apple.com
                CC: ggaren at apple.com, msaboff at apple.com, sbarati at apple.com

The bug occurs with an input like this:
eval('({m("\udeaf")})');


The initial parsing of this results in the \udeaf escape being converted to an actual literal. This is correct.
eval then parses that string, which results in a parse error while parsing the parameter list (string literals aren't valid parameter names).

The bug occurs when we try to actually set the error message:
failWithMessage("Expected a parameter pattern or a ')' in parameter list");

This tries to produce an error message that includes the bogus token:
Exception: SyntaxError: Unexpected string literal "<The failing token>". Expected a parameter pattern or a ')' in parameter list.

This string is produced via concatenation in PrintStringStream (or whatever it's called), which calls fromUTF8() on the buffer, because \udeaf isn't a valid utf8 sequence fromUTF8 fails and returns String().

The parser then checks the error state by checking errorMessage.isNull(), which it now is. This leads to the parser continuing in a bogus state and subsequently crashing.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160526/8fbce0d9/attachment.html>